Trojan.Siggen12.44693

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\mipygvcjzdkkyb.exe

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Full path to file>' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\cGDxJTbVDE.exe' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\mIPYGvcjzDkKYB.exe' = '00000000'

Searches for registry branches where third party applications store passwords

[<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Internet Account Manager\Accounts]
[<HKLM>\Software\Wow6432Node\Microsoft\Internet Account Manager]
[<HKLM>\Software\Microsoft\Internet Account Manager]
[<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%LOCALAPPDATA%\google\chrome\user data\default\cookies
%APPDATA%\opera software\opera stable\login data

Modifies file system

Creates the following files

%LOCALAPPDATA%\⎄⎖⍹⎆⍵⍧⎛⎒⍵⍨⍻⎃⍪⎃⎙⍯⎎⎚⎙⎉⍺⍲⍪⎄⍦\<File name>.exe_url_rbqr0jds1jpf51whbql2onhxmsvf1xbm\1.295.136.456\55u3inrr.newcfg
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l2-1-0.dll
%TEMP%\yvehki8yvh.exe
%TEMP%\cgdxjtbvde.exe
%LOCALAPPDATA%low\zeumhygkxgf.zip
%LOCALAPPDATA%low\screen.jpeg
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\mj87ihs13-shm
%LOCALAPPDATA%low\mj87ihs13
%LOCALAPPDATA%low\ecskp3gpm-shm
%LOCALAPPDATA%low\ecskp3gpm
%LOCALAPPDATA%low\jjwmrdi0p-shm
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\jjwmrdi0p
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-handle-l1-1-0.dll
nul
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssdbm3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ws7zn1lk8tw5ce9s.zip
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%LOCALAPPDATA%low\chrome_urls.txt
%LOCALAPPDATA%low\xrpmcarcr4
%LOCALAPPDATA%low\idcdjoyapn
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%low\sqlite3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\prldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\qipcap.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\softokn3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ucrtbase.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssckbi.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nss3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\msvcp140.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32_inuse.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozglue.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy_inuse.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\libegl.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\lgpllibs.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldif60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ia2marshal.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\freebl3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\breakpadinjector.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblemarshal.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblehandler.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\vcruntime140.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%\箻箥箕箨箄箻箮箴箄箭箘箹箲箕箯箸箝箥箍箯箵箌箰箴箮\cgdxjtbvde.exe_url_m0bhzcb5k5q1rp1aiukx05nmmzfdsg4y\5.10.997.124\nfmhmsjo.newcfg

Deletes the following files

%LOCALAPPDATA%low\fraqbc8wsa
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-utility-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-time-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-stdio-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-runtime-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-process-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-private-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-multibyte-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-math-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-locale-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-heap-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-filesystem-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-environment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-convert-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-crt-conio-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-util-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-sysinfo-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\breakpadinjector.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\freebl3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ucrtbase.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\softokn3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\qipcap.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\prldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssdbm3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nssckbi.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\nss3.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\msvcp140.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-heap-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozglue.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy_inuse.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mapiproxy.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\libegl.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\lgpllibs.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldif60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ldap60.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ia2marshal.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-synch-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-string-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-rtlsupport-l1-1-0.dll
%LOCALAPPDATA%low\ecskp3gpm-shm
%LOCALAPPDATA%low\jjwmrdi0p
%LOCALAPPDATA%low\jjwmrdi0p-shm
%LOCALAPPDATA%low\fraqbc8ws
%LOCALAPPDATA%low\fraqbc8ws-shm
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\ws7zn1lk8tw5ce9s.zip
%LOCALAPPDATA%low\xrpmcarcr4
%LOCALAPPDATA%low\idcdjoyapn
%LOCALAPPDATA%low\bbsqwy6yhk
%LOCALAPPDATA%low\gxix4a2dre
%LOCALAPPDATA%low\exuieaoeii
%LOCALAPPDATA%low\3solbph71y
%LOCALAPPDATA%low\x3cf3ednhm
%LOCALAPPDATA%low\rqf69azbla
%LOCALAPPDATA%low\rywtiizs2t
%LOCALAPPDATA%low\1xvpfvjcrg
%LOCALAPPDATA%low\mj87ihs13-shm
%LOCALAPPDATA%low\mj87ihs13
%LOCALAPPDATA%low\ecskp3gpm
%LOCALAPPDATA%low\firefox_urls.txt
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-profile-l1-1-0.dll
%LOCALAPPDATA%low\chrome_urls.txt
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-1.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processthreads-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-processenvironment-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-namedpipe-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-memory-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-localization-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-libraryloader-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\mozmapi32_inuse.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\vcruntime140.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-handle-l1-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l2-1-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-file-l1-2-0.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblemarshal.dll
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\accessiblehandler.dll
%LOCALAPPDATA%low\zeumhygkxgf.zip
%LOCALAPPDATA%low\screen.jpeg
%LOCALAPPDATA%low\machineinfo.txt
%LOCALAPPDATA%low\cr1dl5pe5dg6md5k\api-ms-win-core-interlocked-l1-1-0.dll
%LOCALAPPDATA%low\sqlite3.dll

Moves the following files

from %LOCALAPPDATA%\⎄⎖⍹⎆⍵⍧⎛⎒⍵⍨⍻⎃⍪⎃⎙⍯⎎⎚⎙⎉⍺⍲⍪⎄⍦\<File name>.exe_url_rbqr0jds1jpf51whbql2onhxmsvf1xbm\1.295.136.456\55u3inrr.newcfg to %LOCALAPPDATA%\⎄⎖⍹⎆⍵⍧⎛⎒⍵⍨⍻⎃⍪⎃⎙⍯⎎⎚⎙⎉⍺⍲⍪⎄⍦\<File name>.exe_url_rbqr0jds1jpf51whbql2onhxmsvf1xbm\1.295.136.456\user.config
from %LOCALAPPDATA%\箻箥箕箨箄箻箮箴箄箭箘箹箲箕箯箸箝箥箍箯箵箌箰箴箮\cgdxjtbvde.exe_url_m0bhzcb5k5q1rp1aiukx05nmmzfdsg4y\5.10.997.124\nfmhmsjo.newcfg to %LOCALAPPDATA%\箻箥箕箨箄箻箮箴箄箭箘箹箲箕箯箸箝箥箍箯箵箌箰箴箮\cgdxjtbvde.exe_url_m0bhzcb5k5q1rp1aiukx05nmmzfdsg4y\5.10.997.124\user.config

Deletes itself.

Network activity

Connects to

'microsoft.com':80
'je####jcjfhh.com':80
'je####jcjfhh.com':443
'91.##4.124.126':80
'av##93r.ru':443

TCP

HTTP GET requests

http://je####jcjfhh.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-75BC81CE07343C54513A0897B31AFE23.html
http://je####jcjfhh.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-FF220895194B354D2583745F5D3B9555.html
http://je####jcjfhh.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-3DF86B88941213B8BF5E8543F3A04B5F.html
http://91.##4.124.126//l/f/fifmSHgBuI_ccNKoKSvK/7a43da94b852773e74ebcfe0b5ee99aecc02dc1a
http://91.##4.124.126//l/f/fifmSHgBuI_ccNKoKSvK/27c730c0da372cf7075e54f26d40266210ede0a2
http://je####jcjfhh.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-14C4B094B1FB49486493CCD754AF6DDE.html
http://je####jcjfhh.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-D83A14033F5A3F30541170966B55B747.html
http://je####jcjfhh.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-6A7231098A0B170FFA30326BF91CFF4A.html
http://je####jcjfhh.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-B5D9D513A28915D2B941F5BC7A6AE7FD.html

HTTP POST requests

http://91.##4.124.126/

'je####jcjfhh.com':443

'te##te.in':443

'av##93r.ru':443

UDP

DNS ASK microsoft.com
DNS ASK je####jcjfhh.com
DNS ASK te##te.in
DNS ASK av##93r.ru

Miscellaneous

Creates and executes the following

'%TEMP%\cgdxjtbvde.exe'
'%TEMP%\yvehki8yvh.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%TEMP%\cGDxJTbVDE.exe" -Force
'%APPDATA%\microsoft\windows\start menu\programs\startup\mipygvcjzdkkyb.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force' (with hidden window)
'%TEMP%\cgdxjtbvde.exe' ' (with hidden window)
'%TEMP%\yvehki8yvh.exe' ' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%TEMP%\cGDxJTbVDE.exe" -Force' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\mIPYGvcjzDkKYB.exe" -Force' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Microsoft.NET\Framework\WglHApUpNASgRih\svchost.exe" -Force' (with hidden window)

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "<Full path to file>" -Force
'%WINDIR%\syswow64\cmd.exe' /C timeout /T 10 /NOBREAK > Nul & Del /f /q "<Full path to file>"
'%WINDIR%\syswow64\timeout.exe' /T 10 /NOBREAK
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\mIPYGvcjzDkKYB.exe" -Force
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath "%WINDIR%\Microsoft.NET\Framework\WglHApUpNASgRih\svchost.exe" -Force

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial