Trojan.Siggen14.20015

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Classes\3XEfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\Software\Classes\.exe] '' = 'exefile'
[<HKLM>\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[<HKLM>\Software\Classes\.com] '' = 'comfile'
[<HKLM>\Software\Classes\comfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\Software\Classes\.bat] '' = 'batfile'
[<HKLM>\Software\Classes\.cmd] '' = 'cmdfile'
[<HKLM>\Software\Classes\.pif] '' = 'piffile'
[<HKLM>\Software\Classes\batfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\Software\Classes\cmdfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\Software\Classes\piffile\shell\open\command] '' = '"%1" %*'
[<HKLM>\Software\Classes\telnet\shell\open\command] '' = '"<SYSTEM32>\rundll32.exe" "<SYSTEM32>\url.dll",TelnetProtocolHandler %l'
[<HKLM>\software\Wow6432Node\microsoft\windows nt\currentversion\winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,'

Устанавливает следующие настройки сервисов

[<HKLM>\SYSTEM\CurrentControlSet\services\AFD] 'Start' = '00000001'
[<HKLM>\SYSTEM\CurrentControlSet\services\tdx] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\W32Time] 'ImagePath' = '<SYSTEM32>\svchost.exe -k LocalService'
[<HKLM>\SYSTEM\CurrentControlSet\services\Wdf01000] 'ImagePath' = 'system32\drivers\Wdf01000.sys'
[<HKLM>\SYSTEM\CurrentControlSet\services\Wdf01000] 'Start' = '00000000'
[<HKLM>\SYSTEM\CurrentControlSet\services\WinDefend] 'ImagePath' = '<SYSTEM32>\svchost.exe -k secsvcs'
[<HKLM>\SYSTEM\CurrentControlSet\services\WinDefend] 'Start' = '00000002'
[<HKLM>\SYSTEM\CurrentControlSet\Services\Spooler] 'Start' = '00000002'
[<HKLM>\SYSTEM\CurrentControlSet\services\tdx] 'ImagePath' = 'system32\DRIVERS\tdx.sys'
[<HKLM>\SYSTEM\CurrentControlSet\services\WinDefend\Parameters] 'ServiceDll' = '%ProgramFiles%\Windows Defender\mpsvc.dll'
[<HKLM>\SYSTEM\CurrentControlSet\services\Winmgmt] 'Start' = '00000002'
[<HKLM>\SYSTEM\CurrentControlSet\services\ws2ifsl] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\wscsvc] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\wscsvc] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
[<HKLM>\System\CurrentControlSet\Services\wscsvc] 'ImagePath' = '<SYSTEM32>\svchost.exe -k LocalServiceNetworkRestricted'
[<HKLM>\SYSTEM\CurrentControlSet\Services\wuauserv] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
[<HKLM>\SYSTEM\CurrentControlSet\services\WinHttpAutoProxySvc] 'ImagePath' = '<SYSTEM32>\svchost.exe -k LocalService'
[<HKLM>\SYSTEM\CurrentControlSet\services\Winmgmt] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
[<HKLM>\SYSTEM\CurrentControlSet\Services\Schedule] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
[<HKLM>\SYSTEM\CurrentControlSet\Services\seclogon] 'Start' = '00000002'
[<HKLM>\SYSTEM\CurrentControlSet\Services\seclogon] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
[<HKLM>\SYSTEM\CurrentControlSet\Services\AsyncMac] 'ImagePath' = 'system32\DRIVERS\asyncmac.sys'
[<HKLM>\SYSTEM\CurrentControlSet\services\BITS] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
[<HKLM>\SYSTEM\CurrentControlSet\services\BridgeMP] 'ImagePath' = 'system32\DRIVERS\bridge.sys'
[<HKLM>\System\CurrentControlSet\Services\Browser] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
[<HKLM>\SYSTEM\CurrentControlSet\Services\COMSysApp] 'ImagePath' = '<SYSTEM32>\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}'
[<HKLM>\SYSTEM\CurrentControlSet\Services\CryptSvc] 'ImagePath' = '<SYSTEM32>\svchost.exe -k NetworkService'
[<HKLM>\SYSTEM\CurrentControlSet\Services\CryptSvc] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\AppMgmt] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
[<HKLM>\SYSTEM\CurrentControlSet\Services\lanmanserver] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
[<HKLM>\System\CurrentControlSet\Services\lmhosts] 'ImagePath' = '<SYSTEM32>\svchost.exe -k LocalServiceNetworkRestricted'
[<HKLM>\SYSTEM\CurrentControlSet\services\nsi] 'ImagePath' = '<SYSTEM32>\svchost.exe -k LocalService'
[<HKLM>\SYSTEM\CurrentControlSet\services\nsi] 'Start' = '00000002'
[<HKLM>\SYSTEM\CurrentControlSet\services\PcaSvc] 'ImagePath' = '<SYSTEM32>\svchost.exe -k LocalSystemNetworkRestricted'
[<HKLM>\SYSTEM\CurrentControlSet\services\PcaSvc] 'Start' = '00000002'
[<HKLM>\SYSTEM\CurrentControlSet\services\PolicyAgent] 'ImagePath' = '<SYSTEM32>\svchost.exe -k NetworkServiceNetworkRestricted'
[<HKLM>\SYSTEM\CurrentControlSet\services\RemoteAccess] 'ImagePath' = '<SYSTEM32>\svchost.exe -k netsvcs'
[<HKLM>\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters] 'Start' = '00000002'
[<HKLM>\SYSTEM\CurrentControlSet\Services\wuauserv] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\PROCEXP113] 'ImagePath' = '<DRIVERS>\PROCEXP113.SYS'

Создает следующие сервисы

'PROCEXP113' <DRIVERS>\PROCEXP113.SYS

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Компонент восстановления системы (SR)

