Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BLUE' = '"%LOCALAPPDATA%\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe" '
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKCU\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
- [HKLM\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
- [HKLM\Software\Classes\mimicfile\shell\open\command] '' = 'notepad.exe "%LOCALAPPDATA%\IMPORTANT_NOTICE.txt"'
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Системный антивирус (Защитник Windows)
блокирует:
- Компонент восстановления системы (SR)
- Средство контроля пользовательских учетных записей (UAC)
изменяет следующие системные настройки:
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\7zipsfx.000\7za.exe
- %TEMP%\7zsfx000.cmd
- %HOMEPATH%\ntuser.pol
- %ALLUSERSPROFILE%\ntuser.pol
- <SYSTEM32>\grouppolicy\gpt.ini
- <SYSTEM32>\grouppolicy\machine\registry.pol
- %TEMP%\qeurjoj
- %TEMP%\autf085.tmp
- C:\important_notice.txt
- C:\temp\session.tmp
- %LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\session.tmp
- %LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\xdel.exe
- %LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\blue.exe
- %LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\everything64.dll
- %LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\everything32.dll
- %LOCALAPPDATA%\important_notice.txt
- %LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\everything2.ini
- %LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\everything.exe
- %LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\encrypt.exe
- %LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\dc.exe
- %LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\7za.exe
- C:\temp\mimic_log.txt
- %TEMP%\7zipsfx.000\xdel.exe
- %TEMP%\7zipsfx.000\teq.exe
- %TEMP%\7zipsfx.000\encrypt.exe
- %TEMP%\7zipsfx.000\dc.exe
- %TEMP%\7zipsfx.000\everything2.ini
- %TEMP%\7zipsfx.000\everything.ini
- %TEMP%\7zipsfx.000\everything64.dll
- %TEMP%\7zipsfx.000\everything32.dll
- %TEMP%\7zipsfx.000\everything.exe
- %LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\everything.ini
- C:\temp\hashlist.txt
Присваивает атрибут 'скрытый' для следующих файлов
- %ALLUSERSPROFILE%\tempntuser.pol
Удаляет следующие файлы
- %TEMP%\7zipsfx.000\7za.exe
- %TEMP%\7zipsfx.000\dc.exe
- %TEMP%\7zipsfx.000\encrypt.exe
- %TEMP%\7zipsfx.000\everything.exe
- %TEMP%\7zipsfx.000\teq.exe
- %TEMP%\7zipsfx.000\xdel.exe
- %TEMP%\7zipsfx.000\everything.ini
- %TEMP%\7zipsfx.000\everything2.ini
- %TEMP%\autf085.tmp
- %TEMP%\qeurjoj
- %ALLUSERSPROFILE%\tempntuser.pol
- %TEMP%\7zipsfx.000\everything32.dll
- %TEMP%\7zipsfx.000\everything64.dll
- %TEMP%\7zsfx000.cmd
Перемещает следующие файлы
- %ALLUSERSPROFILE%\ntuser.pol в %ALLUSERSPROFILE%\tempntuser.pol
- %ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx в %ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx в %ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx в %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\1033\outlook.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\outlook.dev.hxs.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx в %ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\fiverules.potx в %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx в %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\1033\winword.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\winword.dev.hxs.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\1033\powerpnt.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\powerpnt.dev.hxs.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\advtel.dic в %ProgramFiles%\microsoft office\office14\advtel.dic.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\1033\outlook.hxs в %ProgramFiles%\microsoft office\office14\1033\outlook.hxs.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\1033\excel.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\excel.dev.hxs.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\1033\msaccess.hxs в %ProgramFiles%\microsoft office\office14\1033\msaccess.hxs.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one в %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\pubwiz\invite.dpv в %ProgramFiles%\microsoft office\office14\pubwiz\invite.dpv.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv в %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\proof\msgr3en.lex в %ProgramFiles%\microsoft office\office14\proof\msgr3en.lex.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx в %ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\1033\mspub.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\mspub.dev.hxs.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx в %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex в %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex.datenklause0@gmail.com.blue
- %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa в %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.datenklause0@gmail.com.blue
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.datenklause0@gmail.com.blue
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite в %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.datenklause0@gmail.com.blue
- %ProgramFiles%\mozilla thunderbird\omni.ja в %ProgramFiles%\mozilla thunderbird\omni.ja.datenklause0@gmail.com.blue
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\ppklite.api.datenklause0@gmail.com.blue
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\annots.api.datenklause0@gmail.com.blue
- %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\proof\msth7es.lex в %ProgramFiles%\microsoft office\office14\proof\msth7es.lex.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\proof\msth7en.lex в %ProgramFiles%\microsoft office\office14\proof\msth7en.lex.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\1033\excel.hxs в %ProgramFiles%\microsoft office\office14\1033\excel.hxs.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\accwiz\acwzusr12.accdu в %ProgramFiles%\microsoft office\office14\accwiz\acwzusr12.accdu.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde в %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde в %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\accwiz\acwzdat12.accdu в %ProgramFiles%\microsoft office\office14\accwiz\acwzdat12.accdu.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\installed_resources14.xss в %ProgramFiles%\microsoft office\office14\installed_resources14.xss.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\mset7ge.kic в %ProgramFiles%\microsoft office\office14\mset7ge.kic.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\1033\winword.hxs в %ProgramFiles%\microsoft office\office14\1033\winword.hxs.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\1033\powerpnt.hxs в %ProgramFiles%\microsoft office\office14\1033\powerpnt.hxs.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx в %ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\proof\msgr3es.lex в %ProgramFiles%\microsoft office\office14\proof\msgr3es.lex.datenklause0@gmail.com.blue
Изменяет следующие файлы
- %ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\pubwiz\invite.dpv.datenklause0@gmail.com.blue
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\boot.sdi.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\onenote\14\stationery\designer.one.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.datenklause0@gmail.com.blue
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winre.wim.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\urbanphotoalbum.potx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\adjacencyreport.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\document parts\1033\14\built-in building blocks.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\blacktiemergeletter.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\blacktieletter.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\templates\1033\blacktieresume.dotx.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\installed_resources14.xss.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\mset7ge.kic.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\accwiz\acwzdat12.accdu.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\accwiz\acwzusr12.accdu.datenklause0@gmail.com.blue
- C:\users\public\recorded tv\sample media\win7_scenic-demoshort_raw.wtv.datenklause0@gmail.com.blue
- %ProgramFiles%\mozilla thunderbird\omni.ja.datenklause0@gmail.com.blue
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\places.sqlite.datenklause0@gmail.com.blue
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\favicons.sqlite.datenklause0@gmail.com.blue
- %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.datenklause0@gmail.com.blue
- %LOCALAPPDATA%\thunderbird\profiles\chdgbv82.default-release\startupcache\startupcache.8.little.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\proof\msgr3en.lex.datenklause0@gmail.com.blue
- %ProgramFiles%\microsoft office\office14\advtel.dic.datenklause0@gmail.com.blue
Подменяет следующие файлы
- %ALLUSERSPROFILE%\ntuser.pol
Самоудаляется.
Другое
Ищет следующие окна
- ClassName: 'EVERYTHING_TASKBAR_NOTIFICATION' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\7zipsfx.000\7za.exe' i
- '%LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\everything.exe' -startup
- '%LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\dc.exe' /D
- '%LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\blue.exe' -e ul2
- '%LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\blue.exe' -e watch -pid 2832 -!
- '%LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\blue.exe'
- '%LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\blue.exe' -e ul1
- '%TEMP%\7zipsfx.000\7za.exe' x -y -p1794523514629813379 Everything64.dll
- '%TEMP%\7zipsfx.000\teq.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c' (со скрытым окном)
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (со скрытым окном)
- '<SYSTEM32>\bcdedit.exe' /set {default} recoveryenabled no' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61' (со скрытым окном)
- '%TEMP%\7zipsfx.000\7za.exe' x -y -p1794523514629813379 Everything64.dll' (со скрытым окном)
- '%LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\blue.exe' -e ul1' (со скрытым окном)
- '%TEMP%\7zipsfx.000\7za.exe' i' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (со скрытым окном)
- '%LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\blue.exe' ' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c DC.exe /D' (со скрытым окном)
- '%LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\blue.exe' -e watch -pid 2832 -!' (со скрытым окном)
- '%TEMP%\7zipsfx.000\teq.exe' ' (со скрытым окном)
- '%LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\blue.exe' -e ul2' (со скрытым окном)
- '%LOCALAPPDATA%\{1c8fbf78-cea9-289f-d10f-bcad2cfee8bf}\everything.exe' -startup' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -H off' (со скрытым окном)
- '<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (со скрытым окном)
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (со скрытым окном)
- '<SYSTEM32>\wbadmin.exe' delete catalog -quiet' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c DC.exe /D
- '<SYSTEM32>\wbadmin.exe' delete catalog -quiet
- '<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"
- '<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61
- '<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
- '<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
- '<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
- '<SYSTEM32>\powercfg.exe' -H off
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
- '<SYSTEM32>\svchost.exe' -k secsvcs
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '<SYSTEM32>\wbengine.exe'
- '<SYSTEM32>\vds.exe'
