Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MicroUpdate' = '%HOMEPATH%\Documents\MSDCSC\msdcsc.exe'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%HOMEPATH%\Documents\MSDCSC\msdcsc.exe'
- [HKCU\software\microsoft\windows\currentversion\run] '{4046SVFC-807430-4046ZB-4046ZBMJGX}' = '"%HOMEPATH%\Svchost.exe" ...'
- [HKCU\software\microsoft\windows\currentversion\run] '{ALLFG941-195011-HSSMN9-HSSMN94GJ5}' = '"%WINDIR%\Server.exe" ...'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'nvidiaDValueOn' = '%LOCALAPPDATA%\NVIDIA Local Drivers\DriversUpdateProcess_x64.exe'
Creates or modifies the following files
- %WINDIR%\taskse.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\{4046svfc-807430-4046zb-4046zbmjgx}.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\{allfg941-195011-hssmn9-hssmn94gj5}.exe
- <SYSTEM32>\tasks\system32filemanger
Creates the following files on removable media
- <Drive name for removable media>:\1.bat
- <Drive name for removable media>:\autorun.inf
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
- Windows Security Center
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%WINDIR%\Winrar.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Winrar.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%HOMEPATH%\Winrar'
Executes the following
- '%WINDIR%\syswow64\net.exe' stop "Security Center"
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable
- '%WINDIR%\syswow64\net.exe' stop MpsSvc
- '%WINDIR%\syswow64\taskkill.exe' /f /t /im FirewallControlPanel.exe
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode disable
- '%WINDIR%\syswow64\net.exe' stop ACKWIN32
- '%WINDIR%\syswow64\net.exe' stop ADVXDWIN
- '%WINDIR%\syswow64\net.exe' stop ALERTSVC
- '%WINDIR%\syswow64\net.exe' stop ALOGSERV
- '%WINDIR%\syswow64\net.exe' stop AMON9X
- '%WINDIR%\syswow64\net.exe' stop ANTI-TROJAN
- '%WINDIR%\syswow64\net.exe' stop ANTS
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\taskkill.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\1189.jpeg
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\region-north-karelia.jpg
- %HOMEPATH%\desktop\pushkin.jpg
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\parnas_01.jpg
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\tileimage.bmp
Modifies file system
Creates the following files
- %WINDIR%\onedrive.exe
- %HOMEPATH%\desktop\pushkin.jpg.wncryt
- %WINDIR%\m.vbs
- %HOMEPATH%\desktop\pushkin.jpeg.wncryt
- %HOMEPATH%\desktop\parnas_01.jpg.wncryt
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncryt
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx.wncryt
- %HOMEPATH%\desktop\february_catalogue__2015.doc.wncryt
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt
- %HOMEPATH%\desktop\adhd_and_obesity.docx.wncryt
- %HOMEPATH%\desktop\210252809.jpeg.wncryt
- %HOMEPATH%\desktop\1189.jpeg.wncryt
- %WINDIR%\@please_read_me@.txt
- %WINDIR%\21921700363060.bat
- %WINDIR%\@wanadecryptor@.exe
- %WINDIR%\00000000.res
- %WINDIR%\00000000.eky
- %WINDIR%\00000000.pky
- D:\autorun.inf
- D:\1.bat
- C:\autorun.inf
- C:\1.bat
- %HOMEPATH%\desktop\region-north-karelia.jpg.wncryt
- %HOMEPATH%\desktop\sdszfo.docx.wncryt
- %HOMEPATH%\svchost.exe
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wncryt
- %WINDIR%\syswow64\system32 manger\system.exe
- %HOMEPATH%\profilemanger\userprofile.exe
- C:\msreviewsvc\efoyui0asuqh.vbe
- C:\msreviewsvc\winperf.exe
- C:\msreviewsvc\4rd5bvtanpa5x0n2lls7qq6reb.bat
- nul
- %LOCALAPPDATA%\nvidia local drivers\driversupdateprocess_x64.exe
- %TEMP%\tmp698b.tmp.bat
- %APPDATA%\system32filemanger.exe
- <Current directory>\msg.vbs
- %WINDIR%\setup.exe
- %WINDIR%\system.exe
- %WINDIR%\server.exe