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\combofix_19.11.4.1.exe
C:\32788r22fwjfw\license\unxutilsdist.com
%WINDIR%\erdnt\hiv-backup\security
%WINDIR%\erdnt\hiv-backup\default
%WINDIR%\erdnt\hiv-backup\software
%WINDIR%\erdnt\hiv-backup\erdnt.con
%WINDIR%\erdnt\hiv-backup\system
%WINDIR%\erdnt\hiv-backup\erdnt.inf
%WINDIR%\erdnt\hiv-backup\bcd
%TEMP%\nsx760b.tmp\nsisdl.dll
C:\32788r22fwjfw\license\streamtools.zip
C:\32788r22fwjfw\license\pv_5_2_2.zip
C:\32788r22fwjfw\license\ncmd.cfxxe
C:\32788r22fwjfw\license\mtee.txt
C:\32788r22fwjfw\license\iexplore.exe
C:\32788r22fwjfw\license\firefox.exe
C:\32788r22fwjfw\license\dumphive-license.txt
C:\32788r22fwjfw\license\zip - license.txt
%WINDIR%\erdnt\hiv-backup\sam
C:\32788r22fwjfw\license\unxutilsdist.pif
%WINDIR%\erdnt\hiv-backup\users\00000002\ntuser.dat
%WINDIR%\erdnt\hiv-backup\users\00000003\ntuser.dat
C:\32788r22fwjfw\w7.mac
C:\32788r22fwjfw\nolaunch.dat
C:\32788r22fwjfw\setpath_n.cmd
C:\32788r22fwjfw\temppath.bat
C:\32788r22fwjfw\cmd.3xe
%TEMP%\nsx760b.tmp\execcmd.dll
C:\32788r22fwjfw\rar_sfx.cmd
C:\32788r22fwjfw\en-us\cmd.3xe.mui
%TEMP%\nsx760b.tmp\nsexec.dll
C:\32788r22fwjfw\vista.krl
C:\32788r22fwjfw\vun.dat
C:\32788r22fwjfw\w6432.dat
C:\32788r22fwjfw\desktop.ini
%WINDIR%\erdnt\hiv-backup\erdntdos.loc
%WINDIR%\erdnt\hiv-backup\erdntwin.loc
%WINDIR%\erdnt\hiv-backup\erdnt.exe
%WINDIR%\erdnt\hiv-backup\users\00000004\usrclass.dat
%WINDIR%\erdnt\hiv-backup\users\00000001\ntuser.dat
C:\32788r22fwjfw\license\unxutilsdist.html
C:\32788r22fwjfw\license\fi - license.txt
C:\32788r22fwjfw\license\extract.txt
C:\32788r22fwjfw\svchost.w7.x64.dat
C:\32788r22fwjfw\svchost.vista.dat
C:\32788r22fwjfw\svchost.dat
C:\32788r22fwjfw\svc_wht.dat
C:\32788r22fwjfw\srizbi.md5
C:\32788r22fwjfw\sqlite3.3xe
C:\32788r22fwjfw\setpath.3xe
C:\32788r22fwjfw\sed.3xe
C:\32788r22fwjfw\safeboot.def.vista.dat
C:\32788r22fwjfw\safeboot.def.dat
C:\32788r22fwjfw\safeboot.dat
C:\32788r22fwjfw\s0rt.3xe
C:\32788r22fwjfw\run2.sed
C:\32788r22fwjfw\rogues.dat
C:\32788r22fwjfw\rmbr.3xe
C:\32788r22fwjfw\restore_pt.vbs
C:\32788r22fwjfw\region.dat
C:\32788r22fwjfw\svchost.vista.x64.dat
C:\32788r22fwjfw\svchost.w8.dat
C:\32788r22fwjfw\en-us\iexplore.exe
C:\32788r22fwjfw\swreg.3xe
C:\32788r22fwjfw\license\curl - license.txt
C:\32788r22fwjfw\svchost.w8.x64.dat
C:\32788r22fwjfw\zip.3xe
C:\32788r22fwjfw\zhsvc.dat
C:\32788r22fwjfw\zdomain.dat
C:\32788r22fwjfw\xpreg.dat
C:\32788r22fwjfw\xpmcode.dat
C:\32788r22fwjfw\w8reg.dat
C:\32788r22fwjfw\pv.com
C:\32788r22fwjfw\w7reg.dat
C:\32788r22fwjfw\w7mcode.dat
C:\32788r22fwjfw\vistareg.dat
C:\32788r22fwjfw\vistamcode.dat
C:\32788r22fwjfw\toolbar.sed
C:\32788r22fwjfw\tail.3xe
C:\32788r22fwjfw\system_ini.dat
C:\32788r22fwjfw\swxcacls.3xe
C:\32788r22fwjfw\swsc.3xe
C:\32788r22fwjfw\pnp296_00
C:\32788r22fwjfw\svchost.w7.dat
C:\32788r22fwjfw\disclaimed.dat
C:\32788r22fwjfw\pv.txt
C:\combofix_19.11.4.1\cf13968.3xe
C:\combofix_19.11.4.1\en-us\route.3xe.mui
C:\combofix_19.11.4.1\en-us\regt.3xe.mui
C:\combofix_19.11.4.1\en-us\ping.3xe.mui
C:\combofix_19.11.4.1\en-us\iexplore.exe
C:\combofix_19.11.4.1\en-us\cscript.3xe.mui
C:\combofix_19.11.4.1\en-us\cmd.3xe.mui
C:\combofix_19.11.4.1\en-us\cf13968.3xe.mui
C:\combofix_19.11.4.1\en-us\attrib.3xe.mui
C:\32788r22fwjfw\license\sfs.bat
C:\32788r22fwjfw\license\sf.exe
C:\32788r22fwjfw\license\readme.txt
C:\32788r22fwjfw\license\ls.exe
C:\32788r22fwjfw\license\ds.exe
C:\32788r22fwjfw\license\cs.exe
C:\32788r22fwjfw\license\rs.bat
C:\32788r22fwjfw\license\fs.bat
C:\32788r22fwjfw\dirname00
C:\32788r22fwjfw\dirname01
C:\start_.cmd
C:\32788r22fwjfw\start_dat
C:\combofix_19.11.4.1\mirrors00
C:\combofix_19.11.4.1\n_\3809
C:\combofix_19.11.4.1\n_\29144
C:\combofix_19.11.4.1\n_\31793
C:\combofix_19.11.4.1\n_\pingtest
C:\combofix_19.11.4.1\n_\169
C:\combofix_19.11.4.1\n_\16117
C:\combofix_19.11.4.1\foreignwht
C:\combofix_19.11.4.1\n_\12820
C:\32788r22fwjfw\avwhite
C:\qoobox\quarantine\catchme.log
C:\combofix_19.11.4.1\erunt.dat
C:\combofix_19.11.4.1\kmd.dat
C:\combofix_19.11.4.1\n_\7111
C:\combofix_19.11.4.1\desktop.ini
C:\combofix_19.11.4.1\ccs.bat
C:\combofix_19.11.4.1\vista.krl
C:\combofix_19.11.4.1\n_\4919
C:\32788r22fwjfw\filename
C:\32788r22fwjfw\avblack
C:\32788r22fwjfw\update-cf.cmd
C:\32788r22fwjfw\pev.exe
C:\32788r22fwjfw\nircmdb.exe
C:\32788r22fwjfw\en-us\cf13968.3xe.mui
C:\32788r22fwjfw\muisubst.dat
C:\32788r22fwjfw\cmdmui00
C:\32788r22fwjfw\en-us\regt.3xe.mui
C:\32788r22fwjfw\en-us\route.3xe.mui
C:\32788r22fwjfw\en-us\ping.3xe.mui
C:\32788r22fwjfw\en-us\cscript.3xe.mui
C:\32788r22fwjfw\en-us\attrib.3xe.mui
C:\32788r22fwjfw\mui
C:\32788r22fwjfw\mui00
C:\32788r22fwjfw\n_\30075
%TEMP%\nsx760b.tmp\nsprocess.dll
C:\32788r22fwjfw\curver
C:\32788r22fwjfw\vercf.bat
C:\32788r22fwjfw\set.txt
C:\32788r22fwjfw\n_\19557
C:\32788r22fwjfw\nlscodepageacp00
C:\32788r22fwjfw\msname00
C:\32788r22fwjfw\oldsfxname00
C:\32788r22fwjfw\userinit00
C:\32788r22fwjfw\route.3xe
C:\32788r22fwjfw\ping.3xe
C:\32788r22fwjfw\cscript.3xe
C:\32788r22fwjfw\attrib.3xe
C:\32788r22fwjfw\sfx.cmd
C:\32788r22fwjfw\temp01
C:\32788r22fwjfw\set00
C:\32788r22fwjfw\winnt00
%WINDIR%\temp\udde55e.tmp
C:\32788r22fwjfw\pv.exe
C:\32788r22fwjfw\mdcheck00.dat
C:\32788r22fwjfw\temp00
<DRIVERS>\procexp113.sys
