Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Создает следующие файлы на съемном носителе
- <Имя диска съемного носителя>:\dial.bmp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\dialmap.bmp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\toolbar.bmp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\dashborder_120.bmp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\contoso_1.cer.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\pmd.cer.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\sdksampleprivdeveloper.cer.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\sdksampleunprivdeveloper.cer.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\february_catalogue__2015.doc.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\delete.avi.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\join.avi.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\issi2013_template_for_posters.docx.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- <Имя диска съемного носителя>:\archer.avi.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' stop SQLWriter
- '%WINDIR%\syswow64\net.exe' stop SQLBrowser
- '%WINDIR%\syswow64\net.exe' stop MSSQLSERVER
- '%WINDIR%\syswow64\net.exe' stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\net.exe' stop MSDTC
- '%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\net.exe' stop vds
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable
Изменения в файловой системе
Создает следующие файлы
- %PROGRAMDATA%\ido.txt
- C:\far2\plugins\ftp\ftprus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\ftprus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\ftpeng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\farftp.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\ftpeng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\ftpcmds_rus.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\ftpcmds.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\notes.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\farftp.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\filecase\filecase.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\filecase\filecase.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\filecase\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\filecase\caserus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\filecase\caserus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\filecase\caseeng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\filecase\caseeng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\lib\progress_zema.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\macroview\macroeng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\techinfo_rus.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\macroview\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\hlfviewer\hlfviewerrus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\hlfviewer\hlfviewerrus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\hlfviewer\hlfviewereng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\hlfviewer\hlfviewereng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\hlfviewer\hlfviewer.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\hlfviewer\hlfviewer.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\farcmds\farcmdsrus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\hlfviewer\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\lib\progress_wesha.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\lib\progress_jm.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\lib\progress_farcopy.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\lib\ftpprogress.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\lib\ftpprogress.fll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\lib\ftpdirlist.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\lib\ftpdirlist.fll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\notes_rus.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\ftp\techinfo.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\farcmds\farcmdsrus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\editcase\ecaserus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\editcase\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\drawline\drawrus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\drawline\drawrus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\drawline\drawline.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\drawline\drawline.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\drawline\draweng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\drawline\draweng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\editcase\ecaseeng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\drawline\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\compare\compeng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\compare\compare.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\compare\compare.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\compare\cmprus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\compare\cmpeng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\compare\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\brackets\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\compare\comprus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\emenu\emenueng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\farcmds\farcmdseng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\editcase\ecaserus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\farcmds\farcmds.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\farcmds\farcmds.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\farcmds\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\emenu\hotkeyproperties.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\emenu\hotkeyclipboard.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\emenu\hotkey.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\emenu\emenurus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\farcmds\farcmdseng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\emenu\emenurus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\emenu\emenueng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\emenu\emenudel.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\emenu\emenu.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\emenu\emenu.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\emenu\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\editcase\editcase.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\editcase\editcase.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\editcase\ecaseeng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\macroview\macroeng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\macroview\macrorus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\macroview\macrorus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\proof\mswds_en.lex.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\office14\acewss.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\office14\aceodbc.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\office14\aceexch.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\msclientdatamgr\mscdm.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\help\msitss55.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\grphflt\png32.flt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\grphflt\gifimp32.flt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.flt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\osetupui.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\proof\mswds_es.lex.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dwdcw20.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\grphflt\jpegim32.flt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\smart tag\mofl.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\equation\eqnedt32.hlp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\proclist\procrus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\proclist\proclist.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\proclist\proclist.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\proclist\proceng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\proclist\proceng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\proclist\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\network\network.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\network\netrus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\network\netrus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\network\neteng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\network\neteng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\network\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\macroview\macroview.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\macroview\macroview.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\network\network.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\disks_eng.temp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\proclist\procrus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\disks_rus.temp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\tmprus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\pluginsdk\headers.pas\pluginw.pas.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\pluginsdk\headers.pas\farkeysw.pas.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\ose.exe.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\pluginsdk\headers.pas\farcolorw.pas.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\pluginsdk\headers.c\plugin.hpp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\pluginsdk\headers.c\farkeys.hpp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\pluginsdk\headers.c\farcolor.hpp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\tmprus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\shortcuts_eng.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\tmppanel.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\tmppanel.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\tmpeng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\tmpeng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\shortcuts_rus.temp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\shortcuts_rus.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\tmppanel\shortcuts_eng.temp.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\brackets\brackrus.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\brackets\brackrus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\brackets\brackets.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\vaxcolors.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\rodion_doroshkevich.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\nc5pal2.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\import_colors.bat.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\hell.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\greenmile.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\farcolors242.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\altmenu.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\dn_like.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\black_from_myodov.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\black_from_july.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\vaxcolors.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\default_highlighting\descript.ion.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\f3.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_ctrlleft.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\altx.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_ctrlins__.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_bs.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_apps.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_altbs.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\openinglastfile.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\macroconsts.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\f9table.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\f9deactivatemenu.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\edit_savefile.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\edit_saveandexit.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\edit_notepad.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\dialog_altdown.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\descript.ion.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\ctrlf10.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\ctrldel.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\altscreens.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\altsearch.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\nc5pal2.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\savesettings.cmd.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\farspa.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\farrus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\farpol.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\fareng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\farhun.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\farger.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\fareng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\file_id.diz.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\far.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\changelog_eng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\clearpluginscache.cmd.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- D:\install.log.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %PROGRAMDATA%\pubkey.txt
- C:\far2\farcze.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\hell.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\descript.ion.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\greenmile.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\farcolors242.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\dn_like.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\farrus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\descript.ion.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\import_colors.bat.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\farhun.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\import_colors.bat.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\export_colors.bat.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\colors\descript.ion.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\readme.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\restoresettings.cmd.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_ctrlq.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_ctrlright.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_ctrlshiftbackslash.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\align\alignrus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\align\aligneng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\align\align.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\align\align.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\fexcept\setfarexceptionhandler.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\fexcept\fexcept.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\arclite\7zcon.sfx.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\rus\far_faq.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\fexcept\excdump.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\fexcept\demangle32.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\fexcept\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\encyclopedia\tap\code.bin.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\encyclopedia\tap\12_r0m.tap.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\encyclopedia\tap\code.idb.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\rus\techinfo.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\rus\plugins_review.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\arclite\7z.sfx.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\rus\plugins_install.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\align\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\autowrap\autowrap.map.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\brackets\brackets.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\brackets\brackeng.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\brackets\brackeng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\brackets\brackeng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\brackets\brackdel.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\autowrap\wraprus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\autowrap\wrapeng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\arclite\7zs2con.sfx.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\arclite\7zs2.sfx.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\autowrap\autowrap.dll.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\arclite\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\arclite\arclite_rus.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\arclite\arclite_rus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\arclite\arclite_eng.lng.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\arclite\arclite_eng.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\arclite\7zsd.sfx.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\autowrap\changelog.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\rus\bug_report.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\rus\arc_support.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\eng\techinfo.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\view_pgdn.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\view_nextprevfile.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\view_ctrlupdown.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\shifttab.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\shiftf1.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\shiftbs.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\view_space.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_spacetoselect.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_numpad.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_mousewheeltilt.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_lynx_mot.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_jumptoselectedfile.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_esc.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_del.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_ctrlshiftpgupdn.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\panel_selectfromclipboard.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\wheelscreenswitch.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\macros\view_shiftinssearch.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\setup\default165.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\eng\plugins_review.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\xlat\russian\ctrlr.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\eng\plugins_install.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\eng\far_faq.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\eng\bug_report.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\documentation\eng\arc_support.txt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\xlat\russian\qwerty.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\xlat\russian\descript.ion.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\xlat\russian\ctrlshiftx.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\xlat\russian\apps.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\setup\descript.ion.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\xlat\russian\altr.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\xlat\descript.ion.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\shell\farhere.inf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\shell\descript.ion.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\setup\windowsgui.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\setup\executor_cmd.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\addons\setup\executor_4nt.reg.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- C:\far2\plugins\brackets\brackrus.hlf.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
- %CommonProgramFiles%\microsoft shared\grphflt\wpgimp32.flt.[voiddecryption@protonmail.com][id-mvdp54qb3hx1fur].void
Сетевая активность
TCP
Запросы HTTP GET
- /ip-provider.php via sf###dev.org
- /raw/eEpt6UrD via pa###bin.com
UDP
- DNS ASK sf###dev.org
- DNS ASK pa###bin.com
Другое
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLWriter
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set currentprofile state off
- '%WINDIR%\syswow64\net1.exe' stop vds
- '%WINDIR%\syswow64\cmd.exe' /c net stop vds
- '%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLSERVERAGENT
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin delete catalog -quiet
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled no
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\net1.exe' stop MSDTC
- '%WINDIR%\syswow64\cmd.exe' /c net stop MSDTC
- '%WINDIR%\syswow64\net1.exe' stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER
- '%WINDIR%\syswow64\cmd.exe' /c net stop MSSQLSERVER
- '%WINDIR%\syswow64\net1.exe' stop SQLBrowser
- '%WINDIR%\syswow64\cmd.exe' /c net stop SQLBrowser
- '%WINDIR%\syswow64\net1.exe' stop SQLWriter
- '%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall set opmode mode=disable
