Техническая информация
Изменения в файловой системе
Создает следующие файлы
- C:\users\public\just_build.exe
- C:\users\public\de2\system.numerics.vectors.dll
- C:\users\public\de2\system.net.websockets.dll
- C:\users\public\de2\system.net.websockets.client.dll
- C:\users\public\de2\system.net.webheadercollection.dll
- C:\users\public\de2\system.net.sockets.dll
- C:\users\public\de2\system.net.security.dll
- C:\users\public\de2\system.net.requests.dll
- C:\users\public\de2\system.net.primitives.dll
- C:\users\public\de2\system.net.ping.dll
- C:\users\public\de2\system.net.networkinformation.dll
- C:\users\public\de2\system.net.nameresolution.dll
- C:\users\public\de2\system.net.http.dll
- C:\users\public\de2\system.memory.xml
- C:\users\public\de2\system.memory.dll
- C:\users\public\de2\system.numerics.vectors.xml
- C:\users\public\de2\system.linq.queryable.dll
- C:\users\public\de2\system.linq.expressions.dll
- C:\users\public\de2\system.linq.dll
- C:\users\public\de2\system.io.unmanagedmemorystream.dll
- C:\users\public\de2\system.io.pipes.dll
- C:\users\public\de2\system.io.memorymappedfiles.dll
- C:\users\public\de2\system.io.isolatedstorage.dll
- C:\users\public\de2\system.io.filesystem.watcher.dll
- C:\users\public\de2\system.io.filesystem.primitives.dll
- C:\users\public\de2\system.io.filesystem.driveinfo.dll
- C:\users\public\de2\system.io.filesystem.dll
- C:\users\public\de2\system.io.dll
- C:\users\public\de2\system.io.compression.zipfile.dll
- C:\users\public\de2\system.io.compression.dll
- C:\users\public\de2\system.globalization.extensions.dll
- C:\users\public\de2\system.linq.parallel.dll
- C:\users\public\de2\system.runtime.serialization.json.dll
- C:\users\public\de2\deadeye2.exe
- C:\users\public\de2\system.reflection.extensions.dll
- C:\users\public\de2\system.text.regularexpressions.dll
- C:\users\public\de2\system.text.encodings.web.xml
- C:\users\public\de2\system.text.encodings.web.dll
- C:\users\public\de2\system.text.encoding.extensions.dll
- C:\users\public\de2\system.text.encoding.dll
- C:\users\public\de2\system.security.securestring.dll
- C:\users\public\de2\system.security.principal.dll
- C:\users\public\de2\system.security.cryptography.x509certificates.dll
- C:\users\public\de2\system.security.cryptography.primitives.dll
- C:\users\public\de2\system.security.cryptography.encoding.dll
- C:\users\public\de2\system.security.cryptography.csp.dll
- C:\users\public\de2\system.security.cryptography.algorithms.dll
- C:\users\public\de2\system.security.claims.dll
- C:\users\public\de2\system.runtime.serialization.xml.dll
- C:\users\public\de2\system.globalization.dll
- C:\users\public\de2\system.runtime.serialization.primitives.dll
- C:\users\public\de2\system.runtime.serialization.formatters.dll
- C:\users\public\de2\system.runtime.numerics.dll
- C:\users\public\de2\system.runtime.interopservices.runtimeinformation.dll
- C:\users\public\de2\system.runtime.interopservices.dll
- C:\users\public\de2\system.runtime.handles.dll
- C:\users\public\de2\system.runtime.extensions.dll
- C:\users\public\de2\system.runtime.dll
- C:\users\public\de2\system.runtime.compilerservices.visualc.dll
- C:\users\public\de2\system.runtime.compilerservices.unsafe.xml
- C:\users\public\de2\system.runtime.compilerservices.unsafe.dll
- C:\users\public\de2\system.resources.writer.dll
- C:\users\public\de2\system.resources.resourcemanager.dll
- C:\users\public\de2\system.resources.reader.dll
- C:\users\public\de2\system.reflection.primitives.dll
- C:\users\public\de2\system.objectmodel.dll
- C:\users\public\de2\system.reflection.dll
- C:\users\public\de2\system.globalization.calendars.dll
- C:\users\public\de2\microsoft.net.http.headers.dll
- C:\users\public\de2\microsoft.extensions.options.xml
- C:\users\public\de2\microsoft.extensions.options.dll
- C:\users\public\de2\microsoft.extensions.logging.xml
- C:\users\public\de2\microsoft.extensions.logging.dll
- C:\users\public\de2\microsoft.extensions.logging.abstractions.xml
- C:\users\public\de2\microsoft.extensions.logging.abstractions.dll