C:\32788r22fwjfw\handle64.exe
C:\32788r22fwjfw\nlslanguagedefault
C:\32788r22fwjfw\nlslanguage00
C:\32788r22fwjfw\chcp.bat
C:\32788r22fwjfw\mdcheck0a.dat
C:\32788r22fwjfw\powp.dat
C:\32788r22fwjfw\pevb.3xe
C:\32788r22fwjfw\pev.3xe
C:\32788r22fwjfw\find3m.bat
C:\32788r22fwjfw\list-c.bat
C:\32788r22fwjfw\list-b.bat
C:\32788r22fwjfw\lang.bat
C:\32788r22fwjfw\ksvchost.vbs
C:\32788r22fwjfw\kill-all.cmd
C:\32788r22fwjfw\knetsvcs.vbs
C:\32788r22fwjfw\install-rc.cmd
C:\32788r22fwjfw\imefile.dat
C:\32788r22fwjfw\gethive.cmd
C:\32788r22fwjfw\fin.dat
C:\32788r22fwjfw\filekill.3xe
C:\32788r22fwjfw\favoritesfile.cfx
C:\32788r22fwjfw\favoritefolder.cfx
C:\32788r22fwjfw\fkmgen.cmd
C:\32788r22fwjfw\fixlsp64.cmd
C:\32788r22fwjfw\fixlsp.bat
C:\32788r22fwjfw\localappdatafile.cfx
C:\32788r22fwjfw\list.bat
C:\32788r22fwjfw\localservice.dat
C:\32788r22fwjfw\fd-sv.cmd
C:\32788r22fwjfw\nirscript.dat
C:\32788r22fwjfw\nircmdc.3xe
C:\32788r22fwjfw\nircmd.chm
C:\32788r22fwjfw\nircmd.3xe
C:\32788r22fwjfw\networkservice.dat
C:\32788r22fwjfw\nt-os.cmd
C:\32788r22fwjfw\nd_64.bat
C:\32788r22fwjfw\nd_.bat
C:\32788r22fwjfw\moveit.bat
C:\32788r22fwjfw\pv.3xe
C:\32788r22fwjfw\mzchanged.dat
C:\32788r22fwjfw\mdwht.dat
C:\32788r22fwjfw\localsystemnetworkrestricted.dat
C:\32788r22fwjfw\localsettingsfolder.cfx
C:\32788r22fwjfw\localsettingsfile.cfx
C:\32788r22fwjfw\localservicenetworkrestricted.dat
C:\32788r22fwjfw\localappdatafolder.cfx
C:\32788r22fwjfw\osid.vbs
C:\32788r22fwjfw\exe.reg
C:\32788r22fwjfw\erunt.loc
C:\32788r22fwjfw\bfe.dat
C:\32788r22fwjfw\assoc.cmd
C:\32788r22fwjfw\appdatafolder.cfx
C:\32788r22fwjfw\appdatafile.cfx
C:\32788r22fwjfw\activedrv.vbs
C:\32788r22fwjfw\awf.cmd
C:\32788r22fwjfw\023w8.dat
C:\32788r22fwjfw\023w7.dat
C:\32788r22fwjfw\023v.dat
C:\32788r22fwjfw\023.dat
%TEMP%\nsx760b.tmp\banner.dll
%TEMP%\nsx760b.tmp\userinfo.dll
%TEMP%\nsx760b.tmp\vista.krl
%TEMP%\nsx760b.tmp\w7.mac
%TEMP%\nsx760b.tmp\system.dll
%TEMP%\nsh75fa.tmp
C:\32788r22fwjfw\boot-rk.cmd
C:\32788r22fwjfw\boot.bat
C:\32788r22fwjfw\bootdrv.vbs
C:\32788r22fwjfw\auto-rc.cmd
C:\32788r22fwjfw\cf-script.cmd
C:\32788r22fwjfw\erdntwin.loc
C:\32788r22fwjfw\erunt.3xe
C:\32788r22fwjfw\erdntdos.loc
C:\32788r22fwjfw\erdnt.e_e
C:\32788r22fwjfw\drvrun.vbs
C:\32788r22fwjfw\dnl.dat
C:\32788r22fwjfw\desktopfile.cfx
C:\32788r22fwjfw\delclsid64.bat
C:\32788r22fwjfw\p.cmd
C:\32788r22fwjfw\mpssvc.dat
C:\32788r22fwjfw\delclsid.bat
C:\32788r22fwjfw\cregc.cmd
C:\32788r22fwjfw\creg.dat
C:\32788r22fwjfw\create.cmd
C:\32788r22fwjfw\combobatch.bat
C:\32788r22fwjfw\combofix-download.3xe
C:\32788r22fwjfw\combo-fix.sys
C:\32788r22fwjfw\catch-sub.cmd
C:\32788r22fwjfw\dpf.str
C:\32788r22fwjfw\cregc.dat
C:\32788r22fwjfw\list-d.bat
C:\32788r22fwjfw\personalfile.cfx
C:\32788r22fwjfw\hidec.3xe
C:\32788r22fwjfw\hwid.pif
C:\32788r22fwjfw\handle.3xe
C:\32788r22fwjfw\gsar.3xe
C:\32788r22fwjfw\grep.3xe
C:\32788r22fwjfw\fl0.bat
C:\32788r22fwjfw\firefox.exe
C:\32788r22fwjfw\files.pif
C:\32788r22fwjfw\ffext.pif
C:\32788r22fwjfw\ffdefstr.dll
C:\32788r22fwjfw\extract.3xe
C:\32788r22fwjfw\embedded.sed
C:\32788r22fwjfw\dumphive.3xe
C:\32788r22fwjfw\ddsdo.sed
C:\32788r22fwjfw\dd.3xe
C:\32788r22fwjfw\clsid.c
C:\32788r22fwjfw\catchme.3xe
C:\32788r22fwjfw\c.bat
C:\32788r22fwjfw\iexplore.exe
C:\32788r22fwjfw\image001.gif
C:\32788r22fwjfw\pausep.3xe
C:\32788r22fwjfw\md5sum00.pif
C:\32788r22fwjfw\mtee.3xe
C:\32788r22fwjfw\nir.pif
C:\32788r22fwjfw\netsvc.xp.dat
C:\32788r22fwjfw\netsvc.vista.dat
C:\32788r22fwjfw\netsvc.dat
C:\32788r22fwjfw\netsvc.bad.dat
C:\32788r22fwjfw\ndis_combofix.dat
C:\32788r22fwjfw\ncmd.com
C:\32788r22fwjfw\history.bat
C:\32788r22fwjfw\badclsid.c
C:\32788r22fwjfw\personalfolder.cfx
C:\32788r22fwjfw\mbr.chk
C:\32788r22fwjfw\mbr.3xe
C:\32788r22fwjfw\lnkread.vbs
C:\32788r22fwjfw\katch.cmd
C:\32788r22fwjfw\iphlpsvc.w8.dat
C:\32788r22fwjfw\iphlpsvc.w7.dat
C:\32788r22fwjfw\iphlpsvc.vista.dat
C:\32788r22fwjfw\md5sum.pif
C:\combofix_19.11.4.1\n_\19953
C:\combofix_19.11.4.1\mirrors
C:\32788r22fwjfw\asp.str
C:\32788r22fwjfw\srestore.cmd
C:\32788r22fwjfw\rust.str
C:\32788r22fwjfw\rkey.cmd
C:\32788r22fwjfw\regscan64.cmd
C:\32788r22fwjfw\regscan.cmd
C:\32788r22fwjfw\regdo.sed
C:\32788r22fwjfw\rnullfix64.3xe
C:\32788r22fwjfw\regdacl.sed
C:\32788r22fwjfw\rclink.dat
C:\32788r22fwjfw\purity.dat
C:\32788r22fwjfw\programsfolder.cfx
C:\32788r22fwjfw\programsfile.cfx
C:\32788r22fwjfw\profilesfolder.cfx
C:\32788r22fwjfw\profilesfile.cfx
C:\32788r22fwjfw\prep.inf
C:\32788r22fwjfw\policies.dat
C:\32788r22fwjfw\safeboot.def.w8.dat
C:\32788r22fwjfw\setenvmt.bat
C:\32788r22fwjfw\safeboot.def.w7.dat
C:\32788r22fwjfw\shaccess.dat
C:\32788r22fwjfw\appinit.bad
C:\32788r22fwjfw\snapshot.cmd
C:\32788r22fwjfw\xpsboot.reg
C:\32788r22fwjfw\wmi_rem.vbs
C:\32788r22fwjfw\vwintemp.dacl
C:\32788r22fwjfw\vipev.dat
C:\32788r22fwjfw\vinfo2
C:\32788r22fwjfw\vinfo
C:\32788r22fwjfw\vinfo3
C:\32788r22fwjfw\av.vbs
C:\32788r22fwjfw\av.cmd
C:\32788r22fwjfw\undow7_xp.dat
C:\32788r22fwjfw\templatesfolder.cfx
C:\32788r22fwjfw\templatesfile.cfx
C:\32788r22fwjfw\svcdrv.vbs
C:\32788r22fwjfw\suppscan.cmd
C:\32788r22fwjfw\startupfile.cfx
C:\32788r22fwjfw\startmenufolder.cfx
C:\32788r22fwjfw\startmenufile.cfx
C:\32788r22fwjfw\vbr.pif
C:\combofix_19.11.4.1\n_\13772

