Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'AdobeIPCBroker' = '%LOCALAPPDATA%\AdobeIPCBroker.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AdobeIPCBroker' = '%LOCALAPPDATA%\AdobeIPCBroker.exe'
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\adobeipcbroker.exe
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует:
- Компонент восстановления системы (SR)
удаляет теневые копии разделов.
Запускает на исполнение
- '<SYSTEM32>\netsh.exe' firewall set opmode mode=disable
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\vds.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\pb2015a9ec\pbdlg.dat
- %APPDATA%\greatsim\milling\msvcp140.dll
- %APPDATA%\greatsim\milling\msvcp100.dll
- %APPDATA%\greatsim\milling\mfc100u.dll
- %APPDATA%\greatsim\milling\machining.exe
- %APPDATA%\greatsim\milling\libcui40.dll
- %APPDATA%\greatsim\milling\engine.dll
- %APPDATA%\greatsim\milling\drmd.dll
- %APPDATA%\greatsim\milling\d3dx9_43.dll
- %APPDATA%\greatsim\milling\d3dcompiler_43.dll
- %APPDATA%\greatsim\milling\crclient.dll
- %APPDATA%\greatsim\milling\msvcp140_1.dll
- %APPDATA%\greatsim\milling\controllor.dll
- %APPDATA%\greatsim\milling\boost_system-vc100-mt-1_59.dll
- %APPDATA%\greatsim\milling\api-ms-win-eventing-provider-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-downlevel-kernel32-l2-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-downlevel-kernel32-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-utility-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-time-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-string-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-stdio-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-runtime-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-process-l1-1-0.dll
- %APPDATA%\greatsim\milling\codeparsingdll.dll
- %LOCALAPPDATA%\adobeipcbroker.exe
- C:\far2\addons\colors\custom_highlighting\farcolors242.reg.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
- %APPDATA%\greatsim\milling\msvcp140_codecvt_ids.dll
- C:\far2\addons\colors\custom_highlighting\dn_like.reg.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
- C:\far2\addons\colors\custom_highlighting\descript.ion.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
- C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
- C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
- C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
- %APPDATA%\greatsim\milling\api-ms-win-crt-private-l1-1-0.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\adobeipcbroker.exe
- %APPDATA%\greatsim\milling\xdf.dll
- %APPDATA%\greatsim\milling\vcruntime140.dll
- %APPDATA%\greatsim\milling\vccorlib140.dll
- %APPDATA%\greatsim\milling\uninst.exe
- %APPDATA%\greatsim\milling\ucrtbase.dll
- %APPDATA%\greatsim\milling\triangulation.dll
- %APPDATA%\greatsim\milling\tracegen.exe
- %APPDATA%\greatsim\milling\tmevent.dll
- %APPDATA%\greatsim\milling\options.dll
- %APPDATA%\greatsim\milling\msvcr100.dll
- %APPDATA%\greatsim\milling\msvcp140_2.dll
- %APPDATA%\greatsim\milling\msvcp140_atomic_wait.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-multibyte-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-interlocked-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-file-l2-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-file-l1-2-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-file-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-errorhandling-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-debug-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-datetime-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-console-l1-2-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-console-l1-1-0.dll
- %APPDATA%\greatsim\milling\adobeipcbrokercustomhook.exe
- %APPDATA%\greatsim\milling\adobeipcbroker.exe
- %APPDATA%\greatsim\milling\api-ms-win-core-handle-l1-1-0.dll
- %APPDATA%\greatsim\milling\usermanual_en.html
- %APPDATA%\greatsim\milling\tool_mill.ini
- %APPDATA%\greatsim\milling\toollist.ini
- %APPDATA%\greatsim\milling\startupoptions.xml
- %APPDATA%\greatsim\milling\ipcbox.pimx
- %APPDATA%\greatsim\milling\ground
- %APPDATA%\greatsim\milling\cr_win_client_config.cfg
- %APPDATA%\greatsim\milling\config.ini
- %TEMP%\pb2015a9ec\pbcore.dll
- %TEMP%\pb2015a9ec\pb3dll.dll
- %TEMP%\pb2015a9ec\pblng.dat
- %APPDATA%\greatsim\milling\usermanual_ch.html
- %APPDATA%\greatsim\milling\api-ms-win-core-synch-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-locale-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-kernel32-legacy-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-heap-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-filesystem-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-environment-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-convert-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-conio-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-xstate-l2-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-util-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-timezone-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-sysinfo-l1-2-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-sysinfo-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-crt-math-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-synch-l1-2-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-string-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-rtlsupport-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-profile-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-processthreads-l1-1-1.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-processthreads-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-processenvironment-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-namedpipe-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-memory-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-localization-l1-2-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-libraryloader-l1-1-0.dll
- %APPDATA%\greatsim\milling\api-ms-win-core-heap-l1-1-0.dll
- D:\install.log.id[ede7e17d-2686].[martin1993douglas@pressmail.ch].devos
Удаляет следующие файлы
- %TEMP%\pb2015a9ec\pblng.dat
- %TEMP%\pb2015a9ec\pb3dll.dll
- %TEMP%\pb2015a9ec\pbcore.dll
- %TEMP%\pb2015a9ec\pbdlg.dat
Изменяет следующие файлы
- C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg
- C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg
- C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg
- C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg
- D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini
- C:\far2\addons\colors\custom_highlighting\descript.ion
- C:\far2\addons\colors\custom_highlighting\dn_like.reg
- C:\far2\addons\colors\custom_highlighting\farcolors242.reg
- D:\install.log
Другое
Создает и запускает на исполнение
- '%APPDATA%\greatsim\milling\adobeipcbroker.exe'
- '%APPDATA%\greatsim\milling\adobeipcbroker.exe' "-relaunchedForIntegrityLevel -launchedbyvulcan-2604 %APPDATA%\GreatSim\Milling\AdobeIPCBroker.exe"
- '<SYSTEM32>\cmd.exe' ' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\netsh.exe' advfirewall set currentprofile state off
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\wbadmin.exe' delete catalog -quiet
- '<SYSTEM32>\wbengine.exe'
- '<SYSTEM32>\vds.exe'