- C:\users\public\de2\microsoft.extensions.dependencyinjection.abstractions.xml
- C:\users\public\de2\microsoft.extensions.dependencyinjection.abstractions.dll
- C:\users\public\de2\microsoft.bcl.asyncinterfaces.xml
- C:\users\public\de2\microsoft.bcl.asyncinterfaces.dll
- C:\users\public\de2\microsoft.aspnetcore.webutilities.xml
- C:\users\public\de2\microsoft.aspnetcore.webutilities.dll
- C:\users\public\de2\deadeye2.pdb
- C:\users\public\de2\deadeye2.exe.config
- C:\users\public\de2\microsoft.extensions.primitives.dll
- C:\users\public\de2\system.xml.xpath.xdocument.dll
- C:\users\public\de2\system.xml.xmlserializer.dll
- C:\users\public\de2\system.xml.xmldocument.dll
- C:\users\public\de2\system.xml.xdocument.dll
- C:\users\public\de2\system.xml.readerwriter.dll
- C:\users\public\de2\system.valuetuple.dll
- C:\users\public\de2\system.threading.timer.dll
- C:\users\public\de2\system.threading.threadpool.dll
- C:\users\public\de2\system.threading.thread.dll
- C:\users\public\de2\system.threading.tasks.parallel.dll
- C:\users\public\de2\system.threading.tasks.extensions.xml
- C:\users\public\de2\system.threading.tasks.extensions.dll
- C:\users\public\de2\system.threading.tasks.dll
- C:\users\public\de2\system.threading.overlapped.dll
- C:\users\public\de2\system.threading.dll
- C:\users\public\de2\system.xml.xpath.dll
- C:\users\public\de2\system.collections.specialized.dll
- C:\users\public\de2\system.drawing.primitives.dll
- C:\users\public\de2\microsoft.net.http.headers.xml
- C:\users\public\de2\system.diagnostics.tracing.dll
- C:\users\public\de2\system.diagnostics.tracesource.dll
- C:\users\public\de2\system.diagnostics.tools.dll
- C:\users\public\de2\system.diagnostics.textwritertracelistener.dll
- C:\users\public\de2\system.diagnostics.stacktrace.dll
- C:\users\public\de2\system.diagnostics.process.dll
- C:\users\public\de2\system.diagnostics.fileversioninfo.dll
- C:\users\public\de2\system.diagnostics.debug.dll
- C:\users\public\de2\system.diagnostics.contracts.dll
- C:\users\public\de2\system.data.common.dll
- C:\users\public\de2\system.console.dll
- C:\users\public\de2\system.componentmodel.typeconverter.dll
- C:\users\public\de2\system.componentmodel.primitives.dll
- C:\users\public\de2\system.componentmodel.eventbasedasync.dll
- C:\users\public\de2\system.dynamic.runtime.dll
- C:\users\public\de2\system.componentmodel.dll
- C:\users\public\de2\system.collections.nongeneric.dll
- C:\users\public\de2\system.collections.dll
- C:\users\public\de2\system.collections.concurrent.dll
- C:\users\public\de2\system.buffers.xml
- C:\users\public\de2\system.buffers.dll
- C:\users\public\de2\system.appcontext.dll
- C:\users\public\de2\puppeteersharp.xml
- C:\users\public\de2\puppeteersharp.dom.xml
- C:\users\public\de2\puppeteersharp.dom.dll
- C:\users\public\de2\puppeteersharp.dll
- C:\users\public\de2\newtonsoft.json.xml
- C:\users\public\de2\newtonsoft.json.dll
- C:\users\public\de2\netstandard.dll
- C:\users\public\de2\microsoft.win32.primitives.dll
- C:\users\public\de2\microsoft.extensions.primitives.xml
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\deadeye2.exe.log
Изменяет следующие файлы
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\windows.edb
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\edb.jcp
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\edbtmp.jtx
- %ALLUSERSPROFILE%\microsoft\search\data\applications\windows\windows.jfm
Подменяет следующие файлы
- %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\edb.jtx
- %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\edbtmp.jtx
Сетевая активность
Подключается к
- '14#.#0.161.49':80
TCP
Запросы HTTP GET
- http://14#.#0.161.49/index.php?qr###################
Другое
Ищет следующие окна
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- 'C:\users\public\just_build.exe'
- 'C:\users\public\de2\deadeye2.exe'
- 'C:\users\public\just_build.exe' ' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\explorer.exe' C:\Users\Public\just_build.exe
- '<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
- '<SYSTEM32>\searchfilterhost.exe' 0 768 772 780 8192 776