Удаляет следующие файлы

C:\32788r22fwjfw\nirscript.dat
C:\32788r22fwjfw\temp01
C:\32788r22fwjfw\msname00
C:\32788r22fwjfw\avwhite
C:\32788r22fwjfw\avblack
C:\32788r22fwjfw\filename
C:\32788r22fwjfw\dirname00
C:\32788r22fwjfw\dirname01
C:\32788r22fwjfw\oldsfxname00
C:\32788r22fwjfw\nolaunch.dat
C:\32788r22fwjfw\firefox.exe
C:\32788r22fwjfw\undow7_xp.dat
C:\32788r22fwjfw\en-us\iexplore.exe
C:\32788r22fwjfw\license\cs.exe
C:\32788r22fwjfw\license\ds.exe
C:\32788r22fwjfw\license\extract.txt
C:\32788r22fwjfw\license\firefox.exe
C:\32788r22fwjfw\license\fs.bat
C:\32788r22fwjfw\license\iexplore.exe
C:\32788r22fwjfw\license\ls.exe
C:\32788r22fwjfw\license\mtee.txt
C:\32788r22fwjfw\license\ncmd.cfxxe
C:\32788r22fwjfw\license\pv_5_2_2.zip
C:\32788r22fwjfw\license\readme.txt
C:\32788r22fwjfw\license\rs.bat
C:\32788r22fwjfw\license\sfs.bat
C:\32788r22fwjfw\n_\19557
C:\32788r22fwjfw\n_\30075
C:\start_.cmd
C:\combofix_19.11.4.1\p.cmd
C:\32788r22fwjfw\set00
C:\combofix_19.11.4.1\cmd.3xe
C:\32788r22fwjfw\userinit00
C:\32788r22fwjfw\nircmd.chm
C:\32788r22fwjfw\temppath.bat
C:\32788r22fwjfw\pnp296_00
C:\32788r22fwjfw\winnt00
%WINDIR%\temp\udde55e.tmp
C:\32788r22fwjfw\curver
%TEMP%\nsx760b.tmp\banner.dll
%TEMP%\nsx760b.tmp\execcmd.dll
%TEMP%\nsx760b.tmp\nsexec.dll
%TEMP%\nsx760b.tmp\nsisdl.dll
%TEMP%\nsx760b.tmp\nsprocess.dll
%TEMP%\nsx760b.tmp\system.dll
%TEMP%\nsx760b.tmp\userinfo.dll
%TEMP%\nsx760b.tmp\vista.krl
%TEMP%\nsx760b.tmp\w7.mac
%TEMP%\7zipsfx.000\combofix_19.11.4.1.exe
C:\32788r22fwjfw\mui00
C:\32788r22fwjfw\cmdmui00
C:\32788r22fwjfw\muisubst.dat
C:\32788r22fwjfw\md5sum00.pif
C:\32788r22fwjfw\ksvchost.vbs
C:\32788r22fwjfw\pv.txt
C:\32788r22fwjfw\nlscodepageacp00
C:\32788r22fwjfw\nlslanguage00
<DRIVERS>\procexp113.sys
C:\32788r22fwjfw\handle64.exe
C:\32788r22fwjfw\temp00
C:\32788r22fwjfw\mdcheck00.dat
C:\32788r22fwjfw\mdcheck0a.dat
C:\32788r22fwjfw\dnl.dat
C:\32788r22fwjfw\set.txt
C:\combofix_19.11.4.1\mirrors00

Перемещает следующие файлы

C:\32788r22fwjfw\pv.exe в C:\32788r22fwjfw\pv.3xe
C:\32788r22fwjfw\pv.com в C:\combofix_19.11.4.1\pv.com
C:\32788r22fwjfw\rar_sfx.cmd в C:\combofix_19.11.4.1\rar_sfx.cmd
C:\32788r22fwjfw\rclink.dat в C:\combofix_19.11.4.1\rclink.dat
C:\32788r22fwjfw\regdacl.sed в C:\combofix_19.11.4.1\regdacl.sed
C:\32788r22fwjfw\regdo.sed в C:\combofix_19.11.4.1\regdo.sed
C:\32788r22fwjfw\region.dat в C:\combofix_19.11.4.1\region.dat
C:\32788r22fwjfw\regscan.cmd в C:\combofix_19.11.4.1\regscan.cmd
C:\32788r22fwjfw\regscan64.cmd в C:\combofix_19.11.4.1\regscan64.cmd
C:\32788r22fwjfw\restore_pt.vbs в C:\combofix_19.11.4.1\restore_pt.vbs
C:\32788r22fwjfw\rkey.cmd в C:\combofix_19.11.4.1\rkey.cmd
C:\32788r22fwjfw\p.cmd в C:\combofix_19.11.4.1\p.cmd
C:\32788r22fwjfw\rmbr.3xe в C:\combofix_19.11.4.1\rmbr.3xe
C:\32788r22fwjfw\rogues.dat в C:\combofix_19.11.4.1\rogues.dat
C:\32788r22fwjfw\route.3xe в C:\combofix_19.11.4.1\route.3xe
C:\32788r22fwjfw\run2.sed в C:\combofix_19.11.4.1\run2.sed
C:\32788r22fwjfw\rust.str в C:\combofix_19.11.4.1\rust.str
C:\32788r22fwjfw\s0rt.3xe в C:\combofix_19.11.4.1\s0rt.3xe
C:\32788r22fwjfw\safeboot.dat в C:\combofix_19.11.4.1\safeboot.dat
C:\32788r22fwjfw\safeboot.def.dat в C:\combofix_19.11.4.1\safeboot.def.dat
C:\32788r22fwjfw\safeboot.def.vista.dat в C:\combofix_19.11.4.1\safeboot.def.vista.dat
C:\32788r22fwjfw\safeboot.def.w7.dat в C:\combofix_19.11.4.1\safeboot.def.w7.dat
C:\32788r22fwjfw\safeboot.def.w8.dat в C:\combofix_19.11.4.1\safeboot.def.w8.dat
C:\32788r22fwjfw\purity.dat в C:\combofix_19.11.4.1\purity.dat
C:\32788r22fwjfw\pv.3xe в C:\combofix_19.11.4.1\pv.3xe
C:\32788r22fwjfw\programsfolder.cfx в C:\combofix_19.11.4.1\programsfolder.cfx
C:\32788r22fwjfw\programsfile.cfx в C:\combofix_19.11.4.1\programsfile.cfx
C:\32788r22fwjfw\profilesfolder.cfx в C:\combofix_19.11.4.1\profilesfolder.cfx
C:\32788r22fwjfw\netsvc.dat в C:\combofix_19.11.4.1\netsvc.dat
C:\32788r22fwjfw\netsvc.vista.dat в C:\combofix_19.11.4.1\netsvc.vista.dat
C:\32788r22fwjfw\netsvc.xp.dat в C:\combofix_19.11.4.1\netsvc.xp.dat
C:\32788r22fwjfw\networkservice.dat в C:\combofix_19.11.4.1\networkservice.dat
C:\32788r22fwjfw\nircmd.3xe в C:\combofix_19.11.4.1\nircmd.3xe
C:\32788r22fwjfw\nircmdb.exe в C:\combofix_19.11.4.1\nircmdb.exe
C:\32788r22fwjfw\nircmdc.3xe в C:\combofix_19.11.4.1\nircmdc.3xe
C:\32788r22fwjfw\nirkmd.3xe в C:\combofix_19.11.4.1\nirkmd.3xe
C:\32788r22fwjfw\nlslanguagedefault в C:\combofix_19.11.4.1\nlslanguagedefault
C:\32788r22fwjfw\nt-os.cmd в C:\combofix_19.11.4.1\nt-os.cmd
C:\32788r22fwjfw\sed.3xe в C:\combofix_19.11.4.1\sed.3xe
C:\32788r22fwjfw\rnullfix64.3xe в C:\combofix_19.11.4.1\rnullfix64.3xe
C:\32788r22fwjfw\osid.vbs в C:\combofix_19.11.4.1\osid.vbs
C:\32788r22fwjfw\personalfile.cfx в C:\combofix_19.11.4.1\personalfile.cfx
C:\32788r22fwjfw\personalfolder.cfx в C:\combofix_19.11.4.1\personalfolder.cfx
C:\32788r22fwjfw\pev.3xe в C:\combofix_19.11.4.1\pev.3xe
C:\32788r22fwjfw\pev.exe в C:\combofix_19.11.4.1\pev.exe
C:\32788r22fwjfw\pevb.3xe в C:\combofix_19.11.4.1\pevb.3xe
C:\32788r22fwjfw\ping.3xe в C:\combofix_19.11.4.1\ping.3xe
C:\32788r22fwjfw\policies.dat в C:\combofix_19.11.4.1\policies.dat
C:\32788r22fwjfw\powp.dat в C:\combofix_19.11.4.1\powp.dat
C:\32788r22fwjfw\prep.inf в C:\combofix_19.11.4.1\prep.inf
C:\32788r22fwjfw\profilesfile.cfx в C:\combofix_19.11.4.1\profilesfile.cfx
C:\32788r22fwjfw\netsvc.bad.dat в C:\combofix_19.11.4.1\netsvc.bad.dat
C:\32788r22fwjfw\pausep.3xe в C:\combofix_19.11.4.1\pausep.3xe
C:\32788r22fwjfw\svcdrv.vbs в C:\combofix_19.11.4.1\svcdrv.vbs
C:\32788r22fwjfw\zhsvc.dat в C:\combofix_19.11.4.1\zhsvc.dat
C:\32788r22fwjfw\setpath_n.cmd в C:\combofix_19.11.4.1\setpath_n.cmd
C:\32788r22fwjfw\update-cf.cmd в C:\combofix_19.11.4.1\update-cf.cmd
C:\32788r22fwjfw\vbr.pif в C:\combofix_19.11.4.1\vbr.pif
C:\32788r22fwjfw\vercf.bat в C:\combofix_19.11.4.1\vercf.bat
C:\32788r22fwjfw\vinfo в C:\combofix_19.11.4.1\vinfo
C:\32788r22fwjfw\vinfo2 в C:\combofix_19.11.4.1\vinfo2
C:\32788r22fwjfw\vinfo3 в C:\combofix_19.11.4.1\vinfo3
C:\32788r22fwjfw\vipev.dat в C:\combofix_19.11.4.1\vipev.dat
C:\32788r22fwjfw\vista.krl в C:\combofix_19.11.4.1\vista.krl
C:\32788r22fwjfw\vistamcode.dat в C:\combofix_19.11.4.1\vistamcode.dat
C:\32788r22fwjfw\vistareg.dat в C:\combofix_19.11.4.1\vistareg.dat
C:\32788r22fwjfw\setenvmt.bat в C:\combofix_19.11.4.1\setenvmt.bat
C:\32788r22fwjfw\vun.dat в C:\combofix_19.11.4.1\vun.dat
C:\32788r22fwjfw\w6432.dat в C:\combofix_19.11.4.1\w6432.dat
C:\32788r22fwjfw\w7.mac в C:\combofix_19.11.4.1\w7.mac
C:\32788r22fwjfw\w7mcode.dat в C:\combofix_19.11.4.1\w7mcode.dat
C:\32788r22fwjfw\w7reg.dat в C:\combofix_19.11.4.1\w7reg.dat
C:\32788r22fwjfw\w8reg.dat в C:\combofix_19.11.4.1\w8reg.dat
C:\32788r22fwjfw\wmi_rem.vbs в C:\combofix_19.11.4.1\wmi_rem.vbs
C:\32788r22fwjfw\xpmcode.dat в C:\combofix_19.11.4.1\xpmcode.dat
C:\32788r22fwjfw\xpreg.dat в C:\combofix_19.11.4.1\xpreg.dat
C:\32788r22fwjfw\xpsboot.reg в C:\combofix_19.11.4.1\xpsboot.reg
C:\32788r22fwjfw\zdomain.dat в C:\combofix_19.11.4.1\zdomain.dat
C:\32788r22fwjfw\templatesfolder.cfx в C:\combofix_19.11.4.1\templatesfolder.cfx
C:\32788r22fwjfw\toolbar.sed в C:\combofix_19.11.4.1\toolbar.sed
C:\32788r22fwjfw\templatesfile.cfx в C:\combofix_19.11.4.1\templatesfile.cfx
C:\32788r22fwjfw\tail.3xe в C:\combofix_19.11.4.1\tail.3xe
C:\32788r22fwjfw\system_ini.dat в C:\combofix_19.11.4.1\system_ini.dat
C:\32788r22fwjfw\sfx.cmd в C:\combofix_19.11.4.1\sfx.cmd
C:\32788r22fwjfw\shaccess.dat в C:\combofix_19.11.4.1\shaccess.dat
C:\32788r22fwjfw\snapshot.cmd в C:\combofix_19.11.4.1\snapshot.cmd
C:\32788r22fwjfw\sqlite3.3xe в C:\combofix_19.11.4.1\sqlite3.3xe
C:\32788r22fwjfw\srestore.cmd в C:\combofix_19.11.4.1\srestore.cmd
C:\32788r22fwjfw\srizbi.md5 в C:\combofix_19.11.4.1\srizbi.md5
C:\32788r22fwjfw\startmenufile.cfx в C:\combofix_19.11.4.1\startmenufile.cfx
C:\32788r22fwjfw\startmenufolder.cfx в C:\combofix_19.11.4.1\startmenufolder.cfx
C:\32788r22fwjfw\startupfile.cfx в C:\combofix_19.11.4.1\startupfile.cfx
C:\32788r22fwjfw\start_dat в C:\combofix_19.11.4.1\start_dat
C:\32788r22fwjfw\setpath.3xe в C:\combofix_19.11.4.1\setpath.3xe
C:\32788r22fwjfw\nd_64.bat в C:\combofix_19.11.4.1\nd_64.bat
C:\32788r22fwjfw\suppscan.cmd в C:\combofix_19.11.4.1\suppscan.cmd
C:\32788r22fwjfw\svchost.vista.dat в C:\combofix_19.11.4.1\svchost.vista.dat
C:\32788r22fwjfw\svchost.vista.x64.dat в C:\combofix_19.11.4.1\svchost.vista.x64.dat
C:\32788r22fwjfw\svchost.w7.dat в C:\combofix_19.11.4.1\svchost.w7.dat
C:\32788r22fwjfw\svchost.w7.x64.dat в C:\combofix_19.11.4.1\svchost.w7.x64.dat
C:\32788r22fwjfw\svchost.w8.dat в C:\combofix_19.11.4.1\svchost.w8.dat
C:\32788r22fwjfw\svchost.w8.x64.dat в C:\combofix_19.11.4.1\svchost.w8.x64.dat
C:\32788r22fwjfw\svc_wht.dat в C:\combofix_19.11.4.1\svc_wht.dat
C:\32788r22fwjfw\swreg.3xe в C:\combofix_19.11.4.1\swreg.3xe
C:\32788r22fwjfw\swsc.3xe в C:\combofix_19.11.4.1\swsc.3xe
C:\32788r22fwjfw\swxcacls.3xe в C:\combofix_19.11.4.1\swxcacls.3xe
C:\32788r22fwjfw\sf.exe в C:\combofix_19.11.4.1\sf.exe
C:\32788r22fwjfw\svchost.dat в C:\combofix_19.11.4.1\svchost.dat
C:\32788r22fwjfw\vwintemp.dacl в C:\combofix_19.11.4.1\vwintemp.dacl
