Trojan.Encoder.40979

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PIDAR' = '"%LOCALAPPDATA%\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe" '
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8c.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8s.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKCU\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\Software\Classes\mimicfile\shell\open\command] '' = 'notepad.exe "%LOCALAPPDATA%\README.txt"'

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Компонент восстановления системы (SR)

изменяет следующие системные настройки:

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\7za.exe
C:\temp\session.tmp
%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\session.tmp
%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\xdel.exe
%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\everything64.dll
%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\everything32.dll
%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\everything2.ini
%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\everything.ini
%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\everything.exe
%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\pidar.exe
%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\7za.exe
%TEMP%\7zipsfx.000\xdel.exe
%TEMP%\7zipsfx.000\enc_default_default_2024-08-23_22-53-04=demetro9990@cock.li.exe
%TEMP%\7zipsfx.000\everything2.ini
%TEMP%\7zipsfx.000\everything.ini
%TEMP%\7zipsfx.000\everything64.dll
%TEMP%\7zipsfx.000\everything32.dll
%TEMP%\7zipsfx.000\everything.exe
C:\readme.txt
%LOCALAPPDATA%\readme.txt

Удаляет следующие файлы

%TEMP%\7zipsfx.000\7za.exe
%TEMP%\7zipsfx.000\enc_default_default_2024-08-23_22-53-04=demetro9990@cock.li.exe
%TEMP%\7zipsfx.000\everything.exe
%TEMP%\7zipsfx.000\xdel.exe
%TEMP%\7zipsfx.000\everything.ini
%TEMP%\7zipsfx.000\everything2.ini
%TEMP%\7zipsfx.000\everything32.dll
%TEMP%\7zipsfx.000\everything64.dll

Перемещает следующие файлы

%ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde в %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs в %ProgramFiles%\microsoft office\office14\1033\msaccess.dev.hxs.demetro9990@cock.li
%ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx в %ProgramFiles%\microsoft office\templates\1033\introducingpowerpoint2010.potx.demetro9990@cock.li
%ProgramFiles%\microsoft office\templates\1033\fiverules.potx в %ProgramFiles%\microsoft office\templates\1033\fiverules.potx.demetro9990@cock.li
%ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx в %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\mspub.exe в %ProgramFiles%\microsoft office\office14\mspub.exe.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\msaccess.exe в %ProgramFiles%\microsoft office\office14\msaccess.exe.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\excelcnv.exe в %ProgramFiles%\microsoft office\office14\excelcnv.exe.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\excel.exe в %ProgramFiles%\microsoft office\office14\excel.exe.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\outlook.exe в %ProgramFiles%\microsoft office\office14\outlook.exe.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv в %ProgramFiles%\microsoft office\office14\pubwiz\greeting.dpv.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\installed_resources14.xss в %ProgramFiles%\microsoft office\office14\installed_resources14.xss.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\proof\msth7fr.lex в %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex.demetro9990@cock.li
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api.demetro9990@cock.li
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat в %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat.demetro9990@cock.li
%APPDATA%\telegram desktop\telegram.exe в %APPDATA%\telegram desktop\telegram.exe.demetro9990@cock.li
%ProgramFiles%\mozilla thunderbird\omni.ja в %ProgramFiles%\mozilla thunderbird\omni.ja.demetro9990@cock.li
%ProgramFiles%\java\jre1.8.0_45\lib\rt.jar в %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.demetro9990@cock.li
%ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar в %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.demetro9990@cock.li
%ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa в %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde в %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\groove.exe в %ProgramFiles%\microsoft office\office14\groove.exe.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat в %ProgramFiles%\microsoft office\office14\1033\psrchsrn.dat.demetro9990@cock.li

Изменяет следующие файлы

%ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.demetro9990@cock.li
%ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.demetro9990@cock.li
%ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.demetro9990@cock.li
%ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.demetro9990@cock.li
%ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.demetro9990@cock.li
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\jre1.8.0_45.msi.demetro9990@cock.li

Сетевая активность

Подключается к

'<LOCALNET>.34.0':445
'<LOCALNET>.34.161':445
'<LOCALNET>.34.162':445
'<LOCALNET>.34.163':445
'<LOCALNET>.34.164':445
'<LOCALNET>.34.165':445
'<LOCALNET>.34.166':445
'<LOCALNET>.34.167':445
'<LOCALNET>.34.168':445
'<LOCALNET>.34.169':445
'<LOCALNET>.34.170':445
'<LOCALNET>.34.171':445
'<LOCALNET>.34.172':445
'<LOCALNET>.34.173':445
'<LOCALNET>.34.175':445
'<LOCALNET>.34.189':445
'<LOCALNET>.34.176':445
'<LOCALNET>.34.177':445
'<LOCALNET>.34.178':445
'<LOCALNET>.34.179':445
'<LOCALNET>.34.180':445
'<LOCALNET>.34.181':445
'<LOCALNET>.34.182':445
'<LOCALNET>.34.183':445
'<LOCALNET>.34.184':445
'<LOCALNET>.34.185':445
'<LOCALNET>.34.186':445
'<LOCALNET>.34.187':445
'<LOCALNET>.34.188':445
'<LOCALNET>.34.160':445
'<LOCALNET>.34.174':445
'<LOCALNET>.34.159':445
'<LOCALNET>.34.142':445
'<LOCALNET>.34.129':445
'<LOCALNET>.34.130':445
'<LOCALNET>.34.131':445
'<LOCALNET>.34.132':445
'<LOCALNET>.34.133':445
'<LOCALNET>.34.134':445
'<LOCALNET>.34.135':445
'<LOCALNET>.34.136':445
'<LOCALNET>.34.137':445
'<LOCALNET>.34.138':445
'<LOCALNET>.34.139':445
'<LOCALNET>.34.140':445
'<LOCALNET>.34.141':445
'<LOCALNET>.34.143':445
'<LOCALNET>.34.157':445
'<LOCALNET>.34.144':445
'<LOCALNET>.34.145':445
'<LOCALNET>.34.146':445
'<LOCALNET>.34.147':445
'<LOCALNET>.34.148':445
'<LOCALNET>.34.149':445
'<LOCALNET>.34.150':445
'<LOCALNET>.34.151':445
'<LOCALNET>.34.152':445
'<LOCALNET>.34.153':445
'<LOCALNET>.34.154':445
'<LOCALNET>.34.155':445
'<LOCALNET>.34.156':445
'<LOCALNET>.34.158':445
'<LOCALNET>.34.207':445
'<LOCALNET>.34.253':445
'<LOCALNET>.34.192':445
'<LOCALNET>.34.225':445
'<LOCALNET>.34.226':445
'<LOCALNET>.34.227':445
'<LOCALNET>.34.228':445
'<LOCALNET>.34.229':445
'<LOCALNET>.34.230':445
'<LOCALNET>.34.231':445
'<LOCALNET>.34.232':445
'<LOCALNET>.34.233':445
'<LOCALNET>.34.234':445
'<LOCALNET>.34.235':445
'<LOCALNET>.34.236':445
'<LOCALNET>.34.237':445
'<LOCALNET>.34.239':445
'<LOCALNET>.34.191':445
'<LOCALNET>.34.240':445
'<LOCALNET>.34.241':445
'<LOCALNET>.34.242':445
'<LOCALNET>.34.243':445
'<LOCALNET>.34.244':445
'<LOCALNET>.34.245':445
'<LOCALNET>.34.246':445
'<LOCALNET>.34.247':445
'<LOCALNET>.34.248':445
'<LOCALNET>.34.249':445
'<LOCALNET>.34.250':445
'<LOCALNET>.34.251':445
'<LOCALNET>.34.252':445
'<LOCALNET>.34.224':445
'<LOCALNET>.34.128':445
'<LOCALNET>.34.223':445
'<LOCALNET>.34.206':445
'<LOCALNET>.34.193':445
'<LOCALNET>.34.194':445
'<LOCALNET>.34.195':445
'<LOCALNET>.34.196':445
'<LOCALNET>.34.197':445
'<LOCALNET>.34.198':445
'<LOCALNET>.34.199':445
'<LOCALNET>.34.200':445
'<LOCALNET>.34.201':445
'<LOCALNET>.34.202':445
'<LOCALNET>.34.203':445
'<LOCALNET>.34.204':445
'<LOCALNET>.34.205':445
'<LOCALNET>.34.190':445
'<LOCALNET>.34.221':445
'<LOCALNET>.34.208':445
'<LOCALNET>.34.209':445
'<LOCALNET>.34.210':445
'<LOCALNET>.34.211':445
'<LOCALNET>.34.212':445
'<LOCALNET>.34.213':445
'<LOCALNET>.34.214':445
'<LOCALNET>.34.215':445
'<LOCALNET>.34.216':445
'<LOCALNET>.34.217':445
'<LOCALNET>.34.218':445
'<LOCALNET>.34.219':445
'<LOCALNET>.34.220':445
'<LOCALNET>.34.222':445
'<LOCALNET>.34.238':445
'<LOCALNET>.34.127':445
'<LOCALNET>.34.110':445
'<LOCALNET>.34.33':445
'<LOCALNET>.34.34':445
'<LOCALNET>.34.35':445
'<LOCALNET>.34.36':445
'<LOCALNET>.34.37':445
'<LOCALNET>.34.38':445
'<LOCALNET>.34.39':445
'<LOCALNET>.34.40':445
'<LOCALNET>.34.41':445
'<LOCALNET>.34.42':445
'<LOCALNET>.34.43':445
'<LOCALNET>.34.44':445
'<LOCALNET>.34.45':445
'<LOCALNET>.34.47':445
'<LOCALNET>.34.61':445
'<LOCALNET>.34.48':445
'<LOCALNET>.34.49':445
'<LOCALNET>.34.50':445
'<LOCALNET>.34.51':445
'<LOCALNET>.34.52':445
'<LOCALNET>.34.53':445
'<LOCALNET>.34.54':445
'<LOCALNET>.34.55':445
'<LOCALNET>.34.56':445
'<LOCALNET>.34.57':445
'<LOCALNET>.34.58':445
'<LOCALNET>.34.59':445
'<LOCALNET>.34.60':445
'<LOCALNET>.34.32':445
'<LOCALNET>.34.46':445
'<LOCALNET>.34.31':445
'<LOCALNET>.34.14':445
'<LOCALNET>.34.1':445
'<LOCALNET>.34.2':445
'<LOCALNET>.34.3':445
'<LOCALNET>.34.4':445
'<LOCALNET>.34.5':445
'<LOCALNET>.34.6':445
'<LOCALNET>.34.7':445
'<LOCALNET>.34.8':445
'<LOCALNET>.34.9':445
'<LOCALNET>.34.10':445
'<LOCALNET>.34.11':445
'<LOCALNET>.34.12':445
'<LOCALNET>.34.13':445
'<LOCALNET>.34.15':445
'<LOCALNET>.34.29':445
'<LOCALNET>.34.16':445
'<LOCALNET>.34.17':445
'<LOCALNET>.34.18':445
'<LOCALNET>.34.19':445
'<LOCALNET>.34.20':445
'<LOCALNET>.34.21':445
'<LOCALNET>.34.22':445
'<LOCALNET>.34.23':445
'<LOCALNET>.34.24':445
'<LOCALNET>.34.25':445
'<LOCALNET>.34.26':445
'<LOCALNET>.34.27':445
'<LOCALNET>.34.28':445
'<LOCALNET>.34.30':445
'<LOCALNET>.34.79':445
'<LOCALNET>.34.125':445
'<LOCALNET>.34.64':445
'<LOCALNET>.34.97':445
'<LOCALNET>.34.98':445
'<LOCALNET>.34.99':445
'<LOCALNET>.34.100':445
'<LOCALNET>.34.101':445
'<LOCALNET>.34.102':445
'<LOCALNET>.34.103':445
'<LOCALNET>.34.104':445
'<LOCALNET>.34.105':445
'<LOCALNET>.34.106':445
'<LOCALNET>.34.107':445
'<LOCALNET>.34.108':445
'<LOCALNET>.34.109':445
'<LOCALNET>.34.111':445
'<LOCALNET>.34.63':445
'<LOCALNET>.34.112':445
'<LOCALNET>.34.113':445
'<LOCALNET>.34.114':445
'<LOCALNET>.34.115':445
'<LOCALNET>.34.116':445
'<LOCALNET>.34.117':445
'<LOCALNET>.34.118':445
'<LOCALNET>.34.119':445
'<LOCALNET>.34.120':445
'<LOCALNET>.34.121':445
'<LOCALNET>.34.122':445
'<LOCALNET>.34.123':445
'<LOCALNET>.34.124':445
'<LOCALNET>.34.96':445
'<LOCALNET>.34.126':445
'<LOCALNET>.34.95':445
'<LOCALNET>.34.78':445
'<LOCALNET>.34.65':445
'<LOCALNET>.34.66':445
'<LOCALNET>.34.67':445
'<LOCALNET>.34.68':445
'<LOCALNET>.34.69':445
'<LOCALNET>.34.70':445
'<LOCALNET>.34.71':445
'<LOCALNET>.34.72':445
'<LOCALNET>.34.73':445
'<LOCALNET>.34.74':445
'<LOCALNET>.34.75':445
'<LOCALNET>.34.76':445
'<LOCALNET>.34.77':445
'<LOCALNET>.34.62':445
'<LOCALNET>.34.93':445
'<LOCALNET>.34.80':445
'<LOCALNET>.34.81':445
'<LOCALNET>.34.82':445
'<LOCALNET>.34.83':445
'<LOCALNET>.34.84':445
'<LOCALNET>.34.85':445
'<LOCALNET>.34.86':445
'<LOCALNET>.34.87':445
'<LOCALNET>.34.88':445
'<LOCALNET>.34.89':445
'<LOCALNET>.34.90':445
'<LOCALNET>.34.91':445
'<LOCALNET>.34.92':445
'<LOCALNET>.34.94':445
'<LOCALNET>.34.254':445

Другое

Ищет следующие окна

ClassName: 'EVERYTHING_TASKBAR_NOTIFICATION' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\7za.exe' i
'%TEMP%\7zipsfx.000\7za.exe' x -y -p89905472210203597 Everything64.dll
'%TEMP%\7zipsfx.000\enc_default_default_2024-08-23_22-53-04=demetro9990@cock.li.exe'
'%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\pidar.exe'
'%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\everything.exe' -startup
'%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\pidar.exe' -e ul1
'%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\pidar.exe' -e watch -pid 2856 -!
'%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\pidar.exe' -e ul2

Запускает на исполнение

'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0 (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0 (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0 (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0 (со скрытым окном)
'<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM" (со скрытым окном)
'<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0 (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage" (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0 (со скрытым окном)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage" (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0 (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61 (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0 (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -H off (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0 (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0 (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0 (со скрытым окном)
'<SYSTEM32>\wbengine.exe'
'<SYSTEM32>\wbadmin.exe' delete catalog -quiet (со скрытым окном)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0 (со скрытым окном)
'<SYSTEM32>\bcdedit.exe' /set {default} recoveryenabled no (со скрытым окном)
'%TEMP%\7zipsfx.000\7za.exe' x -y -p89905472210203597 Everything64.dll (со скрытым окном)
'%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\pidar.exe' -e ul2 (со скрытым окном)
'%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\pidar.exe' -e watch -pid 2856 -! (со скрытым окном)
'%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\pidar.exe' -e ul1 (со скрытым окном)
'%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\everything.exe' -startup (со скрытым окном)
'%LOCALAPPDATA%\3f4ffa8f-24f8-6f78-a0da-370314484853\pidar.exe' (со скрытым окном)
'%TEMP%\7zipsfx.000\enc_default_default_2024-08-23_22-53-04=demetro9990@cock.li.exe' (со скрытым окном)
'%TEMP%\7zipsfx.000\7za.exe' i (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней