Threat Database Trojans Trojan.MSIL.Mardom.AJ

Trojan.MSIL.Mardom.AJ

By CagedTech in Trojans

Threat Scorecard

Popularity Rank: 24,329
Threat Level: 80 % (High)
Infected Computers: 30
First Seen: May 25, 2024
Last Seen: July 23, 2026
OS(es) Affected: Windows

The detection of Trojan.MSIL.Mardom.AJ on your system indicates a potential security threat that requires immediate attention. This report provides an overview of the threat, its operating mechanisms, symptoms of infection, and step-by-step guidance on how to remove it from your computer.

What Is Trojan.MSIL.Mardom.AJ?

Trojan.MSIL.Mardom.AJ is identified as a Trojan-type threat, which is a broad category of malware designed to deceive users into installing it on their systems. Trojans can lead to a variety of malicious activities, including data theft, unauthorized access to the infected computer, and the distribution of additional malware. The name itself does not specify a known malware family, but its classification as a Trojan indicates its potential to cause significant harm.

How Trojan.MSIL.Mardom.AJ Operates

Trojan.MSIL.Mardom.AJ, like other Trojans, operates by disguising itself as legitimate software or attaching itself to genuine programs. Once installed, it can execute a range of malicious actions, depending on its design and the intentions of its creators. This can include spying on the user, stealing sensitive information, disrupting system operation, or using the infected computer as a hub to spread malware to other devices. The specific operations of Trojan.MSIL.Mardom.AJ can vary, but its primary goal is to compromise the security and integrity of the infected system.

Symptoms of Infection

Symptoms of a Trojan infection can be subtle and may not always be immediately apparent. However, common indicators include unusual system behavior, such as unexpected pop-ups, slow performance, frequent crashes, or the presence of unfamiliar programs. Additionally, if your antivirus software is disabled without your knowledge or if you notice unauthorized changes to your system settings, these could be signs of a Trojan infection. Since Trojans are designed to be stealthy, some infections may not exhibit noticeable symptoms until significant damage has been done.

How to Remove Trojan.MSIL.Mardom.AJ

  1. Boot into Safe Mode with Networking: This will limit the malware's ability to interfere with the removal process. Restart your computer, and as it boots up, press the key that opens the boot menu (this key varies by manufacturer but is often F12, F2, or Del). Select the option to boot into Safe Mode with Networking.
  2. Perform a Full Scan with a Reputable Tool: Use an anti-malware tool, such as SpyHunter, to perform a full scan of your system. This can help identify and remove the Trojan and any associated malware.
  3. Uninstall Suspicious Programs: Go through your installed programs and uninstall any that you do not recognize or that were installed around the time you believe the infection occurred.
  4. Reset Your Web Browsers: Resetting web browsers like Chrome, Firefox, and Edge can help remove any malicious extensions or settings that the Trojan may have installed. You can usually find the reset option in the browser's settings or preferences menu.
  5. Reboot and Re-scan: After completing the above steps, reboot your computer and perform another full scan with your anti-malware tool to ensure that all traces of the malware have been removed.

Conclusion

The removal of Trojan.MSIL.Mardom.AJ requires careful and methodical steps to ensure that all components of the malware are eliminated from your system. By following the guidance provided, you can significantly reduce the risk posed by this threat. However, prevention is the best defense against malware infections. Keeping your operating system, software, and security tools up to date, being cautious with email attachments and downloads, and regularly scanning your system for malware are essential practices for maintaining computer security.

Analysis Report

General information

Family Name: Trojan.MSIL.Mardom.AJ
Signature status: No Signature

Known Samples

MD5: be6f01df976ac1659fa865bd8ca90c9a
SHA1: 9587a920f247d92448afc0f06485398b2e96fc9b
File Size: 754.18 KB, 754176 bytes
MD5: 6a8160ad2d9eb6db10295d3eb86ca3aa
SHA1: a842ba451f9a5b6b0114b35a17521826f9a06a94
File Size: 753.66 KB, 753664 bytes
MD5: e96ae68022ff5a54f0401023f5d1b464
SHA1: 54daab0385e69655da7a8be45e970a6737278146
SHA256: BBC6CB417E0B3CB47117DBA21E14C2AB2ED7B4EB92DA24E91DE37C7170223E02
File Size: 785.92 KB, 785920 bytes
MD5: 4e32e632a49b993aea176bec39460b50
SHA1: 1438c2f00eec86c34f79677f82ab6a4ae7fc7d98
SHA256: 911E41AD6E9AF02E292E0C45D4F0D386AB27B836932FC46B270283D9B4F88AAE
File Size: 552.96 KB, 552960 bytes
MD5: 84e00cc1e36aded9d3eaef013ae33347
SHA1: 379cb6f9f7bb11b9e22f2195baae3da6078b2856
SHA256: BDEDD5E2037041B72F6FBC71BA2C21C1C174F9D372CF06B0D50ACBDB31655B58
File Size: 785.92 KB, 785920 bytes
Show More
MD5: c98ff350a8ccb8968b35b4aa26731e1c
SHA1: 346f1d54b50cff11def7a5d8dfc41b4513808a1f
SHA256: 01818BFED897C9EC9FD46C9D5FD5828E3BA118BD2DDE0B7212CFA2A95DC75282
File Size: 514.05 KB, 514048 bytes
MD5: 47998b95c09291485f80084c41bbd150
SHA1: 2bf9fd359ab88dcccd188d3cc4648f439aab1288
SHA256: 73D0442449378FB3FE52EAC71543DDC6A447615330ACE16949C629B2C3F751A5
File Size: 747.01 KB, 747008 bytes
MD5: cbe64a43859a1e02c4f606706e8c191b
SHA1: fc0a77df015b7875e3c1bb129e4fe2593c33bded
SHA256: B02EDC3297D612BFFCEA11A77A282D73518F26AF9993B6DF27E38A3F0C29AF69
File Size: 571.39 KB, 571392 bytes
MD5: 2ff326f8b8c7ec908e715cb4702a0cd9
SHA1: 68e378db9bc819eaaf84325e215b9695d4806fd9
SHA256: B3FD8B4399A0BF1396FC4D2592AF2E30987DC1B192E56C6902B7ABFC947D556E
File Size: 602.62 KB, 602624 bytes
MD5: 6a015195b895562575d9be056eed76fe
SHA1: de393de5fb5f9d97bac307c398b567c99d40b516
SHA256: 9BFDD7B2A4E00F477B8C9FFE86F9EAEA62BD7F2B4FC65DD26047E877C6521236
File Size: 603.14 KB, 603136 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File is .NET application
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Assembly Version
  • 1412.45600.1.10118
  • 3.54.3.9
  • 1.0.0.0
Comments Host Data Services
Company Name Microsoft Corporation
File Description
  • GMSoft Data Syncer
  • Host Data Services
  • PVM Data Optimizer
File Version
  • 7510.4918.2800.3914
  • 1412.45600.01.10118
  • 502.1800.2.35911
  • 500.31567.21300.85
  • 15.035.41036.4459
  • 1.0.0.0
Internal Name
  • Aywyqdkmrpa.exe
  • Cdsqwdve.exe
  • HostData_B02ZE63X.exe
  • HostData_Q03HT4DXU.exe
  • HostData_RNI803DY6TZXP.exe
  • Jfrse.exe
  • Ujjfiqfzt.exe
  • Vlvycgoknjj.exe
Legal Copyright
  • © Microsoft Corporation. All rights reserved.
  • ©Microsoft Corporation. All rights reserved.
Original Filename
  • Aywyqdkmrpa.exe
  • Cdsqwdve.exe
  • GMSoftsyncer_v500315672130.exe
  • HostData_B02ZE63X.exe
  • HostData_Q03HT4DXU.exe
  • HostData_RNI803DY6TZXP.exe
  • Jfrse.exe
  • PVM_v751025583691402.exe
  • Ujjfiqfzt.exe
  • Vlvycgoknjj.exe
Product Name
  • Microsoft® Windows® Operating System
  • Microsoft®Windows®Operating System
Product Version
  • 7510.4918.2800.3914
  • 1412.45600.01.10118
  • 502.1800.2.35911
  • 500.31567.21300.85
  • 15.035.41036.4459
  • 1.0.0.0

File Traits

  • .NET
  • GenKrypt
  • HighEntropy
  • Reactor
  • RijndaelManaged
  • x64

Block Information

Total Blocks: 752
Potentially Malicious Blocks: 41
Whitelisted Blocks: 386
Unknown Blocks: 325

Visual Map

x ? ? ? ? ? 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? ? ? ? ? ? ? ? 0 x 0 ? ? 0 ? ? 0 ? 0 ? 0 ? ? ? x ? x ? x ? 0 ? 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 ? x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 x 0 ? ? ? 0 ? 0 0 ? ? ? ? ? ? ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? ? ? 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 x x 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? x ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? ? 0 ? x ? 0 0 0 0 0 0 x ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? x ? ? ? ? 0 0 0 0 ? ? ? ? ? ? ? ? ? ? 0 x 0 ? ? ? ? ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? 0 0 ? ? 0 x ? x ? ? ? ? 0 ? 0 0 ? ? ? ? ? 0 0 ? ? ? ? ? 0 0 x 0 ? ? ? ? 0 0 ? ? ? ? 0 0 0 0 0 ? ? x ? ? ? ? x ? ? ? ? ? ? ? ? 0 x ? x ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 0 0 0 0 0 x 0 0 0 x ? ? ? ? x ? 0 ? ? ? ? x x x ? x x 0 ? 0 ? x ? ? 0 ? ? ? x 0 ? x 0 0 0 0 0 ? ? 0 0 x 0 0 x ? ? ? 0 0 0 0 x ? ? 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • MSIL.Agent.OAAH
  • MSIL.Agent.XWB
  • MSIL.AgentTesla.LS
  • MSIL.AgentTesla.PH
  • MSIL.Krypt.GEFY
Show More
  • MSIL.Kryptik.SA
  • MSIL.Mardom.AJ
  • MSIL.Mardom.JF
  • MSIL.Mardom.LM

Files Modified

File Attributes
c:\users\user\appdata\local\temp\60nx15ju.bat Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nnq9n9ru.bat Generic Write,Read Attributes
c:\users\user\appdata\local\temp\qhpk2f3h.bat Generic Write,Read Attributes
c:\users\user\appdata\roaming\hostdata\gxmm\diagsvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\hostdata\gxmm\sdrsvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\hostdata\gxmm\sysdata.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\roaming\hostdata\gxmm\sysdata.vbs Generic Write,Read Attributes
c:\users\user\appdata\roaming\hostdata\install.dat Generic Write,Read Attributes
c:\users\user\appdata\roaming\hostdata\oeig\diagsvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\hostdata\oeig\sdrsvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
Show More
c:\users\user\appdata\roaming\hostdata\oeig\sysdata.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\roaming\hostdata\oeig\sysdata.vbs Generic Write,Read Attributes
c:\users\user\appdata\roaming\hostdata\uasqn\diagsvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\hostdata\uasqn\sdrsvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\hostdata\uasqn\sysdata.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144

Registry Modifications

Key::Value Data API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe 䮴镰ǜ RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 긣镰ǜ RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasapi32::enablefiletracing RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasapi32::enableautofiletracing RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasapi32::enableconsoletracing RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasapi32::filetracingmask ￿ RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasapi32::consoletracingmask ￿ RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasapi32::maxfilesize  RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasapi32::filedirectory %windir%\tracing RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasmancs::enablefiletracing RegNtPreCreateKey
Show More
HKLM\software\microsoft\tracing\rasmancs::enableautofiletracing RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasmancs::enableconsoletracing RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasmancs::filetracingmask ￿ RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasmancs::consoletracingmask ￿ RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasmancs::maxfilesize  RegNtPreCreateKey
HKLM\software\microsoft\tracing\rasmancs::filedirectory %windir%\tracing RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe Ӈ僧웇ǜ RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 쥲僫웇ǜ RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 Jkr�B �� �v �� 7� �� ���T�B������%Bx�<�!$��%�&� '�!(�(X�(�) ;*J*9*�",=�1�1HO5,]5�G>��@V�@�*A��B F Fy�G�IH[uH�pM�lN$N�P@jR��X �_�zc�we0Te�hh�rj�bk�qq(q�XrnJr� RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe घᬄṂǝ RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 〧ᬋṂǝ RegNtPreCreateKey

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcCreatePortSection
  • ntdll.dll!NtAlpcCreateSectionView
  • ntdll.dll!NtAlpcCreateSecurityContext
  • ntdll.dll!NtAlpcDeleteSecurityContext
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcQueryInformationMessage
Show More
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtAlpcSetInformation
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtCancelTimer2
  • ntdll.dll!NtCancelWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtCompareSigningLevels
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreatePrivateNamespace
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFlushProcessWriteBuffers
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtFsControlFile
  • ntdll.dll!NtGetCachedSigningLevel
  • ntdll.dll!NtGetCompleteWnfStateSubscription
  • ntdll.dll!NtGetContextThread
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenSymbolicLinkObject
  • ntdll.dll!NtOpenThread
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtPowerInformation
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryEvent
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySymbolicLinkObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtQueueApcThread
  • ntdll.dll!NtQueueApcThreadEx2
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReadVirtualMemory
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationObject
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory

18 additional items are not displayed above.

User Data Access
  • GetComputerName
  • GetComputerNameEx
  • GetUserDefaultLocaleName
  • GetUserName
  • GetUserObjectInformation
Encryption Used
  • BCryptOpenAlgorithmProvider
  • CryptAcquireContext
Anti Debug
  • IsDebuggerPresent
Other Suspicious
  • AdjustTokenPrivileges
Process Shell Execute
  • CreateProcess
  • WriteConsole
Process Manipulation Evasion
  • NtUnmapViewOfSection
Network Winsock2
  • WSAConnect
  • WSASocket
  • WSAStartup
  • WSAttemptAutodialName
Network Winsock
  • closesocket
  • freeaddrinfo
  • getaddrinfo
  • recv
  • send
  • setsockopt
Network Winhttp
  • WinHttpOpen
Network Info Queried
  • GetAdaptersAddresses
  • GetNetworkParams
Process Terminate
  • TerminateProcess

Shell Command Execution

"schtasks.exe" /Create /TN "HostDataConfig" /TR "\"C:\Users\Vivykpgk\AppData\Roaming\HostData\uasqn\sysdata.exe\"" /SC ONLOGON /DELAY 0002:00 /RL HIGHEST /F
"C:\Users\Vivykpgk\AppData\Roaming\HostData\uasqn\sysdata.exe"
"C:\Users\Vivykpgk\AppData\Local\Temp\nnq9n9ru.bat"
C:\WINDOWS\system32\timeout.exe timeout /t 3 /nobreak
WriteConsole: The batch file c
Show More
"schtasks.exe" /Create /TN "HostDataPlugin" /TR "\"wscript.exe\" //nologo \"C:\Users\Qdpgkcca\AppData\Roaming\HostData\oeig\sysdata.vbs\"" /SC MINUTE /MO 10 /RL HIGHEST /F
"C:\Users\Qdpgkcca\AppData\Roaming\HostData\oeig\sysdata.exe"
"C:\Users\Qdpgkcca\AppData\Local\Temp\qhpk2f3h.bat"
"schtasks.exe" /Create /TN "HostDataAgent" /TR "\"wscript.exe\" //nologo \"C:\Users\Tpvficgv\AppData\Roaming\HostData\gxmm\sysdata.vbs\"" /SC MINUTE /MO 10 /RL HIGHEST /F
"C:\Users\Tpvficgv\AppData\Roaming\HostData\gxmm\sysdata.exe"
"C:\Users\Tpvficgv\AppData\Local\Temp\60nx15ju.bat"