C:\32788r22fwjfw\nd_.bat в C:\combofix_19.11.4.1\nd_.bat
C:\32788r22fwjfw\localsettingsfolder.cfx в C:\combofix_19.11.4.1\localsettingsfolder.cfx
C:\32788r22fwjfw\combo-fix.sys в C:\combofix_19.11.4.1\combo-fix.sys
C:\32788r22fwjfw\combobatch.bat в C:\combofix_19.11.4.1\combobatch.bat
C:\32788r22fwjfw\combofix-download.3xe в C:\combofix_19.11.4.1\combofix-download.3xe
C:\32788r22fwjfw\create.cmd в C:\combofix_19.11.4.1\create.cmd
C:\32788r22fwjfw\creg.dat в C:\combofix_19.11.4.1\creg.dat
C:\32788r22fwjfw\cregc.cmd в C:\combofix_19.11.4.1\cregc.cmd
C:\32788r22fwjfw\cregc.dat в C:\combofix_19.11.4.1\cregc.dat
C:\32788r22fwjfw\cscript.3xe в C:\combofix_19.11.4.1\cscript.3xe
C:\32788r22fwjfw\dd.3xe в C:\combofix_19.11.4.1\dd.3xe
C:\32788r22fwjfw\ddsdo.sed в C:\combofix_19.11.4.1\ddsdo.sed
C:\32788r22fwjfw\attrib.3xe в C:\combofix_19.11.4.1\attrib.3xe
C:\32788r22fwjfw\delclsid.bat в C:\combofix_19.11.4.1\delclsid.bat
C:\32788r22fwjfw\desktop.ini в C:\combofix_19.11.4.1\desktop.ini
C:\32788r22fwjfw\desktopfile.cfx в C:\combofix_19.11.4.1\desktopfile.cfx
C:\32788r22fwjfw\disclaimed.dat в C:\combofix_19.11.4.1\disclaimed.dat
C:\32788r22fwjfw\dpf.str в C:\combofix_19.11.4.1\dpf.str
C:\32788r22fwjfw\drvrun.vbs в C:\combofix_19.11.4.1\drvrun.vbs
C:\32788r22fwjfw\dumphive.3xe в C:\combofix_19.11.4.1\dumphive.3xe
C:\32788r22fwjfw\embedded.sed в C:\combofix_19.11.4.1\embedded.sed
C:\32788r22fwjfw\erdnt.e_e в C:\combofix_19.11.4.1\erdnt.e_e
C:\32788r22fwjfw\erdntdos.loc в C:\combofix_19.11.4.1\erdntdos.loc
C:\32788r22fwjfw\erdntwin.loc в C:\combofix_19.11.4.1\erdntwin.loc
C:\32788r22fwjfw\clsid.c в C:\combofix_19.11.4.1\clsid.c
C:\32788r22fwjfw\cmd.3xe в C:\combofix_19.11.4.1\cmd.3xe
C:\32788r22fwjfw\chcp.bat в C:\combofix_19.11.4.1\chcp.bat
C:\32788r22fwjfw\cf-script.cmd в C:\combofix_19.11.4.1\cf-script.cmd
C:\32788r22fwjfw\catchme.3xe в C:\combofix_19.11.4.1\catchme.3xe
C:\32788r22fwjfw\license\sf.exe в C:\32788r22fwjfw\sf.exe
C:\32788r22fwjfw\023.dat в C:\combofix_19.11.4.1\023.dat
C:\32788r22fwjfw\023v.dat в C:\combofix_19.11.4.1\023v.dat
C:\32788r22fwjfw\023w7.dat в C:\combofix_19.11.4.1\023w7.dat
C:\32788r22fwjfw\023w8.dat в C:\combofix_19.11.4.1\023w8.dat
C:\32788r22fwjfw\activedrv.vbs в C:\combofix_19.11.4.1\activedrv.vbs
C:\32788r22fwjfw\appdatafile.cfx в C:\combofix_19.11.4.1\appdatafile.cfx
C:\32788r22fwjfw\appdatafolder.cfx в C:\combofix_19.11.4.1\appdatafolder.cfx
C:\32788r22fwjfw\appinit.bad в C:\combofix_19.11.4.1\appinit.bad
C:\32788r22fwjfw\asp.str в C:\combofix_19.11.4.1\asp.str
C:\32788r22fwjfw\erunt.3xe в C:\combofix_19.11.4.1\erunt.3xe
C:\32788r22fwjfw\delclsid64.bat в C:\combofix_19.11.4.1\delclsid64.bat
C:\32788r22fwjfw\assoc.cmd в C:\combofix_19.11.4.1\assoc.cmd
C:\32788r22fwjfw\av.cmd в C:\combofix_19.11.4.1\av.cmd
C:\32788r22fwjfw\av.vbs в C:\combofix_19.11.4.1\av.vbs
C:\32788r22fwjfw\awf.cmd в C:\combofix_19.11.4.1\awf.cmd
C:\32788r22fwjfw\badclsid.c в C:\combofix_19.11.4.1\badclsid.c
C:\32788r22fwjfw\bfe.dat в C:\combofix_19.11.4.1\bfe.dat
C:\32788r22fwjfw\boot-rk.cmd в C:\combofix_19.11.4.1\boot-rk.cmd
C:\32788r22fwjfw\boot.bat в C:\combofix_19.11.4.1\boot.bat
C:\32788r22fwjfw\bootdrv.vbs в C:\combofix_19.11.4.1\bootdrv.vbs
C:\32788r22fwjfw\c.bat в C:\combofix_19.11.4.1\c.bat
C:\32788r22fwjfw\catch-sub.cmd в C:\combofix_19.11.4.1\catch-sub.cmd
C:\32788r22fwjfw\nir.pif в C:\32788r22fwjfw\nirkmd.3xe
C:\32788r22fwjfw\auto-rc.cmd в C:\combofix_19.11.4.1\auto-rc.cmd
C:\32788r22fwjfw\gethive.cmd в C:\combofix_19.11.4.1\gethive.cmd
C:\32788r22fwjfw\ncmd.com в C:\combofix_19.11.4.1\ncmd.com
C:\32788r22fwjfw\extract.3xe в C:\combofix_19.11.4.1\extract.3xe
C:\32788r22fwjfw\lang.bat в C:\combofix_19.11.4.1\lang.bat
C:\32788r22fwjfw\list-b.bat в C:\combofix_19.11.4.1\list-b.bat
C:\32788r22fwjfw\list-c.bat в C:\combofix_19.11.4.1\list-c.bat
C:\32788r22fwjfw\list-d.bat в C:\combofix_19.11.4.1\list-d.bat
C:\32788r22fwjfw\list.bat в C:\combofix_19.11.4.1\list.bat
C:\32788r22fwjfw\lnkread.vbs в C:\combofix_19.11.4.1\lnkread.vbs
C:\32788r22fwjfw\localappdatafile.cfx в C:\combofix_19.11.4.1\localappdatafile.cfx
C:\32788r22fwjfw\localappdatafolder.cfx в C:\combofix_19.11.4.1\localappdatafolder.cfx
C:\32788r22fwjfw\localservice.dat в C:\combofix_19.11.4.1\localservice.dat
C:\32788r22fwjfw\localservicenetworkrestricted.dat в C:\combofix_19.11.4.1\localservicenetworkrestricted.dat
C:\32788r22fwjfw\erunt.loc в C:\combofix_19.11.4.1\erunt.loc
C:\32788r22fwjfw\localsettingsfile.cfx в C:\combofix_19.11.4.1\localsettingsfile.cfx
C:\32788r22fwjfw\localsystemnetworkrestricted.dat в C:\combofix_19.11.4.1\localsystemnetworkrestricted.dat
C:\32788r22fwjfw\mbr.3xe в C:\combofix_19.11.4.1\mbr.3xe
C:\32788r22fwjfw\mbr.chk в C:\combofix_19.11.4.1\mbr.chk
C:\32788r22fwjfw\md5sum.pif в C:\combofix_19.11.4.1\md5sum.pif
C:\32788r22fwjfw\mdwht.dat в C:\combofix_19.11.4.1\mdwht.dat
C:\32788r22fwjfw\moveit.bat в C:\combofix_19.11.4.1\moveit.bat
C:\32788r22fwjfw\mpssvc.dat в C:\combofix_19.11.4.1\mpssvc.dat
C:\32788r22fwjfw\mtee.3xe в C:\combofix_19.11.4.1\mtee.3xe
C:\32788r22fwjfw\mui в C:\combofix_19.11.4.1\mui
C:\32788r22fwjfw\mzchanged.dat в C:\combofix_19.11.4.1\mzchanged.dat
C:\32788r22fwjfw\kill-all.cmd в C:\combofix_19.11.4.1\kill-all.cmd
C:\32788r22fwjfw\knetsvcs.vbs в C:\combofix_19.11.4.1\knetsvcs.vbs
C:\32788r22fwjfw\katch.cmd в C:\combofix_19.11.4.1\katch.cmd
C:\32788r22fwjfw\iphlpsvc.w8.dat в C:\combofix_19.11.4.1\iphlpsvc.w8.dat
C:\32788r22fwjfw\iphlpsvc.w7.dat в C:\combofix_19.11.4.1\iphlpsvc.w7.dat
C:\32788r22fwjfw\favoritesfile.cfx в C:\combofix_19.11.4.1\favoritesfile.cfx
C:\32788r22fwjfw\fd-sv.cmd в C:\combofix_19.11.4.1\fd-sv.cmd
C:\32788r22fwjfw\ffdefstr.dll в C:\combofix_19.11.4.1\ffdefstr.dll
C:\32788r22fwjfw\ffext.pif в C:\combofix_19.11.4.1\ffext.pif
C:\32788r22fwjfw\filekill.3xe в C:\combofix_19.11.4.1\filekill.3xe
C:\32788r22fwjfw\files.pif в C:\combofix_19.11.4.1\files.pif
C:\32788r22fwjfw\fin.dat в C:\combofix_19.11.4.1\fin.dat
C:\32788r22fwjfw\find3m.bat в C:\combofix_19.11.4.1\find3m.bat
C:\32788r22fwjfw\fixlsp.bat в C:\combofix_19.11.4.1\fixlsp.bat
C:\32788r22fwjfw\fixlsp64.cmd в C:\combofix_19.11.4.1\fixlsp64.cmd
C:\32788r22fwjfw\exe.reg в C:\combofix_19.11.4.1\exe.reg
C:\32788r22fwjfw\ndis_combofix.dat в C:\combofix_19.11.4.1\ndis_combofix.dat
C:\32788r22fwjfw\fkmgen.cmd в C:\combofix_19.11.4.1\fkmgen.cmd
C:\32788r22fwjfw\gsar.3xe в C:\combofix_19.11.4.1\gsar.3xe
C:\32788r22fwjfw\handle.3xe в C:\combofix_19.11.4.1\handle.3xe
C:\32788r22fwjfw\hidec.3xe в C:\combofix_19.11.4.1\hidec.3xe
C:\32788r22fwjfw\history.bat в C:\combofix_19.11.4.1\history.bat
C:\32788r22fwjfw\hwid.pif в C:\combofix_19.11.4.1\hwid.pif
C:\32788r22fwjfw\iexplore.exe в C:\combofix_19.11.4.1\iexplore.exe
C:\32788r22fwjfw\image001.gif в C:\combofix_19.11.4.1\image001.gif
C:\32788r22fwjfw\imefile.dat в C:\combofix_19.11.4.1\imefile.dat
C:\32788r22fwjfw\install-rc.cmd в C:\combofix_19.11.4.1\install-rc.cmd
C:\32788r22fwjfw\iphlpsvc.vista.dat в C:\combofix_19.11.4.1\iphlpsvc.vista.dat
C:\32788r22fwjfw\favoritefolder.cfx в C:\combofix_19.11.4.1\favoritefolder.cfx
C:\32788r22fwjfw\grep.3xe в C:\combofix_19.11.4.1\grep.3xe
C:\32788r22fwjfw\zip.3xe в C:\combofix_19.11.4.1\zip.3xe

Подменяет следующие файлы

C:\32788r22fwjfw\temp00

Сетевая активность

Подключается к

'do######.bleepingcomputer.com':80
'20#.#3.120.24':80
'69.#.236.82':80

UDP

DNS ASK do######.bleepingcomputer.com
DNS ASK co###ndiate.net
DNS ASK google.com

Другое

Ищет следующие окна

ClassName: 'RegEdit_RegEdit' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\combofix_19.11.4.1.exe' /S /NCRC
'C:\32788r22fwjfw\pev.3xe' -tf -tpmz -t!o C:\$RECYCLE.bin\*000*.? -preg"\\U\\[^\\]*\..$"
'C:\32788r22fwjfw\attrib.3xe' +R "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe"
'C:\32788r22fwjfw\grep.3xe' "=.*[a-z]" sfx.cmd
'C:\32788r22fwjfw\grep.3xe' -Eisq "=.\/NoMbr| .\/NoMbr. | .\/NoMbr.$" sfx.cmd
'C:\32788r22fwjfw\grep.3xe' -Eisq "\\CFScript[^:\/\\]*$" sfx.cmd
'C:\32788r22fwjfw\grep.3xe' -Ei "\\NoMbr\.....$" MSName00
'C:\32788r22fwjfw\grep.3xe' -Ei "\\iexplore\.exe.$" MSName00
'C:\32788r22fwjfw\grep.3xe' -Fsf AVBlack resident.txt
'C:\32788r22fwjfw\grep.3xe' -Fivf AVWhite resident.txt
'C:\32788r22fwjfw\grep.3xe' -E "^(AV|SP): .*\*Enabled/"
'C:\32788r22fwjfw\pev.3xe' -k * -preg"\\((ntvdm|teatimer[^\\]*|ad-watch[^\\]*|SZServer|StopZilla[^\\]*|userinit|procmon|txp1atform|SonndMan|ANDRE|TOLO|jalang|jalangkung|jantungan|DOSEN|C3W3K4MPUS)\.exe)$"
'C:\32788r22fwjfw\grep.3xe' -Fx "REGEDIT4" Fin.dat
'C:\32788r22fwjfw\grep.3xe' -ix "FileName=[-[:alnum:]@_.]*" FileName
'C:\32788r22fwjfw\grep.3xe' -ivx ComboFix DirName00
'C:\32788r22fwjfw\nircmd.3xe' CMDWAIT 9000 EXEC HIDE PEV -k CSCRIPT.3XE
'C:\32788r22fwjfw\swxcacls.3xe' C:\$RECYCLE.bin\* /GA:F /S /Q
'C:\32788r22fwjfw\sed.3xe' -r "/.*\\CF@C([1-9][0-9])M([1-9])\.....$/I!d; s//\1\t\2/" MSName00
'C:\32788r22fwjfw\cscript.3xe' //NOLOGO //E:VBSCRIPT //B //T:08 av.vbs
'C:\32788r22fwjfw\grep.3xe' -Ei "\\uninstall\.....$" MSName00
'C:\32788r22fwjfw\pev.3xe' -tx50000 -tf -files:files.pif -c:##5#b#f# -output:mdCheck00.dat
'C:\32788r22fwjfw\grep.3xe' -vs "^!" mdCheck00.dat
'C:\32788r22fwjfw\grep.3xe' -Fvf md5sum.pif mdCheck0a.dat
'C:\32788r22fwjfw\swreg.3xe' QUERY "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve
'C:\32788r22fwjfw\swreg.3xe' ADD "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve /d "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe"
'C:\32788r22fwjfw\grep.3xe' -Ei "\\(wscntfy|winlogon|wininit|nvsvc|lsm|lsass|iexplore|svchost|spoolsv|smss|slsvc|services|explorer|ctfmon|csrss|alg)\.....$" MSName00
'C:\32788r22fwjfw\swreg.3xe' QUERY "hklm\software\microsoft\windows nt\currentversion\winlogon" /v Userinit
'C:\32788r22fwjfw\grep.3xe' -Fisqx "ComboFix_19.11.4.1" DirName01
'C:\32788r22fwjfw\swreg.3xe' ADD "hklm\software\microsoft\windows nt\currentversion\winlogon" /v Userinit /d "<SYSTEM32>\userinit.exe,"
'C:\32788r22fwjfw\sed.3xe' -r "/./!d; /^\x22/!{s/\x22(\S+)\x22/\1/; s_\s+(/\S+)\s+_ \x22\1\x22 _g; s_\s+(/\S+)\s+_ \x22\1\x22 _g; s_\x22\s+(/\S*)$_\x22 \x22\1\x22_; s_^(/\S+)\s+_\x22\1\x22 _; }" temp00
'C:\combofix_19.11.4.1\swreg.3xe' QUERY "HKCU\Console_combofixbackup"
'C:\32788r22fwjfw\swxcacls.3xe' %WINDIR%\SysNative\ATTRIB.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
'C:\32788r22fwjfw\swxcacls.3xe' %WINDIR%\SysNative\CSCRIPT.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
'C:\32788r22fwjfw\swxcacls.3xe' %WINDIR%\SysNative\PING.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
'C:\32788r22fwjfw\grep.3xe' -Fi "<SYSTEM32>\userinit.exe" Userinit00
'C:\32788r22fwjfw\swxcacls.3xe' %WINDIR%\SysNative\ROUTE.exe /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
'C:\32788r22fwjfw\sed.3xe' -r "/SfxCmd=/I!d; s///; s/\s*$//; s/^(\x22[^\x22]*\x22|[^\x22]\S*) *//; s/(\x22[^\x22]*\x22)/\n\1\n/g" SET00
'C:\32788r22fwjfw\grep.3xe' -E "^[5-9]$|.."
'C:\32788r22fwjfw\sed.3xe' -r ":a; $!N;s/\n *\x22/ \x22/;ta; s/./@SET SfxCmd=&/; s/^(@SET SfxCmd=)([^\x22]\S*)$/\1\x22\2\x22/" temp01
'C:\combofix_19.11.4.1\sed.3xe' -R "1,3d; /[4-9]\S{7}\s*\d* .:\\|\\detoured.dll$/Id; /.*(.:\\.*)/I!d; s//\1/" ForeignC00
'C:\combofix_19.11.4.1\swreg.3xe' DELETE HKLM\Software\Swearware /V "CF_Update"
'C:\combofix_19.11.4.1\pev.3xe' -rtf -dg365 .\md5sum.pif
'C:\combofix_19.11.4.1\pv.3xe' -d2000 -xa PING.3XE
'C:\combofix_19.11.4.1\pv.3xe' -m PING.3XE
'C:\combofix_19.11.4.1\sed.3xe' -R "1,3d; /((10|4)00000|[4-9]\S{7})\s*\d* .:\\/d; /C:\\Windows\\SysWow64\$xpsp2res|Normaliz|urlmon|odbcint|imon)\.dll/Id; /$|\\/I!d; s/.*(.:\\)/\1/" pingtest00
'C:\combofix_19.11.4.1\grep.3xe' -Fixf ForeignWht pingtest01
'C:\combofix_19.11.4.1\hidec.3xe' PING -n 1 -w 250 127.0.0.1
'C:\combofix_19.11.4.1\ping.3xe' -n 2 -w 500 google.com
'C:\combofix_19.11.4.1\swreg.3xe' QUERY "HKLM\SOFTWARE\swearware\Backup\Winsock2"
'C:\combofix_19.11.4.1\swreg.3xe' ACL "HKLM\SOFTWARE\swearware" /RESET
'C:\combofix_19.11.4.1\swreg.3xe' COPY "HKLM\SYSTEM\CurrentControlSet\Services\WinSock2" "HKLM\SOFTWARE\swearware\Backup\Winsock2" /s
'C:\combofix_19.11.4.1\combofix-download.3xe' -s --connect-timeout 5 -A "cfcurl/7.15.3 (i586-pc-mingw32msvc) libcurl/7.15.3 zlib/1.2.2" -H "Host: download.bleepingcomputer.com" http://20#.#3.120.24/sUBs/version.txt
'C:\combofix_19.11.4.1\grep.3xe' "^[0-9][0-9].* [0-9]"
'C:\combofix_19.11.4.1\combofix-download.3xe' -s --connect-timeout 5 -A "cfcurl/7.15.3 (i586-pc-mingw32msvc) libcurl/7.15.3 zlib/1.2.2" -H "Host: www.co####diate.net" http://69.#.236.82/sUBs/ComboFix.exe/version.txt
'C:\combofix_19.11.4.1\pev.3xe' -k PING.3XE
'C:\combofix_19.11.4.1\swreg.3xe' QUERY HKLM\Software\Swearware /V "CF_Update"
'C:\32788r22fwjfw\pev.3xe' -rtf -s=0 "%WINDIR%\erdnt\Hiv-backup\*"
'C:\combofix_19.11.4.1\swreg.3xe' QUERY HKLM\Software\Swearware /v 44617465204572726F72
'C:\32788r22fwjfw\swreg.3xe' ADD "HKLM\Software\Swearware" /V LastDir /D "C:\ComboFix_19.11.4.1"
'C:\combofix_19.11.4.1\swxcacls.3xe' PV.3XE /P /GE:F /Q
'C:\32788r22fwjfw\pev.3xe' -k SWSC.3XE
'C:\32788r22fwjfw\pev.3xe' UZIP "License\streamtools.zip" License
'C:\32788r22fwjfw\hidec.3xe' "C:\ComboFix_19.11.4.1\CF13968.3XE" /F:OFF /D /C C:\Start_.cmd
'C:\32788r22fwjfw\pev.3xe' WAIT 2000
'C:\combofix_19.11.4.1\cf13968.3xe' /F:OFF /D /C C:\Start_.cmd
'C:\combofix_19.11.4.1\cf13968.3xe' /k c.bat
'C:\32788r22fwjfw\grep.3xe' -Eisq "=.\/uninstall| .\/uninstall. | .\/uninstall.$" sfx.cmd
'C:\combofix_19.11.4.1\pev.3xe' RIMPORT EXE.reg
'C:\combofix_19.11.4.1\sed.3xe' -r "/.* /!d; s//00/; s/^[0-9]*(...) .*/@SET ControlSet=ControlSet\1\nSET CS000=HKEY_LOCAL_MACHINE\\system\\ControlSet\1\\Services/"
'C:\combofix_19.11.4.1\attrib.3xe' +S "C:\ComboFix_19.11.4.1"
'C:\combofix_19.11.4.1\grep.3xe' -sqx "REGEDIT4" Fin.dat
'C:\combofix_19.11.4.1\attrib.3xe' +R *.3XE
'C:\combofix_19.11.4.1\nircmdc.3xe' EXEC SHOW "C:\ComboFix_19.11.4.1\CF13968.3XE" /C " ECHO.&&ECHO.-------- ~%CurrDate.yyyy-MM-dd% - ~%CurrTime.HH:mm:ss% -------------&&ECHO."
'C:\combofix_19.11.4.1\swreg.3xe' ADD "HKLM\Software\Swearware" /v 44617465204572726F72 /d "idk"
'C:\combofix_19.11.4.1\grep.3xe' -Fixvf ForeignWht ForeignC01
'C:\combofix_19.11.4.1\swreg.3xe' QUERY "hklm\system\select" /v "current"
'C:\combofix_19.11.4.1\cf13968.3xe' /C " ECHO.&&ECHO.-------- 2021-07-01 - 18:30:22 -------------&&ECHO."
'C:\32788r22fwjfw\grep.3xe' -sq . mdCheck01.dat
'C:\combofix_19.11.4.1\grep.3xe' -isq "09$" NlsLanguageDefault
'C:\32788r22fwjfw\handle64.exe' -p System
'C:\32788r22fwjfw\grep.3xe' -Fic "%WINDIR%\SysWow64\drivers\volsnap.sys" temp00
'C:\32788r22fwjfw\pev.3xe' -tx40000 -t!g -rtf -tpmz -c##y#b#z# \Services.exe
'C:\32788r22fwjfw\sed.3xe' -r "/(0x0.*)\t\1/d"
'C:\32788r22fwjfw\grep.3xe' .
'C:\32788r22fwjfw\pev.3xe' -tf -tpmz -t!o %WINDIR%\Installer\*000*.? -preg"C:\\Windows\\Installer\\\{[^\\]*\}\\U\\[^\\]*\..$"
'C:\32788r22fwjfw\license\iexplore.exe' -rk { "%ProgramFiles(x86)%\*" OR "%CommonProgramFiles(x86)%\*" } not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }
'C:\combofix_19.11.4.1\pv.3xe' -m CF13968.3XE
'C:\32788r22fwjfw\setpath.3xe'