- %WINDIR%\disable.exe
- %WINDIR%\123.exe
- %WINDIR%\22.bat
- %WINDIR%\22#.cmd
- %WINDIR%\msedge.exe
- %TEMP%\cmd.bat
- %HOMEPATH%\documents\msdcsc\msdcsc.exe
- %HOMEPATH%\desktop\@wanadecryptor@.exe
- %HOMEPATH%\desktop\@please_read_me@.txt
- C:\msreviewsvc\lhq3biwjis3aus9519wlagd5tyws.bat
- %WINDIR%\smd.png
- %WINDIR%\xx1.bat
- %WINDIR%\xxx.exe
- %WINDIR%\msg\m_french.wnry
- %WINDIR%\msg\m_finnish.wnry
- %WINDIR%\msg\m_filipino.wnry
- %WINDIR%\msg\m_english.wnry
- %WINDIR%\msg\m_dutch.wnry
- %WINDIR%\msg\m_danish.wnry
- %WINDIR%\msg\m_czech.wnry
- %WINDIR%\msg\m_croatian.wnry
- %WINDIR%\svchost.exe
- %WINDIR%\msg\m_chinese (traditional).wnry
- %WINDIR%\msg\m_chinese (simplified).wnry
- %WINDIR%\msg\m_bulgarian.wnry
- %WINDIR%\c.wnry
- %WINDIR%\b.wnry
- <SYSTEM32>manger.exe
- %WINDIR%\sender.exe
- %WINDIR%\ts.exe
- %WINDIR%\run.exe
- %WINDIR%\userprofile.exe
- %WINDIR%\adop2020.exe
- %WINDIR%\winrar.exe
- %WINDIR%\msg\m_german.wnry
- %WINDIR%\msg\m_greek.wnry
- %WINDIR%\msg\m_indonesian.wnry
- %WINDIR%\msg\m_italian.wnry
- %WINDIR%\tsrunswindows.exe
- %WINDIR%\syswow64\config\rundll32.exe
- %WINDIR%\1.bat
- %WINDIR%\2.exe
- %WINDIR%\u.wnry
- %WINDIR%\taskdl.exe
- %WINDIR%\t.wnry
- %WINDIR%\s.wnry
- %WINDIR%\r.wnry
- %WINDIR%\msg\m_vietnamese.wnry
- %WINDIR%\msg\m_swedish.wnry
- %WINDIR%\msg\m_turkish.wnry
- %WINDIR%\msg\m_spanish.wnry
- %WINDIR%\msg\m_slovak.wnry
- %WINDIR%\msg\m_russian.wnry
- %WINDIR%\msg\m_romanian.wnry
- %WINDIR%\msg\m_portuguese.wnry
- %WINDIR%\msg\m_polish.wnry
- %WINDIR%\msg\m_norwegian.wnry
- %WINDIR%\msg\m_latvian.wnry
- %WINDIR%\msg\m_korean.wnry
- %WINDIR%\msg\m_japanese.wnry
- %WINDIR%\cute.bat
- C:\msreviewsvc\lcyj0hj8b0untiv7.vbe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\documents\msdcsc\msdcsc.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\{4046svfc-807430-4046zb-4046zbmjgx}.exe
- %WINDIR%\cute.bat
- %APPDATA%\microsoft\windows\start menu\programs\startup\{allfg941-195011-hssmn9-hssmn94gj5}.exe
- %WINDIR%\server.exe
- %LOCALAPPDATA%\nvidia local drivers\driversupdateprocess_x64.exe
Deletes the following files
- %WINDIR%\m.vbs
- %HOMEPATH%\svchost.exe
- %TEMP%\cmd.bat
- <Drive name for removable media>:\cveuropeo.doc.wncryt
- <Drive name for removable media>:\hanni_umami_chapter.doc.wncryt
Moves the following files
- from %HOMEPATH%\desktop\1189.jpeg.wncryt to %HOMEPATH%\desktop\1189.jpeg.wncry
- from %HOMEPATH%\desktop\210252809.jpeg.wncryt to %HOMEPATH%\desktop\210252809.jpeg.wncry
- from %HOMEPATH%\desktop\adhd_and_obesity.docx.wncryt to %HOMEPATH%\desktop\adhd_and_obesity.docx.wncry
- from %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncryt to %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx.wncry
- from %HOMEPATH%\desktop\february_catalogue__2015.doc.wncryt to %HOMEPATH%\desktop\february_catalogue__2015.doc.wncry
- from %HOMEPATH%\desktop\glidescope_review_rev_010.docx.wncryt to %HOMEPATH%\desktop\glidescope_review_rev_010.docx.wncry
- from %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncryt to %HOMEPATH%\desktop\issi2013_template_for_posters.docx.wncry
- from %HOMEPATH%\desktop\parnas_01.jpg.wncryt to %HOMEPATH%\desktop\parnas_01.jpg.wncry
- from %HOMEPATH%\desktop\pushkin.jpeg.wncryt to %HOMEPATH%\desktop\pushkin.jpeg.wncry
- from %HOMEPATH%\desktop\pushkin.jpg.wncryt to %HOMEPATH%\desktop\pushkin.jpg.wncry
- from %HOMEPATH%\desktop\region-north-karelia.jpg.wncryt to %HOMEPATH%\desktop\region-north-karelia.jpg.wncry
- from %HOMEPATH%\desktop\sdszfo.docx.wncryt to %HOMEPATH%\desktop\sdszfo.docx.wncry
- from %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wncryt to %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc.wncry
Modifies the following files
