Technical Information
Modifies file system
Creates the following files
- C:\addon\private-user.cmd
- C:\addon\default.bat
- C:\addon\time out execution (sleep).bat
- C:\addon\suporte.exe
- %HOMEPATH%\desktop\comunicação direta (contato).png
- nul
Sets the 'hidden' attribute to the following files
- C:\addon\private-user.cmd
- C:\addon\default.bat
- C:\addon\time out execution (sleep).bat
- C:\addon\suporte.exe
Modifies the HOSTS file.
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- 'C:\addon\suporte.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""C:\Addon\Time Out Execution (sleep).bat" "
- '<SYSTEM32>\cmd.exe' /K ""C:\Addon\DEFAULT.bat""
- '<SYSTEM32>\timeout.exe' /t 3
- '<SYSTEM32>\fltmc.exe'
- '<SYSTEM32>\cmd.exe' /K "C:\Addon\PRIVATE-USER.cmd"
- '<SYSTEM32>\attrib.exe' -r <DRIVERS>\etc\hosts
- '<SYSTEM32>\attrib.exe' +r <DRIVERS>\etc\hosts
