Trojan.KillFiles.64989

Technical Information

Modifies file system

Creates the following files

%TEMP%\9b96.tmp\9ba6.tmp\9ba7.bat
nul

Deletes the following files

%WINDIR%\temp\adobearm.log
%WINDIR%\temp\ts_77d1.tmp
%WINDIR%\temp\ts_5080.tmp
%WINDIR%\temp\ts_4f66.tmp
%WINDIR%\temp\ts_39ba.tmp
%WINDIR%\temp\ts_3852.tmp
%WINDIR%\temp\ts_361e.tmp
%WINDIR%\temp\ts_8e67.tmp
%WINDIR%\temp\ts_316a.tmp
%WINDIR%\temp\ts_2b0f.tmp
%WINDIR%\temp\ts_267a.tmp
%WINDIR%\temp\fxstiffdebuglogfile.txt
%WINDIR%\temp\fxsapidebuglogfile.txt
%WINDIR%\temp\fwtsqmfile00.sqm
%WINDIR%\temp\dmi8538.tmp
%WINDIR%\temp\ts_2bfb.tmp
%WINDIR%\temp\8147932992814195939363050711163993686\adobearm.exe

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c "%TEMP%\9B96.tmp\9BA6.tmp\9BA7.bat <Full path to file>"
'<SYSTEM32>\netsh.exe' int tcp set global chimney=disabled
'<SYSTEM32>\netsh.exe' int tcp set global autotuninglevel=normal
'<SYSTEM32>\netsh.exe' int tcp set global ecncapability=disabled
'<SYSTEM32>\netsh.exe' int tcp set global netdma=disabled
'<SYSTEM32>\netsh.exe' int tcp set global nonsackrttresiliency=disabled
'<SYSTEM32>\netsh.exe' int tcp set global fastopen=enabled
'<SYSTEM32>\netsh.exe' int tcp set supplemental template=custom icw=10
'<SYSTEM32>\netsh.exe' interface ipv4 set subinterface "Ethernet" mtu=1492 store=persistent
'<SYSTEM32>\netsh.exe' interface ipv6 set subinterface "Ethernet" mtu=1492 store=persistent
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Enable-NetAdapterChecksumOffload -Name 'Ethernet'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Disable-NetAdapterLso -Name 'Ethernet'
'<SYSTEM32>\netsh.exe' interface tcp set global ecncapability=disabled
'<SYSTEM32>\netsh.exe' int tcp set global rsc=enabled
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Enable-NetAdapterRss -Name 'Ethernet'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-NetTCPSetting -SettingName InternetCustom -MaxSynRetransmissions 2
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-NetTCPSetting -SettingName InternetCustom -EcnCapability disabled
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-NetTCPSetting -SettingName InternetCustom -Timestamps disabled
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-NetTCPSetting -SettingName InternetCustom -AutoTuningLevelLocal Normal
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-NetTCPSetting -SettingName InternetCustom -ScalingHeuristics disabled
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-NetTCPSetting -SettingName InternetCustom -CongestionProvider ctcp
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-NetOffloadGlobalSetting -Chimney Automatic
'<SYSTEM32>\ipconfig.exe' /release
'<SYSTEM32>\ipconfig.exe' /renew
'<SYSTEM32>\ipconfig.exe' /flushdns
'<SYSTEM32>\ping.exe' -n 7 -w 1000 127.0.0.1
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Enable-NetAdapterRsc -Name 'Ethernet'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-NetTCPSetting -SettingName InternetCustom -NonSackRttResiliency disabled
'<SYSTEM32>\netsh.exe' int tcp set global dca=enabled
'<SYSTEM32>\netsh.exe' int tcp set global rss=enabled
'<SYSTEM32>\netsh.exe' int tcp set global initialRto=2000
'<SYSTEM32>\reg.exe' query "HKU\S-1-5-19\Environment"
'<SYSTEM32>\ping.exe' -n 1,5 localhost
'<SYSTEM32>\ping.exe' -n 2 localhost
'<SYSTEM32>\ping.exe' -n 4 localhost
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowgameDVR /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\TimeBrokerSvc" /v "Start" /t REG_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCortana" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLowDiskSpaceChecks /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "LargeSystemCache" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "8" /f
'<SYSTEM32>\reg.exe' add "HKU\S-1-5-19\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "8" /f
'<SYSTEM32>\ping.exe' -n 3 localhost
'<SYSTEM32>\reg.exe' add "HKU\S-1-5-20\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "8" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "PowerDownAfterShutdown" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "ClearPageFileAtShutDown" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v "HiberbootEnabled" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v "StartupDelayInMSec" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control" /v "AutoEndTasks" /t REG_SZ /d "1" /f
'<SYSTEM32>\reg.exe' add "HKCU\Control Panel\Desktop" /v "AutoEndTasks" /t REG_SZ /d "1" /f
'<SYSTEM32>\ping.exe' -n 2 -w 1000 127.0.0.1
'<SYSTEM32>\ping.exe' -n 3 -w 1000 127.0.0.1
'<SYSTEM32>\ping.exe' -n 5 -w 1000 127.0.0.1
'<SYSTEM32>\netsh.exe' interface tcp set global autotuning=normal
'<SYSTEM32>\netsh.exe' int tcp set heuristics disabled
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_ShowRun" /t REG_DWORD /d "1" /f
'<SYSTEM32>\wbem\wmic.exe' process where name="mqsvc.exe" CALL setpriority 256
'<SYSTEM32>\wbem\wmic.exe' process where name="javaw.exe" CALL setpriority 128