'C:\32788r22fwjfw\hidec.3xe' %WINDIR%\Sysnative\cmd.exe /c REGEDIT.EXE /S C:\32788R22FWJFW\W7Reg.dat
'C:\32788r22fwjfw\cmd.3xe' /C C:\32788R22FWJFW\p.cmd
'C:\32788r22fwjfw\swreg.3xe' QUERY "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_{79007602-0CDB-4405-9DBF-1257BB3226ED}\0000\Control" /v ActiveService
'C:\32788r22fwjfw\rmbr.3xe' -u
'C:\32788r22fwjfw\grep.3xe' -Eix "HKEY_.*\\root\\\*PNP[^\\]*" PNP296_00
'C:\32788r22fwjfw\nircmd.3xe' WIN CLOSE CLASS "#32770"
'C:\32788r22fwjfw\grep.3xe' -sq . ZAFldr00.dat
'C:\32788r22fwjfw\grep.3xe' -Fsq "STATE : 4 RUNNING"
'C:\combofix_19.11.4.1\grep.3xe' -Eisq "=.\/uninstall.| .\/uninstall. | .\/uninstall.$" sfx.cmd
'C:\32788r22fwjfw\swreg.3xe' QUERY "HKLM\System\Currentcontrolset\Control\ProductOptions" /v ProductType
'C:\32788r22fwjfw\grep.3xe' -isq "ProductType.*WinNT" WinNT00
'C:\32788r22fwjfw\swreg.3xe' ACL "HKLM\SOFTWARE\Microsoft\Command Processor" /RESET /Q
'C:\32788r22fwjfw\erunt.3xe' "%WINDIR%\erdnt\Hiv-backup" SYSREG CURUSER OTHERUSERS /NOCONFIRMDELETE
'C:\32788r22fwjfw\pev.3xe' RIMPORT C:\32788R22FWJFW\EXE.reg
'C:\32788r22fwjfw\en-us\iexplore.exe' /w C:\32788R22FWJFW\PEV.3XE RIMPORT C:\32788R22FWJFW\EXE.reg
'C:\32788r22fwjfw\iexplore.exe' Script C:\32788R22FWJFW\Nirscript.dat
'C:\32788r22fwjfw\license\iexplore.exe' -s450000-1400000 -t!k -t!o -t!g -k C:\*.exe and not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }
'C:\32788r22fwjfw\license\iexplore.exe' -k { "%ALLUSERSPROFILE%\*" or "%HOMEPATH%\*" } not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }
'C:\32788r22fwjfw\hidec.3xe' C:\32788R22FWJFW\cmd.3XE /C C:\32788R22FWJFW\p.cmd
'C:\32788r22fwjfw\swreg.3xe' ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /RESET /Q
'C:\32788r22fwjfw\license\iexplore.exe' -loadline:C:\32788R22FWJFW\License\UnxUtilsDist.pif and not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }
'C:\32788r22fwjfw\license\iexplore.exe' -loadline:C:\32788R22FWJFW\License\UnxUtilsDist.com and not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }
'C:\32788r22fwjfw\swxcacls.3xe' "<SYSTEM32>\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
'C:\32788r22fwjfw\gsar.3xe' -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" cmd.3XE
'C:\32788r22fwjfw\swreg.3xe' ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /DA:R /Q
'C:\32788r22fwjfw\swreg.3xe' ACL "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /RESET /Q
'C:\32788r22fwjfw\swsc.3xe' QUERY BFE
'C:\32788r22fwjfw\license\iexplore.exe' -k "%TEMP%\*" not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }
'C:\32788r22fwjfw\pev.3xe' -c##g# "<SYSTEM32>\kernel32.dll"
'C:\32788r22fwjfw\handle.3xe' -p System
'C:\32788r22fwjfw\grep.3xe' -isq "processorArchitecture=.amd64." "%WINDIR%\SysNative\csrss.exe"
'C:\32788r22fwjfw\hidec.3xe' SWSC START CryptSvc
'C:\32788r22fwjfw\swreg.3xe' QUERY "HKCU\Console_combofixbackup"
'C:\32788r22fwjfw\swreg.3xe' COPY "HKCU\Console" "HKCU\Console_combofixbackup" /s
'C:\32788r22fwjfw\pev.3xe' -rtd %WINDIR%\Sysnative
'C:\32788r22fwjfw\swreg.3xe' ADD "HKCU\Console" /V "InsertMode" /T REG_DWORD /D 1
'C:\32788r22fwjfw\swreg.3xe' QUERY "HKLM\SYSTEM\CurrentControlSet\Enum\Root"
'C:\32788r22fwjfw\pev.3xe' UZIP License\pv_5_2_2.zip .\
'C:\32788r22fwjfw\swreg.3xe' ADD HKCU\Console /V CodePage /T REG_DWORD /D "1252"
'C:\32788r22fwjfw\swreg.3xe' ADD HKU\S-1-5-18\Console /V CodePage /T REG_DWORD /D "1252"
'C:\32788r22fwjfw\swreg.3xe' QUERY HKLM\System\CurrentControlSet\Control\NLS\Language /V Default
'C:\32788r22fwjfw\sed.3xe' "/.* /!d; s///" NlsLanguage00
'C:\32788r22fwjfw\grep.3xe' -isq "09$" NlsLanguageDefault
'C:\32788r22fwjfw\swreg.3xe' QUERY hklm\system\currentcontrolset\enum\root\system
'C:\32788r22fwjfw\swsc.3xe' DELETE MBR
'C:\32788r22fwjfw\swreg.3xe' QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Nls\CodePage" /V ACP
'C:\32788r22fwjfw\sed.3xe' -r "/.* (.:\\[^\\]*)$/!d; s//\1/"
'C:\32788r22fwjfw\swreg.3xe' QUERY "HKLM\Software\Swearware" /V LastDir
'C:\32788r22fwjfw\swreg.3xe' ADD "HKCU\Console" /v "QuickEdit" /T REG_DWORD /D 0
'C:\32788r22fwjfw\pev.3xe' -limit1 -rtf -sasize "C:\32788R22FWJFW\en-US\*.3XE.mui"
'C:\32788r22fwjfw\nircmd.3xe' CMDWAIT 6000 EXEC HIDE PEV -k CSCRIPT.exe
'%WINDIR%\syswow64\cscript.exe' //NOLOGO //E:VBSCRIPT //B //T:05 "C:\32788R22FWJFW\ksvchost.vbs"
'C:\32788r22fwjfw\pev.3xe' -k NIRCMD.3XE
'C:\32788r22fwjfw\sed.3xe' "/.* /!d; s//@CHCP.com /" NlsCodePageACP00
'C:\32788r22fwjfw\swreg.3xe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys /D Driver
'C:\32788r22fwjfw\swreg.3xe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys /D Driver
'C:\32788r22fwjfw\grep.3xe' -Fsqix en-US MUI
'C:\32788r22fwjfw\swreg.3xe' ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RESET /Q
'C:\32788r22fwjfw\swreg.3xe' DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option
'C:\32788r22fwjfw\sed.3xe' -r "/.* /!d; s///; s/(\\0)*$//; s/\\0/\n/g" MUI00
'C:\32788r22fwjfw\swreg.3xe' QUERY "HKCU\Control Panel\International" /v LocaleName
'C:\32788r22fwjfw\swreg.3xe' QUERY "HKCU\Control Panel\Desktop\MuiCached" /v "MachinePreferredUILanguages"
'C:\32788r22fwjfw\swreg.3xe' ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /V "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" /T REG_DWORD /D 1
'C:\32788r22fwjfw\swreg.3xe' ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RO:F /RA:F /Q
'C:\32788r22fwjfw\sed.3xe' -r -n "G; s/\n/&&/; /^([ -~]*\n).*\n\1/d; s/\n//; h; P"
'C:\32788r22fwjfw\pev.3xe' -outputtemp00 -rtf -c:##5# .\* and { License.exe or 32788R22FWJFW.exe or WinNT.exe or N_.exe }
'C:\combofix_19.11.4.1\nircmdb.exe' QBOXCOMTOP "Current date is ~%CurrDate.yyyy-MM-dd%. ComboFix has expired~n~nClick 'Yes' to run in REDUCED FUNCTIONALITY mode~n~nClick 'No' to exit" "Version_19-11-04.01" "" FILLDELETE ABORTB
'C:\combofix_19.11.4.1\cf13968.3xe' /F:OFF /D /C C:\Start_.cmd' (со скрытым окном)
'%WINDIR%\syswow64\ping.exe' -n 1 -w 250 127.0.0.1' (со скрытым окном)
'C:\32788r22fwjfw\license\iexplore.exe' -loadline:C:\32788R22FWJFW\License\UnxUtilsDist.pif and not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }' (со скрытым окном)
'C:\32788r22fwjfw\license\iexplore.exe' -s450000-1400000 -t!k -t!o -t!g -k C:\*.exe and not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }' (со скрытым окном)
'C:\32788r22fwjfw\pev.3xe' RIMPORT C:\32788R22FWJFW\EXE.reg' (со скрытым окном)
'C:\32788r22fwjfw\license\iexplore.exe' -loadline:C:\32788R22FWJFW\License\UnxUtilsDist.com and not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }' (со скрытым окном)
'C:\32788r22fwjfw\license\iexplore.exe' -k "%TEMP%\*" not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /C %WINDIR%\SysNative\cmd.exe /c C:\32788R22FWJFW\fl0.bat' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c REGEDIT.EXE /S C:\32788R22FWJFW\W7Reg.dat' (со скрытым окном)
'C:\32788r22fwjfw\license\iexplore.exe' -k { "%ALLUSERSPROFILE%\*" or "%HOMEPATH%\*" } not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }' (со скрытым окном)
'C:\32788r22fwjfw\cmd.3xe' /C C:\32788R22FWJFW\p.cmd' (со скрытым окном)
'C:\32788r22fwjfw\license\iexplore.exe' -rk { "%ProgramFiles(x86)%\*" OR "%CommonProgramFiles(x86)%\*" } not { "%TEMP%\7ZipSfx.000\ComboFix_19.11.4.1.exe" or C:\32788R22FWJFW\* }' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /C %WINDIR%\SysNative\cmd.exe /c C:\32788R22FWJFW\fl0.bat
'<SYSTEM32>\cmd.exe' /c C:\32788R22FWJFW\fl0.bat
'<SYSTEM32>\cmd.exe' /c REGEDIT.EXE /S C:\32788R22FWJFW\W7Reg.dat
'%WINDIR%\regedit.exe' /S C:\32788R22FWJFW\W7Reg.dat
'%WINDIR%\syswow64\findstr.exe' -B "6.1.760" CurVer
'%WINDIR%\syswow64\chcp.com' 1252
'<SYSTEM32>\attrib.exe' -H -S "C:\32788R22FWJFW\*"
'<SYSTEM32>\chcp.com' 1252
'%WINDIR%\syswow64\ping.exe' -n 1 -w 250 127.0.0.1
'<SYSTEM32>\sort.exe' /M 65536 Mirrors00 /O Mirrors

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней