Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\MyService] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\MyService] 'ImagePath' = '%WINDIR%\System\MyService\xrmjad.exe -m s'
- [HKLM\System\CurrentControlSet\Services\NPF] 'ImagePath' = 'system32\drivers\NPF.sys'
Создает следующие сервисы
- 'MyService' %WINDIR%\System\MyService\xrmjad.exe -m s
- 'NPF' system32\drivers\NPF.sys
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\system\myservice\.myservice.log
- %WINDIR%\temp\_mei28962\api-ms-win-core-profile-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-processthreads-l1-1-1.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-processthreads-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-processenvironment-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-namedpipe-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-memory-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-localization-l1-2-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-libraryloader-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-interlocked-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-heap-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-handle-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-file-l2-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-file-l1-2-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-file-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-errorhandling-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-rtlsupport-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-synch-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-utility-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-synch-l1-2-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-time-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-string-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-stdio-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-runtime-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-process-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-math-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-locale-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-heap-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-filesystem-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-environment-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-convert-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-crt-conio-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-util-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-timezone-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-sysinfo-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-debug-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-string-l1-1-0.dll
- %WINDIR%\temp\_mei28962\api-ms-win-core-datetime-l1-1-0.dll
- %WINDIR%\temp\_mei28962\cryptodome\math\_modexp.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_keccak.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_ghash_portable.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_ghash_clmul.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_sha512.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_sha384.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_sha256.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_sha224.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_sha1.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_ripemd160.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_md5.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_md4.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_md2.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_blake2s.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_blake2b.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_ofb.pyd
- %WINDIR%\temp\_mei28962\cryptodome\hash\_poly1305.pyd
- %WINDIR%\temp\_mei28962\cryptodome\protocol\_scrypt.pyd
- %WINDIR%\temp\_mei28962\_ssl.pyd
- %WINDIR%\temp\_mei28962\cryptodome\publickey\_ec_ws.pyd
- %WINDIR%\temp\_mei28962\_socket.pyd
- %WINDIR%\temp\_mei28962\_queue.pyd
- %WINDIR%\temp\_mei28962\_multiprocessing.pyd
- %WINDIR%\temp\_mei28962\_lzma.pyd
- %WINDIR%\temp\_mei28962\_hashlib.pyd
- %WINDIR%\temp\_mei28962\_decimal.pyd
- %WINDIR%\temp\_mei28962\_ctypes.pyd
- %WINDIR%\temp\_mei28962\_cffi_backend.cp37-win32.pyd
- %WINDIR%\temp\_mei28962\_bz2.pyd
- %WINDIR%\temp\_mei28962\vcruntime140.dll
- %WINDIR%\temp\_mei28962\cryptodome\util\_strxor.pyd
- %WINDIR%\temp\_mei28962\cryptodome\util\_cpuid_c.pyd
- %WINDIR%\temp\_mei28962\cryptodome\publickey\_x25519.pyd
- %WINDIR%\temp\_mei28962\cryptodome\publickey\_ed448.pyd
- %WINDIR%\temp\_mei28962\cryptodome\publickey\_ed25519.pyd
- %WINDIR%\temp\_mei28962\api-ms-win-core-console-l1-1-0.dll
- %WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\license
- %WINDIR%\temp\caba2c1.tmp
- %WINDIR%\temp\_mei28962\grpc\_cython\cygrpc.cp37-win32.pyd
- %WINDIR%\temp\tar48fa.tmp
- %WINDIR%\temp\cab48e8.tmp
- %WINDIR%\temp\cab48e9.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- global\npf_{a16b3811-6333-49f6-89f3-3db75d9d59b9}
- %WINDIR%\temp\udd3dab.tmp
- %WINDIR%\system\myservice\services.exe
- <DRIVERS>\npf.sys
- %WINDIR%\syswow64\packet.dll
- %WINDIR%\syswow64\wpcap.dll
- %WINDIR%\system\myservice\s.conf
- %WINDIR%\system\myservice\e.conf
- %WINDIR%\temp\tar1b31.tmp
- %WINDIR%\temp\tar1b71.tmp
- %WINDIR%\temp\tar48ea.tmp
- %WINDIR%\temp\tar4a25.tmp
- %WINDIR%\temp\_mei28962\google\protobuf\pyext\_message.cp37-win32.pyd
- %WINDIR%\temp\cab6054.tmp
- %WINDIR%\temp\tar8d2d.tmp
- %WINDIR%\temp\cab8d2c.tmp
- %WINDIR%\temp\tar8cfc.tmp
- %WINDIR%\temp\cab8cfb.tmp
- %WINDIR%\temp\tar7758.tmp
- %WINDIR%\temp\cab7757.tmp
- %WINDIR%\temp\tar7727.tmp
- %WINDIR%\temp\cab7726.tmp
- %WINDIR%\temp\tar6164.tmp
- %WINDIR%\temp\cab6163.tmp
- %WINDIR%\temp\tar6105.tmp
- %WINDIR%\temp\cab6104.tmp
- %WINDIR%\temp\tar60a5.tmp
- %WINDIR%\temp\cab60a4.tmp
- %WINDIR%\temp\tar6055.tmp
- %WINDIR%\temp\tar1ae1.tmp
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_ocb.pyd
- nul
- %WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\installer
- %WINDIR%\temp\_mei28962\base_library.zip
- %WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\zip-safe
- %WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\top_level.txt
- %WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\wheel
- %WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\record
- %WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\metadata
- %WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\license
- %WINDIR%\temp\_mei28962\altgraph-0.17.4.dist-info\installer
- %WINDIR%\temp\_mei28962\unicodedata.pyd
- %WINDIR%\temp\_mei28962\ucrtbase.dll
- %WINDIR%\temp\_mei28962\select.pyd
- %WINDIR%\temp\_mei28962\python37.dll
- %WINDIR%\temp\_mei28962\pyexpat.pyd
- %WINDIR%\temp\_mei28962\libssl-1_1.dll
- %WINDIR%\temp\_mei28962\libcrypto-1_1.dll
- %WINDIR%\temp\_mei28962\grpc\_cython\_credentials\roots.pem
- %WINDIR%\temp\_mei28962\google\protobuf\internal\_api_implementation.cp37-win32.pyd
- %WINDIR%\temp\cab1b30.tmp
- %WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\metadata
- %WINDIR%\temp\cab1ae0.tmp
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\2d85f72862b55c4eadd9e66e06947f3d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\2d85f72862b55c4eadd9e66e06947f3d
- %WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\top_level.txt
- %WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\entry_points.txt
- %WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\wheel
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\14232b434cf29d4c4fb335a86d7fffe3
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\14232b434cf29d4c4fb335a86d7fffe3
- %WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\record
- %WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\metadata
- %WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\installer
- %WINDIR%\temp\_mei28962\pyinstaller-4.10.dist-info\copying.txt
- %WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\top_level.txt
- %WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\wheel
- %WINDIR%\temp\_mei28962\importlib_metadata-6.7.0.dist-info\record
- %WINDIR%\temp\cab1b70.tmp
- %WINDIR%\temp\cab4a24.tmp
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_eksblowfish.pyd
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\metadata
- %WINDIR%\temp\_mei26842\cryptodome\util\_cpuid_c.pyd
- %WINDIR%\temp\_mei26842\cryptodome\publickey\_x25519.pyd
- %WINDIR%\temp\_mei26842\cryptodome\publickey\_ed448.pyd
- %WINDIR%\temp\_mei26842\cryptodome\publickey\_ed25519.pyd
- %WINDIR%\temp\_mei26842\cryptodome\publickey\_ec_ws.pyd
- %WINDIR%\temp\_mei26842\cryptodome\protocol\_scrypt.pyd
- %WINDIR%\temp\_mei26842\cryptodome\math\_modexp.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_poly1305.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_keccak.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_ghash_portable.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_ghash_clmul.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_sha512.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_sha384.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_sha256.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_sha224.pyd
- %WINDIR%\temp\_mei26842\cryptodome\util\_strxor.pyd
- %WINDIR%\temp\_mei26842\_bz2.pyd
- %WINDIR%\temp\_mei26842\api-ms-win-core-handle-l1-1-0.dll
- %WINDIR%\temp\_mei26842\_cffi_backend.cp37-win32.pyd
- %WINDIR%\temp\_mei26842\api-ms-win-core-file-l2-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-file-l1-2-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-file-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-errorhandling-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-debug-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-datetime-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-console-l1-1-0.dll
- %WINDIR%\temp\_mei26842\_ssl.pyd
- %WINDIR%\temp\_mei26842\_socket.pyd
- %WINDIR%\temp\_mei26842\_queue.pyd
- %WINDIR%\temp\_mei26842\_multiprocessing.pyd
- %WINDIR%\temp\_mei26842\_lzma.pyd
- %WINDIR%\temp\_mei26842\_hashlib.pyd
- %WINDIR%\temp\_mei26842\_decimal.pyd
- %WINDIR%\temp\_mei26842\_ctypes.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_sha1.pyd
- %WINDIR%\temp\_mei26842\vcruntime140.dll
- %WINDIR%\temp\_mei26842\cryptodome\hash\_ripemd160.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_pkcs1_decode.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_salsa20.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_arc4.pyd
- %WINDIR%\system\myservice\csrs_upgrade.exe
- %WINDIR%\system\myservice\csrs_upgrade.exe.s.remote
- %WINDIR%\system\myservice\csrs_upgrade.exe.remote
- %WINDIR%\system\myservice\.asst_bin.v
- %WINDIR%\system\myservice\.myservice.t.s.remote
- %WINDIR%\system\myservice\.myservice.t.remote
- %WINDIR%\system\myservice\.task_config.v
- %WINDIR%\system\myservice\.myservice.c.s.remote
- %WINDIR%\system\myservice\.myservice.c.remote
- %WINDIR%\system\myservice\.app_config.v
- %WINDIR%\system\myservice\.app_bin.v
- %WINDIR%\system\myservice\.myservice
- %WINDIR%\system\myservice\xrmjad.exe
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_chacha20.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_aes.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_md4.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_aesni.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_md2.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_blake2s.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_blake2b.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ofb.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ocb.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_eksblowfish.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ecb.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_des3.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_des.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ctr.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cfb.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cbc.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cast.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_blowfish.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_arc2.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_md5.pyd
- %WINDIR%\temp\_mei26842\api-ms-win-crt-filesystem-l1-1-0.dll
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_des3.pyd
- %WINDIR%\temp\_mei26842\api-ms-win-core-libraryloader-l1-1-0.dll
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\copying.txt
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\top_level.txt
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\wheel
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\record
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\metadata
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\license
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\installer
- %WINDIR%\temp\_mei26842\grpc\_cython\_credentials\roots.pem
- %WINDIR%\temp\_mei26842\base_library.zip
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\zip-safe
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\top_level.txt
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\wheel
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\record
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\metadata
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\license
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\installer
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\record
- %WINDIR%\temp\_mei26842\api-ms-win-core-interlocked-l1-1-0.dll
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\wheel
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_des.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_ctr.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_cfb.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_cbc.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_cast.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_blowfish.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_arc2.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_aesni.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_aes.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_pkcs1_decode.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_chacha20.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_salsa20.pyd
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_arc4.pyd
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\top_level.txt
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\entry_points.txt
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\installer
- %WINDIR%\temp\_mei28962\cryptodome\cipher\_raw_ecb.pyd
- %WINDIR%\temp\_mei26842\unicodedata.pyd
- %WINDIR%\temp\_mei26842\api-ms-win-crt-environment-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-conio-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-util-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-timezone-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-sysinfo-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-synch-l1-2-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-synch-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-string-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-rtlsupport-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-profile-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-processthreads-l1-1-1.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-processthreads-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-processenvironment-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-namedpipe-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-memory-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-localization-l1-2-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-convert-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-heap-l1-1-0.dll
- %WINDIR%\temp\_mei26842\select.pyd
- %WINDIR%\temp\_mei26842\api-ms-win-crt-heap-l1-1-0.dll
- %WINDIR%\temp\_mei26842\python37.dll
- %WINDIR%\temp\_mei26842\pyexpat.pyd
- %WINDIR%\temp\_mei26842\libssl-1_1.dll
- %WINDIR%\temp\_mei26842\libcrypto-1_1.dll
- %WINDIR%\temp\_mei26842\grpc\_cython\cygrpc.cp37-win32.pyd
- %WINDIR%\temp\_mei26842\google\protobuf\pyext\_message.cp37-win32.pyd
- %WINDIR%\temp\_mei26842\google\protobuf\internal\_api_implementation.cp37-win32.pyd
- %WINDIR%\temp\_mei26842\api-ms-win-crt-utility-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-time-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-string-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-stdio-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-runtime-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-process-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-math-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-locale-l1-1-0.dll
- %WINDIR%\temp\_mei26842\ucrtbase.dll
- %WINDIR%\temp\tara2c2.tmp
Удаляет следующие файлы
- %WINDIR%\system\myservice\.app_bin.v
- %WINDIR%\temp\_mei26842\libcrypto-1_1.dll
- %WINDIR%\temp\_mei26842\libssl-1_1.dll
- %WINDIR%\temp\_mei26842\pyexpat.pyd
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\copying.txt
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\entry_points.txt
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\installer
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\metadata
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\top_level.txt
- %WINDIR%\temp\_mei26842\_cffi_backend.cp37-win32.pyd
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\wheel
- %WINDIR%\temp\_mei26842\python37.dll
- %WINDIR%\temp\_mei26842\select.pyd
- %WINDIR%\temp\_mei26842\ucrtbase.dll
- %WINDIR%\temp\_mei26842\unicodedata.pyd
- %WINDIR%\temp\_mei26842\vcruntime140.dll
- %WINDIR%\temp\_mei26842\_bz2.pyd
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\wheel
- %WINDIR%\temp\_mei26842\pyinstaller-4.10.dist-info\record
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\top_level.txt
- %WINDIR%\temp\_mei26842\cryptodome\publickey\_x25519.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_sha384.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_sha512.pyd
- %WINDIR%\temp\_mei26842\cryptodome\math\_modexp.pyd
- %WINDIR%\temp\_mei26842\cryptodome\protocol\_scrypt.pyd
- %WINDIR%\temp\_mei26842\cryptodome\publickey\_ec_ws.pyd
- %WINDIR%\temp\_mei26842\cryptodome\publickey\_ed25519.pyd
- %WINDIR%\temp\_mei26842\cryptodome\publickey\_ed448.pyd
- %WINDIR%\temp\_mei26842\cryptodome\util\_cpuid_c.pyd
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\metadata
- %WINDIR%\temp\_mei26842\cryptodome\util\_strxor.pyd
- %WINDIR%\temp\_mei26842\google\protobuf\internal\_api_implementation.cp37-win32.pyd
- %WINDIR%\temp\_mei26842\google\protobuf\pyext\_message.cp37-win32.pyd
- %WINDIR%\temp\_mei26842\grpc\_cython\cygrpc.cp37-win32.pyd
- %WINDIR%\temp\_mei26842\grpc\_cython\_credentials\roots.pem
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\installer
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\license
- %WINDIR%\temp\_mei26842\importlib_metadata-6.7.0.dist-info\record
- %WINDIR%\temp\tar1ae1.tmp
- %WINDIR%\temp\caba2c1.tmp
- %WINDIR%\temp\_mei26842\_hashlib.pyd
- %WINDIR%\temp\cab6054.tmp
- %WINDIR%\temp\tar6055.tmp
- %WINDIR%\temp\cab60a4.tmp
- %WINDIR%\temp\tar60a5.tmp
- %WINDIR%\temp\cab6104.tmp
- %WINDIR%\temp\tar6105.tmp
- %WINDIR%\temp\cab6163.tmp
- %WINDIR%\temp\cab7726.tmp
- %WINDIR%\temp\_mei26842\_decimal.pyd
- %WINDIR%\temp\tar7727.tmp
- %WINDIR%\temp\cab7757.tmp
- %WINDIR%\temp\tar7758.tmp
- %WINDIR%\temp\cab8cfb.tmp
- %WINDIR%\temp\tar8cfc.tmp
- %WINDIR%\temp\cab8d2c.tmp
- %WINDIR%\temp\tar8d2d.tmp
- %WINDIR%\temp\tar4a25.tmp
- %WINDIR%\temp\_mei26842\cryptodome\hash\_sha256.pyd
- %WINDIR%\temp\cab4a24.tmp
- %WINDIR%\temp\cab1ae0.tmp
- %WINDIR%\temp\_mei26842\_lzma.pyd
- %WINDIR%\temp\_mei26842\_multiprocessing.pyd
- %WINDIR%\temp\_mei26842\_queue.pyd
- %WINDIR%\temp\_mei26842\_socket.pyd
- %WINDIR%\temp\_mei26842\_ssl.pyd
- %WINDIR%\system\myservice\csrs_upgrade.exe
- %WINDIR%\system\myservice\csrs_upgrade.exe.s
- %WINDIR%\temp\_mei26842\_ctypes.pyd
- %WINDIR%\temp\cab48e8.tmp
- %WINDIR%\temp\cab1b70.tmp
- %WINDIR%\temp\tar1b71.tmp
- %WINDIR%\temp\cab1b30.tmp
- %WINDIR%\temp\tar1b31.tmp
- %WINDIR%\temp\udd3dab.tmp
- %WINDIR%\temp\cab48e9.tmp
- %WINDIR%\temp\tar48fa.tmp
- %WINDIR%\temp\tar48ea.tmp
- %WINDIR%\temp\tar6164.tmp
- %WINDIR%\temp\_mei26842\cryptodome\hash\_sha224.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_blake2b.pyd
- %WINDIR%\temp\_mei26842\api-ms-win-core-libraryloader-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-localization-l1-2-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-memory-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-namedpipe-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-processenvironment-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-processthreads-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-processthreads-l1-1-1.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-rtlsupport-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-convert-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-string-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-synch-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-synch-l1-2-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-sysinfo-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-timezone-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-util-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-conio-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-interlocked-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-profile-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-heap-l1-1-0.dll
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\top_level.txt
- %WINDIR%\system\myservice\.app_config.v
- %WINDIR%\system\myservice\.task_config.v
- %WINDIR%\system\myservice\.asst_bin.v
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\installer
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\license
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\metadata
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\record
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\wheel
- %WINDIR%\temp\_mei26842\api-ms-win-core-file-l2-1-0.dll
- %WINDIR%\temp\_mei26842\altgraph-0.17.4.dist-info\zip-safe
- %WINDIR%\temp\_mei26842\api-ms-win-core-console-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-datetime-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-debug-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-errorhandling-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-file-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-file-l1-2-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-core-handle-l1-1-0.dll
- %WINDIR%\temp\_mei26842\base_library.zip
- %WINDIR%\temp\_mei26842\cryptodome\hash\_ripemd160.pyd
- %WINDIR%\temp\_mei26842\api-ms-win-crt-heap-l1-1-0.dll
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_des.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_des3.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ecb.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_eksblowfish.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ocb.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ofb.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_salsa20.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_blake2s.pyd
- %WINDIR%\temp\_mei26842\api-ms-win-crt-filesystem-l1-1-0.dll
- %WINDIR%\temp\_mei26842\cryptodome\hash\_ghash_clmul.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_ghash_portable.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_keccak.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_md2.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_md4.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_md5.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_poly1305.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_ctr.pyd
- %WINDIR%\temp\_mei26842\cryptodome\hash\_sha1.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cfb.pyd
- %WINDIR%\temp\_mei26842\api-ms-win-crt-utility-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-locale-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-math-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-process-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-runtime-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-stdio-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-string-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-time-l1-1-0.dll
- %WINDIR%\temp\_mei26842\api-ms-win-crt-environment-l1-1-0.dll
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cast.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_arc4.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_chacha20.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_pkcs1_decode.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_aes.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_aesni.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_arc2.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_blowfish.pyd
- %WINDIR%\temp\_mei26842\cryptodome\cipher\_raw_cbc.pyd
- %WINDIR%\temp\tara2c2.tmp
Перемещает следующие файлы
- %WINDIR%\system\myservice\.myservice.c.remote в %WINDIR%\system\myservice\.myservice.c
- %WINDIR%\system\myservice\.myservice.c.s.remote в %WINDIR%\system\myservice\.myservice.c.s
- %WINDIR%\system\myservice\.myservice.t.remote в %WINDIR%\system\myservice\.myservice.t
- %WINDIR%\system\myservice\.myservice.t.s.remote в %WINDIR%\system\myservice\.myservice.t.s
- %WINDIR%\system\myservice\csrs_upgrade.exe.s.remote в %WINDIR%\system\myservice\csrs_upgrade.exe.s
- %WINDIR%\system\myservice\csrs_upgrade.exe в %WINDIR%\system\myservice\csrs.exe
Подменяет следующие файлы
- %WINDIR%\system\myservice\.app_bin.v
- %WINDIR%\system\myservice\.app_config.v
- %WINDIR%\system\myservice\csrs_upgrade.exe
Сетевая активность
Подключается к
- '91.##5.152.45':9999
- '21#.#92.15.157':5678
- '5.##.176.171':8171
- '91.##5.152.45':1234
- 'wh#####yip.akamai.com':80
- 'ch#####.amazonaws.com':80
- 'ic###azip.com':443
- 'id##t.me':80
- 'my####rnalip.com':443
- 'if##nfig.io':80
- 'sh###yip.com':443
- 'localhost':49199
- 'x1.#.lencr.org':80
- 'microsoft.com':80
TCP
Запросы HTTP GET
- http://21#.##2.15.157:5678/a/WX4/v via 21#.#92.15.157
- http://91.###.152.45:1234/s/WX4/s via 91.##5.152.45
- http://id##t.me/
- http://if##nfig.io/ip
- http://ch#####.amazonaws.com/
- http://91.###.152.45:1234/s/WX4/d via 91.##5.152.45
- http://wh#####yip.akamai.com/
- http://91.###.152.45:1234/s/WX4/v via 91.##5.152.45
- http://21#.##2.15.157:5678/t/s via 21#.#92.15.157
- http://21#.##2.15.157:5678/t/d via 21#.#92.15.157
- http://21#.##2.15.157:5678/t/v via 21#.#92.15.157
- http://5.##.#76.171:8171/c/v via 5.##.176.171
- http://5.##.#76.171:8171/a/WX4/v via 5.##.176.171
- http://21#.##2.15.157:5678/c/s via 21#.#92.15.157
- http://21#.##2.15.157:5678/c/d via 21#.#92.15.157
- http://21#.##2.15.157:5678/c/v via 21#.#92.15.157
- http://x1.#.lencr.org/
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Другие
- '91.##5.152.45':9999
- 'ic###azip.com':443
- 'my####rnalip.com':443
- 'sh###yip.com':443
- 'localhost':49199
- 'localhost':49207
UDP
- DNS ASK wh#####yip.akamai.com
- DNS ASK my####rnalip.com
- DNS ASK ch#####.amazonaws.com
- DNS ASK if##nfig.io
- DNS ASK sh###yip.com
- DNS ASK ic###azip.com
- DNS ASK id##t.me
- DNS ASK x1.#.lencr.org
- DNS ASK microsoft.com
Другое
Создает и запускает на исполнение
- '%WINDIR%\system\myservice\xrmjad.exe' -m s
- '%WINDIR%\system\myservice\xrmjad.exe' -action restart
- '%WINDIR%\system\myservice\csrs_upgrade.exe' -b
- '%WINDIR%\system\myservice\csrs.exe' -l 127.0.0.1:49199 -t 32
- '%WINDIR%\system\myservice\services.exe' --conf %WINDIR%\system\MyService\s.conf