- %HOMEPATH%\desktop\1189.jpeg
- %HOMEPATH%\desktop\210252809.jpeg
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\parnas_01.jpg
- %HOMEPATH%\desktop\pushkin.jpeg
- %HOMEPATH%\desktop\pushkin.jpg
- %HOMEPATH%\desktop\region-north-karelia.jpg
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Substitutes the following files
- %TEMP%\cmd.bat
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
Connects to
- 'localhost':5552
- 'localhost':8080
- 'ch####p.dyndns.org':80
- 'localhost':1604
- 'wh#####oe.gl.at.ply.gg':63740
TCP
HTTP GET requests
- http://ch####p.dyndns.org/
UDP
- DNS ASK ch####p.dyndns.org
- DNS ASK wh#####oe.gl.at.ply.gg
- 'localhost':62660
- 'localhost':50226
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '#32770' WindowName: 'WinRAR self-extracting archive'
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '#32770' WindowName: 'RunDLL'
- ClassName: '#32770' WindowName: 'Windows'
Creates and executes the following
- '%WINDIR%\2.exe'
- '%WINDIR%\server.exe'
- '%WINDIR%\system.exe'
- '%WINDIR%\tsrunswindows.exe'
- '%WINDIR%\syswow64\config\rundll32.exe'
- '%WINDIR%\cute.bat'
- '%WINDIR%\123.exe'
- '%WINDIR%\xxx.exe'
- '%WINDIR%\disable.exe'
- '%WINDIR%\taskdl.exe'
- '%HOMEPATH%\svchost.exe'
- '%WINDIR%\svchost.exe'
- '%HOMEPATH%\documents\msdcsc\msdcsc.exe'
- '%WINDIR%\setup.exe'
- '<SYSTEM32>manger.exe'
- '%APPDATA%\system32filemanger.exe'
- '%WINDIR%\adop2020.exe'
- '%HOMEPATH%\profilemanger\userprofile.exe'
- '%WINDIR%\syswow64\wscript.exe' "C:\msreviewsvc\efOYui0Asuqh.vbe"
- '%WINDIR%\run.exe'
- '%WINDIR%\userprofile.exe'
- '%WINDIR%\ts.exe'
- '%WINDIR%\winrar.exe'
- '%WINDIR%\onedrive.exe'
- '%WINDIR%\sender.exe'
- '%WINDIR%\msedge.exe'
- '%WINDIR%\syswow64\wscript.exe' "C:\msreviewsvc\lcyj0hJ8B0UNtIV7.vbe"
- '%WINDIR%\syswow64\notepad.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k attrib "%WINDIR%" +s +h' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\22#.cmd" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\22.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\msreviewsvc\Lhq3bIWJis3Aus9519WLAGD5tYws.bat" "' (with hidden window)
- '%WINDIR%\123.exe' ' (with hidden window)
- '%WINDIR%\server.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'%HOMEPATH%\ProfileManger\UserProfile.exe'"' (with hidden window)
- '%WINDIR%\adop2020.exe' ' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHMAYgBoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcAegB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
- '%WINDIR%\msedge.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Winrar.exe'' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "System32FileManger" /tr '"%APPDATA%\System32FileManger.exe"' & exit' (with hidden window)
- '%WINDIR%\disable.exe' ' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHUAYQB1ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AYQBpACMAPgBbAFMAeQBzAHQAZQBtAC4A...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /k attrib "%WINDIR%\cute.bat" +s +h' (with hidden window)
- '%WINDIR%\onedrive.exe' ' (with hidden window)
- '%WINDIR%\winrar.exe' ' (with hidden window)
- '%WINDIR%\system.exe' ' (with hidden window)
- '%WINDIR%\setup.exe' ' (with hidden window)
- '%WINDIR%\syswow64\attrib.exe' +h .' (with hidden window)
- '%WINDIR%\tsrunswindows.exe' ' (with hidden window)
- '%WINDIR%\ts.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\1.bat" "' (with hidden window)
- '%WINDIR%\sender.exe' ' (with hidden window)
- '<SYSTEM32>manger.exe' ' (with hidden window)
- '%WINDIR%\svchost.exe' ' (with hidden window)
- '%WINDIR%\notepad.exe' ' (with hidden window)
- '%WINDIR%\2.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%WINDIR%\Winrar.exe'' (with hidden window)
- '%WINDIR%\userprofile.exe' ' (with hidden window)
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q' (with hidden window)
- '%WINDIR%\syswow64\config\rundll32.exe' ' (with hidden window)
- '%WINDIR%\cute.bat' ' (with hidden window)
- '%WINDIR%\xxx.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\xx1.bat" "' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGkAdgBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGIAcgBhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...' (with hidden window)
- '%WINDIR%\taskdl.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c 21921700363060.bat' (with hidden window)
- '%WINDIR%\run.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\msreviewsvc\4RD5bVTaNPA5x0n2llS7Qq6rEb.bat" "' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%HOMEPATH%\Winrar'' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHMAYgBoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHcAegB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '<SYSTEM32>\timeout.exe' 3
- '%WINDIR%\syswow64\notepad.exe'
- '<SYSTEM32>\schtasks.exe' /create /f /sc onlogon /rl highest /tn "System32FileManger" /tr '"%APPDATA%\System32FileManger.exe"'
- '%WINDIR%\syswow64\rundll32.exe' (USER32.DLL, SwapMouseButton)
- '%WINDIR%\syswow64\rundll32.exe' USER32.DLL,SwapMouseButton
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'%HOMEPATH%\ProfileManger\UserProfile.exe'"
- '<SYSTEM32>\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "System32FileManger" /tr '"%APPDATA%\System32FileManger.exe"' & exit
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmp698B.tmp.bat""
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'System';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'System' -Value...
- '%WINDIR%\syswow64\net1.exe' stop ADVXDWIN
- '%WINDIR%\syswow64\reg.exe' add /v /t "REG_SZ" /d "%WINDIR%\22.bat" /f
- '%WINDIR%\syswow64\net1.exe' stop ALERTSVC
- '%WINDIR%\syswow64\net1.exe' stop ALOGSERV
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\msreviewsvc\Lhq3bIWJis3Aus9519WLAGD5tYws.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\msreviewsvc\4RD5bVTaNPA5x0n2llS7Qq6rEb.bat" "
- '%WINDIR%\syswow64\net1.exe' stop ACKWIN32
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL <Current directory>\nul
- '%WINDIR%\syswow64\net1.exe' stop MpsSvc
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL <Current directory>\msg.vbs
- '%WINDIR%\syswow64\attrib.exe' +h .
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\1.bat" "
- '%WINDIR%\syswow64\icacls.exe' . /grant Everyone:F /T /C /Q
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\xx1.bat" "
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHUAYQB1ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AYQBpACMAPgBbAFMAeQBzAHQAZQBtAC4A...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAGkAdgBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGIAcgBhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwA...
- '%WINDIR%\syswow64\cmd.exe' /c 21921700363060.bat
- '%WINDIR%\notepad.exe'
- '%WINDIR%\syswow64\cscript.exe' //nologo m.vbs
- '%WINDIR%\syswow64\cmd.exe' /k attrib "%WINDIR%" +s +h
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\22#.cmd" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\22.bat" "
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\cmd.bat" "
- '%WINDIR%\syswow64\net1.exe' stop "Security Center"
- '%WINDIR%\syswow64\attrib.exe' "%WINDIR%\cute.bat" +s +h
- '%WINDIR%\syswow64\attrib.exe' "%WINDIR%" +s +h
- '%WINDIR%\syswow64\cmd.exe' /k attrib "%WINDIR%\cute.bat" +s +h
- '%WINDIR%\syswow64\net1.exe' stop AMON9X
- '%WINDIR%\syswow64\net1.exe' stop ANTI-TROJAN