Trojan.Siggen.14287

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%WINDIR%\Tasks\At203.job
%WINDIR%\Tasks\At204.job
%WINDIR%\Tasks\At201.job
%WINDIR%\Tasks\At202.job
%WINDIR%\Tasks\At205.job
%WINDIR%\Tasks\At208.job
%WINDIR%\Tasks\At209.job
%WINDIR%\Tasks\At206.job
%WINDIR%\Tasks\At207.job
%WINDIR%\Tasks\At200.job
%WINDIR%\Tasks\At193.job
%WINDIR%\Tasks\At194.job
%WINDIR%\Tasks\At191.job
%WINDIR%\Tasks\At192.job
%WINDIR%\Tasks\At195.job
%WINDIR%\Tasks\At198.job
%WINDIR%\Tasks\At199.job
%WINDIR%\Tasks\At196.job
%WINDIR%\Tasks\At197.job
%WINDIR%\Tasks\At222.job
%WINDIR%\Tasks\At223.job
%WINDIR%\Tasks\At220.job
%WINDIR%\Tasks\At221.job
%WINDIR%\Tasks\At224.job
%WINDIR%\Tasks\At227.job
%WINDIR%\Tasks\At228.job
%WINDIR%\Tasks\At225.job
%WINDIR%\Tasks\At226.job
%WINDIR%\Tasks\At219.job
%WINDIR%\Tasks\At212.job
%WINDIR%\Tasks\At213.job
%WINDIR%\Tasks\At210.job
%WINDIR%\Tasks\At211.job
%WINDIR%\Tasks\At214.job
%WINDIR%\Tasks\At217.job
%WINDIR%\Tasks\At218.job
%WINDIR%\Tasks\At215.job
%WINDIR%\Tasks\At216.job
%WINDIR%\Tasks\At165.job
%WINDIR%\Tasks\At166.job
%WINDIR%\Tasks\At163.job
%WINDIR%\Tasks\At164.job
%WINDIR%\Tasks\At167.job
%WINDIR%\Tasks\At170.job
%WINDIR%\Tasks\At171.job
%WINDIR%\Tasks\At168.job
%WINDIR%\Tasks\At169.job
%WINDIR%\Tasks\At162.job
%WINDIR%\Tasks\At155.job
%WINDIR%\Tasks\At156.job
%WINDIR%\Tasks\At153.job
%WINDIR%\Tasks\At154.job
%WINDIR%\Tasks\At157.job
%WINDIR%\Tasks\At160.job
%WINDIR%\Tasks\At161.job
%WINDIR%\Tasks\At158.job
%WINDIR%\Tasks\At159.job
%WINDIR%\Tasks\At184.job
%WINDIR%\Tasks\At185.job
%WINDIR%\Tasks\At182.job
%WINDIR%\Tasks\At183.job
%WINDIR%\Tasks\At186.job
%WINDIR%\Tasks\At189.job
%WINDIR%\Tasks\At190.job
%WINDIR%\Tasks\At187.job
%WINDIR%\Tasks\At188.job
%WINDIR%\Tasks\At181.job
%WINDIR%\Tasks\At174.job
%WINDIR%\Tasks\At175.job
%WINDIR%\Tasks\At172.job
%WINDIR%\Tasks\At173.job
%WINDIR%\Tasks\At176.job
%WINDIR%\Tasks\At179.job
%WINDIR%\Tasks\At180.job
%WINDIR%\Tasks\At177.job
%WINDIR%\Tasks\At178.job
%WINDIR%\Tasks\At279.job
%WINDIR%\Tasks\At280.job
%WINDIR%\Tasks\At277.job
%WINDIR%\Tasks\At278.job
%WINDIR%\Tasks\At281.job
%WINDIR%\Tasks\At284.job
%WINDIR%\Tasks\At285.job
%WINDIR%\Tasks\At282.job
%WINDIR%\Tasks\At283.job
%WINDIR%\Tasks\At276.job
%WINDIR%\Tasks\At269.job
%WINDIR%\Tasks\At270.job
%WINDIR%\Tasks\At267.job
%WINDIR%\Tasks\At268.job
%WINDIR%\Tasks\At271.job
%WINDIR%\Tasks\At274.job
%WINDIR%\Tasks\At275.job
%WINDIR%\Tasks\At272.job
%WINDIR%\Tasks\At273.job
%WINDIR%\Tasks\At298.job
%WINDIR%\Tasks\At299.job
%WINDIR%\Tasks\At296.job
%WINDIR%\Tasks\At297.job
%WINDIR%\Tasks\At300.job
%WINDIR%\Tasks\At303.job
%WINDIR%\Tasks\At304.job
%WINDIR%\Tasks\At301.job
%WINDIR%\Tasks\At302.job
%WINDIR%\Tasks\At295.job
%WINDIR%\Tasks\At288.job
%WINDIR%\Tasks\At289.job
%WINDIR%\Tasks\At286.job
%WINDIR%\Tasks\At287.job
%WINDIR%\Tasks\At290.job
%WINDIR%\Tasks\At293.job
%WINDIR%\Tasks\At294.job
%WINDIR%\Tasks\At291.job
%WINDIR%\Tasks\At292.job
%WINDIR%\Tasks\At241.job
%WINDIR%\Tasks\At242.job
%WINDIR%\Tasks\At239.job
%WINDIR%\Tasks\At240.job
%WINDIR%\Tasks\At243.job
%WINDIR%\Tasks\At246.job
%WINDIR%\Tasks\At247.job
%WINDIR%\Tasks\At244.job
%WINDIR%\Tasks\At245.job
%WINDIR%\Tasks\At238.job
%WINDIR%\Tasks\At231.job
%WINDIR%\Tasks\At232.job
%WINDIR%\Tasks\At229.job
%WINDIR%\Tasks\At230.job
%WINDIR%\Tasks\At233.job
%WINDIR%\Tasks\At236.job
%WINDIR%\Tasks\At237.job
%WINDIR%\Tasks\At234.job
%WINDIR%\Tasks\At235.job
%WINDIR%\Tasks\At260.job
%WINDIR%\Tasks\At261.job
%WINDIR%\Tasks\At258.job
%WINDIR%\Tasks\At259.job
%WINDIR%\Tasks\At262.job
%WINDIR%\Tasks\At265.job
%WINDIR%\Tasks\At266.job
%WINDIR%\Tasks\At263.job
%WINDIR%\Tasks\At264.job
%WINDIR%\Tasks\At257.job
%WINDIR%\Tasks\At250.job
%WINDIR%\Tasks\At251.job
%WINDIR%\Tasks\At248.job
%WINDIR%\Tasks\At249.job
%WINDIR%\Tasks\At252.job
%WINDIR%\Tasks\At255.job
%WINDIR%\Tasks\At256.job
%WINDIR%\Tasks\At253.job
%WINDIR%\Tasks\At254.job
%WINDIR%\Tasks\At51.job
%WINDIR%\Tasks\At52.job
%WINDIR%\Tasks\At49.job
%WINDIR%\Tasks\At50.job
%WINDIR%\Tasks\At53.job
%WINDIR%\Tasks\At56.job
%WINDIR%\Tasks\At57.job
%WINDIR%\Tasks\At54.job
%WINDIR%\Tasks\At55.job
%WINDIR%\Tasks\At48.job
%WINDIR%\Tasks\At41.job
%WINDIR%\Tasks\At42.job
%WINDIR%\Tasks\At39.job
%WINDIR%\Tasks\At40.job
%WINDIR%\Tasks\At43.job
%WINDIR%\Tasks\At46.job
%WINDIR%\Tasks\At47.job
%WINDIR%\Tasks\At44.job
%WINDIR%\Tasks\At45.job
%WINDIR%\Tasks\At70.job
%WINDIR%\Tasks\At71.job
%WINDIR%\Tasks\At68.job
%WINDIR%\Tasks\At69.job
%WINDIR%\Tasks\At72.job
%WINDIR%\Tasks\At75.job
%WINDIR%\Tasks\At76.job
%WINDIR%\Tasks\At73.job
%WINDIR%\Tasks\At74.job
%WINDIR%\Tasks\At67.job
%WINDIR%\Tasks\At60.job
%WINDIR%\Tasks\At61.job
%WINDIR%\Tasks\At58.job
%WINDIR%\Tasks\At59.job
%WINDIR%\Tasks\At62.job
%WINDIR%\Tasks\At65.job
%WINDIR%\Tasks\At66.job
%WINDIR%\Tasks\At63.job
%WINDIR%\Tasks\At64.job
%WINDIR%\Tasks\At13.job
%WINDIR%\Tasks\At14.job
%WINDIR%\Tasks\At11.job
%WINDIR%\Tasks\At12.job
%WINDIR%\Tasks\At15.job
%WINDIR%\Tasks\At18.job
%WINDIR%\Tasks\At19.job
%WINDIR%\Tasks\At16.job
%WINDIR%\Tasks\At17.job
%WINDIR%\Tasks\At10.job
%WINDIR%\Tasks\At3.job
%WINDIR%\Tasks\At4.job
%WINDIR%\Tasks\At1.job
%WINDIR%\Tasks\At2.job
%WINDIR%\Tasks\At5.job
%WINDIR%\Tasks\At8.job
%WINDIR%\Tasks\At9.job
%WINDIR%\Tasks\At6.job
%WINDIR%\Tasks\At7.job
%WINDIR%\Tasks\At32.job
%WINDIR%\Tasks\At33.job
%WINDIR%\Tasks\At30.job
%WINDIR%\Tasks\At31.job
%WINDIR%\Tasks\At34.job
%WINDIR%\Tasks\At37.job
%WINDIR%\Tasks\At38.job
%WINDIR%\Tasks\At35.job
%WINDIR%\Tasks\At36.job
%WINDIR%\Tasks\At29.job
%WINDIR%\Tasks\At22.job
%WINDIR%\Tasks\At23.job
%WINDIR%\Tasks\At20.job
%WINDIR%\Tasks\At21.job
%WINDIR%\Tasks\At24.job
%WINDIR%\Tasks\At27.job
%WINDIR%\Tasks\At28.job
%WINDIR%\Tasks\At25.job
%WINDIR%\Tasks\At26.job
%WINDIR%\Tasks\At127.job
%WINDIR%\Tasks\At128.job
%WINDIR%\Tasks\At125.job
%WINDIR%\Tasks\At126.job
%WINDIR%\Tasks\At129.job
%WINDIR%\Tasks\At132.job
%WINDIR%\Tasks\At133.job
%WINDIR%\Tasks\At130.job
%WINDIR%\Tasks\At131.job
%WINDIR%\Tasks\At124.job
%WINDIR%\Tasks\At117.job
%WINDIR%\Tasks\At118.job
%WINDIR%\Tasks\At115.job
%WINDIR%\Tasks\At116.job
%WINDIR%\Tasks\At119.job
%WINDIR%\Tasks\At122.job
%WINDIR%\Tasks\At123.job
%WINDIR%\Tasks\At120.job
%WINDIR%\Tasks\At121.job
%WINDIR%\Tasks\At146.job
%WINDIR%\Tasks\At147.job
%WINDIR%\Tasks\At144.job
%WINDIR%\Tasks\At145.job
%WINDIR%\Tasks\At148.job
%WINDIR%\Tasks\At151.job
%WINDIR%\Tasks\At152.job
%WINDIR%\Tasks\At149.job
%WINDIR%\Tasks\At150.job
%WINDIR%\Tasks\At143.job
%WINDIR%\Tasks\At136.job
%WINDIR%\Tasks\At137.job
%WINDIR%\Tasks\At134.job
%WINDIR%\Tasks\At135.job
%WINDIR%\Tasks\At138.job
%WINDIR%\Tasks\At141.job
%WINDIR%\Tasks\At142.job
%WINDIR%\Tasks\At139.job
%WINDIR%\Tasks\At140.job
%WINDIR%\Tasks\At89.job
%WINDIR%\Tasks\At90.job
%WINDIR%\Tasks\At87.job
%WINDIR%\Tasks\At88.job
%WINDIR%\Tasks\At91.job
%WINDIR%\Tasks\At94.job
%WINDIR%\Tasks\At95.job
%WINDIR%\Tasks\At92.job
%WINDIR%\Tasks\At93.job
%WINDIR%\Tasks\At86.job
%WINDIR%\Tasks\At79.job
%WINDIR%\Tasks\At80.job
%WINDIR%\Tasks\At77.job
%WINDIR%\Tasks\At78.job
%WINDIR%\Tasks\At81.job
%WINDIR%\Tasks\At84.job
%WINDIR%\Tasks\At85.job
%WINDIR%\Tasks\At82.job
%WINDIR%\Tasks\At83.job
%WINDIR%\Tasks\At108.job
%WINDIR%\Tasks\At109.job
%WINDIR%\Tasks\At106.job
%WINDIR%\Tasks\At107.job
%WINDIR%\Tasks\At110.job
%WINDIR%\Tasks\At113.job
%WINDIR%\Tasks\At114.job
%WINDIR%\Tasks\At111.job
%WINDIR%\Tasks\At112.job
%WINDIR%\Tasks\At105.job
%WINDIR%\Tasks\At98.job
%WINDIR%\Tasks\At99.job
%WINDIR%\Tasks\At96.job
%WINDIR%\Tasks\At97.job
%WINDIR%\Tasks\At100.job
%WINDIR%\Tasks\At103.job
%WINDIR%\Tasks\At104.job
%WINDIR%\Tasks\At101.job
%WINDIR%\Tasks\At102.job

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

Creates and executes the following:

<SYSTEM32>\systen32.exe 19:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 19:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 20:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 17:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 18:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 23:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 21:30 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 22:30 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 23:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 20:30 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 23:30 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 01:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe <SYSTEM32>\WIN.bat +s +h
<SYSTEM32>\systen32.exe 00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 00:30 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 16:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 17:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 14:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 15:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 18:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 21:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 22:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 19:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 20:00:00 /every:m,t,w,th,f,s,su cmd /c <SYSTEM32>\WIN.bat
<SYSTEM32>\systen32.exe 23:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 21:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 23:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 22:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 11:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe /del /y
<SYSTEM32>\systen32.exe 9:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 9:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 10:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 15:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 16:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 12:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:054:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:033:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:036:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:027:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:030:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:039:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:051:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:042:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:045:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:06:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 13:057:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:03:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:012:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:021:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:024:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:015:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\systen32.exe 14:018:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll

Executes the following:

<SYSTEM32>\sc.exe 21:09:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\ipconfig.exe /all
<SYSTEM32>\reg.exe 20:048:00 /every:m,t,w,th,f,s,su cmd /c cmd <<SYSTEM32>\Attusb.dll
<SYSTEM32>\net1.exe stop sharedaccess
<SYSTEM32>\sc.exe stop sharedaccess
<SYSTEM32>\findstr.exe "Address" <SYSTEM32>\a.txt
<SYSTEM32>\attrib.exe <SYSTEM32>\Attusb.dll +s +h
<SYSTEM32>\attrib.exe <SYSTEM32>\autousb.bat +s +h
<SYSTEM32>\attrib.exe <SYSTEM32>\mail3.vbe +s +h
<SYSTEM32>\findstr.exe "IP " <SYSTEM32>\b.txt
<SYSTEM32>\wscript.exe "<SYSTEM32>\mail3.vbe"
<SYSTEM32>\net.exe stop sharedaccess
<SYSTEM32>\find.exe /i "cmd /c cmd"
<SYSTEM32>\sc.exe config schedule start= auto
<SYSTEM32>\at.exe 1
%WINDIR%\explorer.exe <Virus name>
<SYSTEM32>\cmd.exe /c <SYSTEM32>\idnd.bat
<SYSTEM32>\net1.exe start schedule
<SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\Currentversion\Explorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\Currentversion\Explorer\Advanced /v HideFileExt /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\Currentversion\Explorer\Advanced /v Hidden /t REG_DWORD /d 0 /f
<SYSTEM32>\sc.exe start schedule
<SYSTEM32>\at.exe 19:53 cmd /c cmd <<SYSTEM32>\ativcox.DLL

Injects code into

the following system processes:

<SYSTEM32>\sc.exe
<SYSTEM32>\net.exe
<SYSTEM32>\reg.exe

Modifies file system :

Creates the following files:

<SYSTEM32>\systen32.exe
<SYSTEM32>\dd.bat
<SYSTEM32>\WIN.bat
<SYSTEM32>\a.txt
<SYSTEM32>\mailbody.txt
<SYSTEM32>\c.txt
<SYSTEM32>\b.txt
<SYSTEM32>\idnd.bat
<SYSTEM32>\down.exe
<SYSTEM32>\ativcox.DLL
<SYSTEM32>\autousb.bat
<SYSTEM32>\Attusb.dll
<SYSTEM32>\mail3.vbe

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\autousb.bat
<SYSTEM32>\WIN.bat
<SYSTEM32>\mail3.vbe
<SYSTEM32>\Attusb.dll

Deletes the following files:

<SYSTEM32>\b.txt
<SYSTEM32>\c.txt
<SYSTEM32>\dd.bat
%TEMP%\~DF54A1.tmp
%WINDIR%\Tasks\At1.job
<SYSTEM32>\a.txt

Network activity:

Connects to:

'sm##.tom.com':25

UDP:

DNS ASK sm##.tom.com

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial