Trojan.Siggen33.58610

Technical Information

Malicious functions

Injects code into

the following system processes:

%WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe

Modifies file system

Creates the following files

%TEMP%\nsse547.tmp\system.dll
%TEMP%\nsse547.tmp\app-64.7z
%TEMP%\nsse547.tmp\nsis7z.dll
%TEMP%\nsse547.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsse547.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsse547.tmp\7z-out\icudtl.dat
%TEMP%\nsse547.tmp\7z-out\license.electron.txt
%TEMP%\nsse547.tmp\7z-out\licenses.chromium.html
%TEMP%\nsse547.tmp\7z-out\locales\af.pak
%TEMP%\nsse547.tmp\7z-out\locales\am.pak
%TEMP%\nsse547.tmp\7z-out\locales\ar.pak
%TEMP%\nsse547.tmp\7z-out\locales\bg.pak
%TEMP%\nsse547.tmp\7z-out\locales\bn.pak
%TEMP%\nsse547.tmp\7z-out\locales\ca.pak
%TEMP%\nsse547.tmp\7z-out\locales\cs.pak
%TEMP%\nsse547.tmp\7z-out\locales\da.pak
%TEMP%\nsse547.tmp\7z-out\locales\de.pak
%TEMP%\nsse547.tmp\7z-out\locales\el.pak
%TEMP%\nsse547.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsse547.tmp\7z-out\locales\en-us.pak
%TEMP%\nsse547.tmp\7z-out\locales\es-419.pak
%TEMP%\nsse547.tmp\7z-out\locales\es.pak
%TEMP%\nsse547.tmp\7z-out\locales\et.pak
%TEMP%\nsse547.tmp\7z-out\locales\fa.pak
%TEMP%\nsse547.tmp\7z-out\locales\fi.pak
%TEMP%\nsse547.tmp\7z-out\locales\fil.pak
%TEMP%\nsse547.tmp\7z-out\locales\fr.pak
%TEMP%\nsse547.tmp\7z-out\locales\gu.pak
%TEMP%\nsse547.tmp\7z-out\locales\he.pak
%TEMP%\nsse547.tmp\7z-out\locales\hi.pak
%TEMP%\nsse547.tmp\7z-out\locales\hr.pak
%TEMP%\nsse547.tmp\7z-out\locales\hu.pak
%TEMP%\nsse547.tmp\7z-out\locales\id.pak
%TEMP%\nsse547.tmp\7z-out\locales\it.pak
%TEMP%\nsse547.tmp\7z-out\locales\ja.pak
%TEMP%\nsse547.tmp\7z-out\locales\kn.pak
%TEMP%\nsse547.tmp\7z-out\locales\ko.pak
%TEMP%\nsse547.tmp\7z-out\locales\lt.pak
%TEMP%\nsse547.tmp\7z-out\locales\lv.pak
%TEMP%\nsse547.tmp\7z-out\locales\ml.pak
%TEMP%\nsse547.tmp\7z-out\locales\mr.pak
%TEMP%\nsse547.tmp\7z-out\locales\ms.pak
%TEMP%\nsse547.tmp\7z-out\locales\nb.pak
%TEMP%\nsse547.tmp\7z-out\locales\nl.pak
%TEMP%\nsse547.tmp\7z-out\locales\pl.pak
%TEMP%\nsse547.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsse547.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsse547.tmp\7z-out\locales\ro.pak
%TEMP%\nsse547.tmp\7z-out\locales\ru.pak
%TEMP%\nsse547.tmp\7z-out\locales\sk.pak
%TEMP%\nsse547.tmp\7z-out\locales\sl.pak
%TEMP%\nsse547.tmp\7z-out\locales\sr.pak
%TEMP%\nsse547.tmp\7z-out\locales\sv.pak
%TEMP%\nsse547.tmp\7z-out\locales\sw.pak
%TEMP%\nsse547.tmp\7z-out\locales\ta.pak
%TEMP%\nsse547.tmp\7z-out\locales\te.pak
%TEMP%\nsse547.tmp\7z-out\locales\th.pak
%TEMP%\nsse547.tmp\7z-out\locales\tr.pak
%TEMP%\nsse547.tmp\7z-out\locales\uk.pak
%TEMP%\nsse547.tmp\7z-out\locales\ur.pak
%TEMP%\nsse547.tmp\7z-out\locales\vi.pak
%TEMP%\nsse547.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsse547.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsse547.tmp\7z-out\resources\app.asar
%TEMP%\nsse547.tmp\7z-out\resources.pak
%TEMP%\nsse547.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsse547.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsse547.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsse547.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsse547.tmp\7z-out\ffmpeg.dll
%TEMP%\nsse547.tmp\7z-out\libegl.dll
%TEMP%\nsse547.tmp\7z-out\libglesv2.dll
%TEMP%\nsse547.tmp\7z-out\resources\elevate.exe
%TEMP%\nsse547.tmp\7z-out\sehidiniskim.exe
%TEMP%\nsse547.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsse547.tmp\7z-out\vulkan-1.dll
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\chrome_100_percent.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\chrome_200_percent.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\d3dcompiler_47.dll
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\ffmpeg.dll
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\icudtl.dat
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\libegl.dll
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\libglesv2.dll
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\license.electron.txt
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\licenses.chromium.html
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\resources.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\sehidiniskim.exe
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\snapshot_blob.bin
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\v8_context_snapshot.bin
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\vk_swiftshader.dll
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\vk_swiftshader_icd.json
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\vulkan-1.dll
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\af.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\am.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\ar.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\bg.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\bn.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\ca.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\cs.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\da.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\de.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\el.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\en-gb.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\en-us.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\es-419.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\es.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\et.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\fa.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\fi.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\fil.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\fr.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\gu.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\he.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\hi.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\hr.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\hu.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\id.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\it.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\ja.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\kn.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\ko.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\lt.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\lv.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\ml.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\mr.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\ms.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\nb.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\nl.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\pl.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\pt-br.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\pt-pt.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\ro.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\ru.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\sk.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\sl.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\sr.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\sv.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\sw.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\ta.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\te.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\th.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\tr.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\uk.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\ur.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\vi.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\zh-cn.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\locales\zh-tw.pak
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\resources\app.asar
%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\resources\elevate.exe
%TEMP%\nsse547.tmp\stdutils.dll
%TEMP%\payload_debug.log
%APPDATA%\sehidiniskim\local storage\leveldb\log
%APPDATA%\sehidiniskim\local storage\leveldb\manifest-000001
%APPDATA%\sehidiniskim\local storage\leveldb\000001.dbtmp
%APPDATA%\sehidiniskim\code cache\wasm\index
%APPDATA%\sehidiniskim\code cache\js\index
%APPDATA%\sehidiniskim\code cache\wasm\index-dir\temp-index
%APPDATA%\sehidiniskim\code cache\js\index-dir\temp-index
%APPDATA%\sehidiniskim\gpucache\index
%APPDATA%\sehidiniskim\gpucache\data_0
%APPDATA%\sehidiniskim\gpucache\data_1
%APPDATA%\sehidiniskim\gpucache\data_2
%APPDATA%\sehidiniskim\gpucache\data_3
%APPDATA%\sehidiniskim\dawncache\index
%APPDATA%\sehidiniskim\dawncache\data_0
%APPDATA%\sehidiniskim\dawncache\data_1
%APPDATA%\sehidiniskim\dawncache\data_2
%APPDATA%\sehidiniskim\dawncache\data_3
%APPDATA%\microsoft\spelling\en-us\default.dic
%APPDATA%\microsoft\spelling\en-us\default.exc
%APPDATA%\microsoft\spelling\en-us\default.acl
%TEMP%\kyoesf.xml
%APPDATA%\sehidiniskim\shared dictionary\cache\index
%APPDATA%\sehidiniskim\network\trust tokens-journal
%APPDATA%\sehidiniskim\network\trust tokens
%APPDATA%\sehidiniskim\shared dictionary\db-journal
%APPDATA%\sehidiniskim\shared dictionary\db
%APPDATA%\sehidiniskim\shared dictionary\cache\index-dir\temp-index
%APPDATA%\sehidiniskim\cache\cache_data\index
%APPDATA%\sehidiniskim\cache\cache_data\data_0
%APPDATA%\sehidiniskim\cache\cache_data\data_1
%APPDATA%\sehidiniskim\cache\cache_data\data_2
%APPDATA%\sehidiniskim\cache\cache_data\data_3
%TEMP%\ym0h2brm\ym0h2brm.0.cs
%TEMP%\ym0h2brm\ym0h2brm.cmdline
%TEMP%\ym0h2brm\ym0h2brm.out
%TEMP%\2099d551-db4d-4626-8597-886cb14a08f8.txt
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\msbuild.exe.log
%TEMP%\xg25so.xml
%APPDATA%\sehidiniskim\network\ab44269a-ba7d-4b92-bc23-1a6e6deba770.tmp
%TEMP%\hpaqji0a\hpaqji0a.0.cs
%TEMP%\hpaqji0a\hpaqji0a.cmdline
%TEMP%\hpaqji0a\hpaqji0a.out
%TEMP%\04a1ffe1-f36d-4b52-9a0a-6dff5b77a128.txt
%APPDATA%\sehidiniskim\b40cbb16-83c5-44bb-807d-bd9114060812.tmp
%APPDATA%\sehidiniskim\60044ff1-691b-404a-bd41-c98a1bf6d742.tmp
%APPDATA%\sehidiniskim\network\40262072-bdd8-474f-b89c-15731f932cd6.tmp
%LOCALAPPDATA%\microsoft\windows\caches\systemtelemetry_5o90o.exe
%TEMP%\mgrrbo.xml
%TEMP%\u0w528.bin
%TEMP%\kvqrc7.xml

Deletes following files that it created itself

%TEMP%\ym0h2brm\ym0h2brm.cmdline
%TEMP%\ym0h2brm\ym0h2brm.out
%TEMP%\ym0h2brm\ym0h2brm.0.cs
%TEMP%\hpaqji0a\hpaqji0a.out
%TEMP%\hpaqji0a\hpaqji0a.cmdline
%TEMP%\hpaqji0a\hpaqji0a.0.cs
%TEMP%\u0w528.bin
%TEMP%\kvqrc7.xml
%TEMP%\mgrrbo.xml

Moves the following files

from %APPDATA%\sehidiniskim\code cache\wasm\index-dir\temp-index to %APPDATA%\sehidiniskim\code cache\wasm\index-dir\the-real-index
from %APPDATA%\sehidiniskim\code cache\js\index-dir\temp-index to %APPDATA%\sehidiniskim\code cache\js\index-dir\the-real-index
from %APPDATA%\sehidiniskim\local storage\leveldb\000001.dbtmp to %APPDATA%\sehidiniskim\local storage\leveldb\current
from %APPDATA%\sehidiniskim\shared dictionary\cache\index-dir\temp-index to %APPDATA%\sehidiniskim\shared dictionary\cache\index-dir\the-real-index
from %APPDATA%\sehidiniskim\network\ab44269a-ba7d-4b92-bc23-1a6e6deba770.tmp to %APPDATA%\sehidiniskim\network\network persistent state
from %APPDATA%\sehidiniskim\b40cbb16-83c5-44bb-807d-bd9114060812.tmp to %APPDATA%\sehidiniskim\local state
from %APPDATA%\sehidiniskim\60044ff1-691b-404a-bd41-c98a1bf6d742.tmp to %APPDATA%\sehidiniskim\preferences
from %APPDATA%\sehidiniskim\network\40262072-bdd8-474f-b89c-15731f932cd6.tmp to %APPDATA%\sehidiniskim\network\transportsecurity

Network activity

Connects to

'dn#.google':443
'ap#.#pify.org':443
'vi###total.com':443
'di##ord.com':443

TCP

Other

'dn#.google':443
'ap#.#pify.org':443
'vi###total.com':443
'ca####.discord.com':443

UDP

DNS ASK dn#.google
DNS ASK ap#.#pify.org
DNS ASK vi###total.com
DNS ASK di##ord.com
DNS ASK ca####.discord.com

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\sehidiniskim'

Creates and executes the following

'%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\sehidiniskim.exe'
'%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\sehidiniskim.exe' --type=gpu-process --no-sandbox --user-data-dir="%APPDATA%\sehidiniskim" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAA...
'%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\sehidiniskim.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="%APPDATA%\sehidiniskim" --mojo-platform-channel-handle=1852...
'%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\sehidiniskim.exe' --type=renderer --user-data-dir="%APPDATA%\sehidiniskim" --app-path="%TEMP%\3ITahtSzDF7K5rbpL5ue3nV2brO\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --no-sandbox --disa...
'%TEMP%\3itahtszdf7k5rbpl5ue3nv2bro\sehidiniskim.exe' --type=renderer --user-data-dir="%APPDATA%\sehidiniskim" --app-path="%TEMP%\3ITahtSzDF7K5rbpL5ue3nV2brO\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --lan...
'%LOCALAPPDATA%\microsoft\windows\caches\systemtelemetry_5o90o.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /d /s /c ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "%TEMP%\kyoesf.xml" /nologo /v:quiet"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe' "%TEMP%\kyoesf.xml" /nologo /v:quiet
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ym0h2brm\ym0h2brm.cmdline"
'<SYSTEM32>\cmd.exe' /d /s /c "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "%TEMP%\xg25so.xml" /nologo /v:quiet"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe' "%TEMP%\xg25so.xml" /nologo /v:quiet
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\hpaqji0a\hpaqji0a.cmdline"
'<SYSTEM32>\cmd.exe' /d /s /c "getmac"
'<SYSTEM32>\getmac.exe'
'<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"
'<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
'<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_videocontroller get caption"
'<SYSTEM32>\wbem\wmic.exe' path win32_videocontroller get caption
'<SYSTEM32>\cmd.exe' /d /s /c "systeminfo"
'<SYSTEM32>\systeminfo.exe'
'<SYSTEM32>\cmd.exe' /d /s /c "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "%TEMP%\mgrrbo.xml" /nologo /v:quiet"
'<SYSTEM32>\cmd.exe' /d /s /c "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "%TEMP%\kvqrc7.xml" /nologo /v:quiet"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe' "%TEMP%\mgrrbo.xml" /nologo /v:quiet
'%WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe' "%TEMP%\kvqrc7.xml" /nologo /v:quiet
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\emcqyfxd\emcqyfxd.cmdline"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9C2D.tmp" "%TEMP%\emcqyfxd\CSC51B5E01476CD483D86F18ACA9988513.TMP"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\rgfh21um\rgfh21um.cmdline"
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9FD7.tmp" "%TEMP%\rgfh21um\CSC17E4A16BBAAD4BBCB6E7755DEF98818.TMP"
'<SYSTEM32>\cmd.exe' /c "ver"
'<SYSTEM32>\cmd.exe' /d /s /c ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "%TEMP%\kyoesf.xml" /nologo /v:quiet"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\ym0h2brm\ym0h2brm.cmdline"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "%TEMP%\xg25so.xml" /nologo /v:quiet"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\hpaqji0a\hpaqji0a.cmdline"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "getmac"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic csproduct get uuid"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_videocontroller get caption"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "systeminfo"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "%TEMP%\mgrrbo.xml" /nologo /v:quiet"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe "%TEMP%\kvqrc7.xml" /nologo /v:quiet"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\emcqyfxd\emcqyfxd.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9C2D.tmp" "%TEMP%\emcqyfxd\CSC51B5E01476CD483D86F18ACA9988513.TMP"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\rgfh21um\rgfh21um.cmdline"' (with hidden window)
'%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9FD7.tmp" "%TEMP%\rgfh21um\CSC17E4A16BBAAD4BBCB6E7755DEF98818.TMP"' (with hidden window)
'%LOCALAPPDATA%\microsoft\windows\caches\systemtelemetry_5o90o.exe' ' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней