Trojan.Siggen28.50978

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'YOURDATA' = '"%LOCALAPPDATA%\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" '
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iisadmin.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangesa.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangeis.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql-exchange.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangeadtopology.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKCU\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\Software\Classes\mimicfile\shell\open\command] '' = 'notepad.exe "%LOCALAPPDATA%\----Read-Me-----.txt"'

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

blocks the following features:

User Account Control (UAC)

modifies the following system settings:

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\7za.exe
%HOMEPATH%\ntuser.pol
%ALLUSERSPROFILE%\ntuser.pol
<SYSTEM32>\grouppolicy\gpt.ini
<SYSTEM32>\grouppolicy\machine\registry.pol
%TEMP%\szdbstz
%TEMP%\aut8fb1.tmp
C:\----read-me-----.txt
C:\temp\session.tmp
%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\session.tmp
%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\xdel.exe
%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\everything64.dll
%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\everything32.dll
%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\everything2.ini
%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\everything.ini
%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\everything.exe
%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\dc.exe
%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\7za.exe
%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\yourdata.exe
C:\temp\mimic_log.txt
%TEMP%\7zipsfx.000\xdel.exe
%TEMP%\7zipsfx.000\dc.exe
%TEMP%\7zipsfx.000\5koto.exe
%TEMP%\7zipsfx.000\everything2.ini
%TEMP%\7zipsfx.000\everything.ini
%TEMP%\7zipsfx.000\everything64.dll
%TEMP%\7zipsfx.000\everything32.dll
%TEMP%\7zipsfx.000\everything.exe
%TEMP%\7zsfx000.cmd
%LOCALAPPDATA%\----read-me-----.txt

Sets the 'hidden' attribute to the following files

%ALLUSERSPROFILE%\tempntuser.pol

Deletes the following files

%TEMP%\7zipsfx.000\5koto.exe
%TEMP%\7zipsfx.000\7za.exe
%TEMP%\7zipsfx.000\dc.exe
%TEMP%\7zipsfx.000\everything.exe
%TEMP%\7zipsfx.000\xdel.exe
%TEMP%\7zipsfx.000\everything.ini
%TEMP%\7zipsfx.000\everything2.ini
C:\temp\mimic_log.txt
%TEMP%\aut8fb1.tmp
%TEMP%\szdbstz
%TEMP%\7zipsfx.000\everything32.dll
%TEMP%\7zipsfx.000\everything64.dll
%TEMP%\7zsfx000.cmd
%ALLUSERSPROFILE%\tempntuser.pol

Moves the following files

from %ALLUSERSPROFILE%\ntuser.pol to %ALLUSERSPROFILE%\tempntuser.pol
from %ProgramFiles%\java\jre1.8.0_45\copyright to %ProgramFiles%\java\jre1.8.0_45\copyright.getmydata@tutamail.com.5000usd
from %ProgramFiles%\java\jre1.8.0_45\license to %ProgramFiles%\java\jre1.8.0_45\license.getmydata@tutamail.com.5000usd
from %ProgramFiles%\java\jre1.8.0_45\lib\classlist to %ProgramFiles%\java\jre1.8.0_45\lib\classlist.getmydata@tutamail.com.5000usd
from %ProgramFiles%\java\jre1.8.0_45\lib\deploy\ffjcext.zip to %ProgramFiles%\java\jre1.8.0_45\lib\deploy\ffjcext.zip.getmydata@tutamail.com.5000usd
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\ext\meta-index.getmydata@tutamail.com.5000usd
from %ProgramFiles%\java\jre1.8.0_45\lib\meta-index to %ProgramFiles%\java\jre1.8.0_45\lib\meta-index.getmydata@tutamail.com.5000usd
from %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklist to %ProgramFiles%\java\jre1.8.0_45\lib\security\blacklist.getmydata@tutamail.com.5000usd
from %ProgramFiles%\java\jre1.8.0_45\lib\security\cacerts to %ProgramFiles%\java\jre1.8.0_45\lib\security\cacerts.getmydata@tutamail.com.5000usd
from %ProgramFiles%\java\jre1.8.0_45\release to %ProgramFiles%\java\jre1.8.0_45\release.getmydata@tutamail.com.5000usd
from %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings to %ProgramFiles%\java\jre1.8.0_45\lib\tzmappings.getmydata@tutamail.com.5000usd
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd.getmydata@tutamail.com.5000usd
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e.getmydata@tutamail.com.5000usd
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595 to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595.getmydata@tutamail.com.5000usd
from %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f to %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f.getmydata@tutamail.com.5000usd
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.getmydata@tutamail.com.5000usd
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913 to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.getmydata@tutamail.com.5000usd
from %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d to %APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.getmydata@tutamail.com.5000usd
from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202.getmydata@tutamail.com.5000usd
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\installtime20210406220621.getmydata@tutamail.com.5000usd

Modifies the following files

%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\a72798def4f924983d5a0db82d383c613b515ff2.getmydata@tutamail.com.5000usd
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\9cd37e15-817f-4044-81be-e43af1dfc595.getmydata@tutamail.com.5000usd
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\71d7d59d-5451-4f15-bb9e-420e88a3061f.getmydata@tutamail.com.5000usd
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\22a456d0-5d02-445b-9603-4fe4b9e5c45c.getmydata@tutamail.com.5000usd
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\d8154144-ac52-40e8-b685-b640783b2c0d.getmydata@tutamail.com.5000usd
%APPDATA%\thunderbird\profiles\chdgbv82.default-release\saved-telemetry-pings\199a0618-6d48-4205-858d-6b9a8ba9e913.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\ca7b107e288f94eb98b38094e8c5546e41a7b930.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\340a10d652987df5e54312e31f5c22f6e8dba574.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\4c5a1680d3b63616e845aca183dd3af5ad89c635.getmydata@tutamail.com.5000usd
%TEMP%\tmpaddon.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\a2f1b3da369eab62efa8bdaf2aaad94562df2b2f.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\dce3a97602eb76261f7fab20278ef882b97bfba1.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\2b8fb3a7c1e8990ce64886d66718692d2b2ed2bc.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\658c5a175a2f50d3f24332176c26ef5502016108.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\979581c3e304e73a28c04371ad0d7425356d6bdf.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\736385d44960845008f6cd8aa6fcfbedfc56713d.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\c72d4296c2ebc6fd41a9f780cd0c8f30f0ff937c.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\936b994871a31e7be8e673e61f515ddf60561094.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\1d048d4c93ba7775f1c2e11f1117d0fde4760f65.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\c2bcd190e3dad6b7dc138eb689593de077e96131.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\d0ed2eaa2bb547ad2b2a4e6eaed8931f54b6c8ec.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\1e9395fbb58031ece972bfe7a83eb202a6f3ea4f.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\13a9d78e63abd60764cbeb0bbd193b7b831d4c13.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\82c47fa9f5f29d08908329a836215460fd85b37b.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\9c571ec4d1abdf04dec3542cba1cbcdb49632bf7.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\bc9a334d14ae8d5cdcf1f5f5128ba1f4cdd083ac.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\2cb84dd9abb4e1485d83397c59b193094e1abfc7.getmydata@tutamail.com.5000usd
%LOCALAPPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\cache2\entries\39d80535a21e286b3c662765c5f09aceb927e77d.getmydata@tutamail.com.5000usd
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\dc35f7c9-5b80-4042-a301-e84d8619b27e.getmydata@tutamail.com.5000usd
%APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\saved-telemetry-pings\2a211dea-1f81-457a-9f7c-a174126ff0dd.getmydata@tutamail.com.5000usd

Modifies multiple files.

Substitutes the following files

C:\temp\mimic_log.txt
%ALLUSERSPROFILE%\ntuser.pol

Deletes itself.

Network activity

Connects to

'<LOCALNET>.62.0':445
'<LOCALNET>.62.161':445
'<LOCALNET>.62.162':445
'<LOCALNET>.62.163':445
'<LOCALNET>.62.164':445
'<LOCALNET>.62.165':445
'<LOCALNET>.62.166':445
'<LOCALNET>.62.167':445
'<LOCALNET>.62.168':445
'<LOCALNET>.62.169':445
'<LOCALNET>.62.170':445
'<LOCALNET>.62.171':445
'<LOCALNET>.62.172':445
'<LOCALNET>.62.173':445
'<LOCALNET>.62.175':445
'<LOCALNET>.62.189':445
'<LOCALNET>.62.176':445
'<LOCALNET>.62.177':445
'<LOCALNET>.62.178':445
'<LOCALNET>.62.179':445
'<LOCALNET>.62.180':445
'<LOCALNET>.62.181':445
'<LOCALNET>.62.182':445
'<LOCALNET>.62.183':445
'<LOCALNET>.62.184':445
'<LOCALNET>.62.185':445
'<LOCALNET>.62.186':445
'<LOCALNET>.62.187':445
'<LOCALNET>.62.188':445
'<LOCALNET>.62.160':445
'<LOCALNET>.62.174':445
'<LOCALNET>.62.159':445
'<LOCALNET>.62.142':445
'<LOCALNET>.62.129':445
'<LOCALNET>.62.130':445
'<LOCALNET>.62.131':445
'<LOCALNET>.62.132':445
'<LOCALNET>.62.133':445
'<LOCALNET>.62.134':445
'<LOCALNET>.62.135':445
'<LOCALNET>.62.136':445
'<LOCALNET>.62.137':445
'<LOCALNET>.62.138':445
'<LOCALNET>.62.139':445
'<LOCALNET>.62.140':445
'<LOCALNET>.62.141':445
'<LOCALNET>.62.143':445
'<LOCALNET>.62.157':445
'<LOCALNET>.62.144':445
'<LOCALNET>.62.145':445
'<LOCALNET>.62.146':445
'<LOCALNET>.62.147':445
'<LOCALNET>.62.148':445
'<LOCALNET>.62.149':445
'<LOCALNET>.62.150':445
'<LOCALNET>.62.151':445
'<LOCALNET>.62.152':445
'<LOCALNET>.62.153':445
'<LOCALNET>.62.154':445
'<LOCALNET>.62.155':445
'<LOCALNET>.62.156':445
'<LOCALNET>.62.158':445
'<LOCALNET>.62.207':445
'<LOCALNET>.62.253':445
'<LOCALNET>.62.192':445
'<LOCALNET>.62.225':445
'<LOCALNET>.62.226':445
'<LOCALNET>.62.227':445
'<LOCALNET>.62.228':445
'<LOCALNET>.62.229':445
'<LOCALNET>.62.230':445
'<LOCALNET>.62.231':445
'<LOCALNET>.62.232':445
'<LOCALNET>.62.233':445
'<LOCALNET>.62.234':445
'<LOCALNET>.62.235':445
'<LOCALNET>.62.236':445
'<LOCALNET>.62.237':445
'<LOCALNET>.62.239':445
'<LOCALNET>.62.191':445
'<LOCALNET>.62.240':445
'<LOCALNET>.62.241':445
'<LOCALNET>.62.242':445
'<LOCALNET>.62.243':445
'<LOCALNET>.62.244':445
'<LOCALNET>.62.245':445
'<LOCALNET>.62.246':445
'<LOCALNET>.62.247':445
'<LOCALNET>.62.248':445
'<LOCALNET>.62.249':445
'<LOCALNET>.62.250':445
'<LOCALNET>.62.251':445
'<LOCALNET>.62.252':445
'<LOCALNET>.62.224':445
'<LOCALNET>.62.128':445
'<LOCALNET>.62.223':445
'<LOCALNET>.62.206':445
'<LOCALNET>.62.193':445
'<LOCALNET>.62.194':445
'<LOCALNET>.62.195':445
'<LOCALNET>.62.196':445
'<LOCALNET>.62.197':445
'<LOCALNET>.62.198':445
'<LOCALNET>.62.199':445
'<LOCALNET>.62.200':445
'<LOCALNET>.62.201':445
'<LOCALNET>.62.202':445
'<LOCALNET>.62.203':445
'<LOCALNET>.62.204':445
'<LOCALNET>.62.205':445
'<LOCALNET>.62.190':445
'<LOCALNET>.62.221':445
'<LOCALNET>.62.208':445
'<LOCALNET>.62.209':445
'<LOCALNET>.62.210':445
'<LOCALNET>.62.211':445
'<LOCALNET>.62.212':445
'<LOCALNET>.62.213':445
'<LOCALNET>.62.214':445
'<LOCALNET>.62.215':445
'<LOCALNET>.62.216':445
'<LOCALNET>.62.217':445
'<LOCALNET>.62.218':445
'<LOCALNET>.62.219':445
'<LOCALNET>.62.220':445
'<LOCALNET>.62.222':445
'<LOCALNET>.62.238':445
'<LOCALNET>.62.127':445
'<LOCALNET>.62.110':445
'<LOCALNET>.62.33':445
'<LOCALNET>.62.34':445
'<LOCALNET>.62.35':445
'<LOCALNET>.62.36':445
'<LOCALNET>.62.37':445
'<LOCALNET>.62.38':445
'<LOCALNET>.62.39':445
'<LOCALNET>.62.40':445
'<LOCALNET>.62.41':445
'<LOCALNET>.62.42':445
'<LOCALNET>.62.43':445
'<LOCALNET>.62.44':445
'<LOCALNET>.62.45':445
'<LOCALNET>.62.47':445
'<LOCALNET>.62.61':445
'<LOCALNET>.62.48':445
'<LOCALNET>.62.49':445
'<LOCALNET>.62.50':445
'<LOCALNET>.62.51':445
'<LOCALNET>.62.52':445
'<LOCALNET>.62.53':445
'<LOCALNET>.62.54':445
'<LOCALNET>.62.55':445
'<LOCALNET>.62.56':445
'<LOCALNET>.62.57':445
'<LOCALNET>.62.58':445
'<LOCALNET>.62.59':445
'<LOCALNET>.62.60':445
'<LOCALNET>.62.32':445
'<LOCALNET>.62.46':445
'<LOCALNET>.62.31':445
'<LOCALNET>.62.14':445
'<LOCALNET>.62.1':445
'<LOCALNET>.62.2':445
'<LOCALNET>.62.3':445
'<LOCALNET>.62.4':445
'<LOCALNET>.62.5':445
'<LOCALNET>.62.6':445
'<LOCALNET>.62.7':445
'<LOCALNET>.62.8':445
'<LOCALNET>.62.9':445
'<LOCALNET>.62.10':445
'<LOCALNET>.62.11':445
'<LOCALNET>.62.12':445
'<LOCALNET>.62.13':445
'<LOCALNET>.62.15':445
'<LOCALNET>.62.29':445
'<LOCALNET>.62.16':445
'<LOCALNET>.62.17':445
'<LOCALNET>.62.18':445
'<LOCALNET>.62.19':445
'<LOCALNET>.62.20':445
'<LOCALNET>.62.21':445
'<LOCALNET>.62.22':445
'<LOCALNET>.62.23':445
'<LOCALNET>.62.24':445
'<LOCALNET>.62.25':445
'<LOCALNET>.62.26':445
'<LOCALNET>.62.27':445
'<LOCALNET>.62.28':445
'<LOCALNET>.62.30':445
'<LOCALNET>.62.79':445
'<LOCALNET>.62.125':445
'<LOCALNET>.62.64':445
'<LOCALNET>.62.97':445
'<LOCALNET>.62.98':445
'<LOCALNET>.62.99':445
'<LOCALNET>.62.100':445
'<LOCALNET>.62.101':445
'<LOCALNET>.62.102':445
'<LOCALNET>.62.103':445
'<LOCALNET>.62.104':445
'<LOCALNET>.62.105':445
'<LOCALNET>.62.106':445
'<LOCALNET>.62.107':445
'<LOCALNET>.62.108':445
'<LOCALNET>.62.109':445
'<LOCALNET>.62.111':445
'<LOCALNET>.62.63':445
'<LOCALNET>.62.112':445
'<LOCALNET>.62.113':445
'<LOCALNET>.62.114':445
'<LOCALNET>.62.115':445
'<LOCALNET>.62.116':445
'<LOCALNET>.62.117':445
'<LOCALNET>.62.118':445
'<LOCALNET>.62.119':445
'<LOCALNET>.62.120':445
'<LOCALNET>.62.121':445
'<LOCALNET>.62.122':445
'<LOCALNET>.62.123':445
'<LOCALNET>.62.124':445
'<LOCALNET>.62.96':445
'<LOCALNET>.62.126':445
'<LOCALNET>.62.95':445
'<LOCALNET>.62.78':445
'<LOCALNET>.62.65':445
'<LOCALNET>.62.66':445
'<LOCALNET>.62.67':445
'<LOCALNET>.62.68':445
'<LOCALNET>.62.69':445
'<LOCALNET>.62.70':445
'<LOCALNET>.62.71':445
'<LOCALNET>.62.72':445
'<LOCALNET>.62.73':445
'<LOCALNET>.62.74':445
'<LOCALNET>.62.75':445
'<LOCALNET>.62.76':445
'<LOCALNET>.62.77':445
'<LOCALNET>.62.62':445
'<LOCALNET>.62.93':445
'<LOCALNET>.62.80':445
'<LOCALNET>.62.81':445
'<LOCALNET>.62.82':445
'<LOCALNET>.62.83':445
'<LOCALNET>.62.84':445
'<LOCALNET>.62.85':445
'<LOCALNET>.62.86':445
'<LOCALNET>.62.87':445
'<LOCALNET>.62.88':445
'<LOCALNET>.62.89':445
'<LOCALNET>.62.90':445
'<LOCALNET>.62.91':445
'<LOCALNET>.62.92':445
'<LOCALNET>.62.94':445
'<LOCALNET>.62.254':445

Miscellaneous

Searches for the following windows

ClassName: 'EVERYTHING_TASKBAR_NOTIFICATION' WindowName: ''

Creates and executes the following

'%TEMP%\7zipsfx.000\7za.exe' i
'%TEMP%\7zipsfx.000\7za.exe' x -y -p5056156942493511584 Everything64.dll
'%TEMP%\7zipsfx.000\5koto.exe'
'%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\yourdata.exe'
'%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\yourdata.exe' -e watch -pid 2000 -!
'%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\yourdata.exe' -e ul1
'%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\yourdata.exe' -e ul2
'%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\dc.exe' /D
'%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\everything.exe' -startup

Executes the following

'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\raserver.exe' /offerraupdate
'<SYSTEM32>\powercfg.exe' -H off
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
'%WINDIR%\syswow64\cmd.exe' /c DC.exe /D
'<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\gpscript.exe' /RefreshSystemParam
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\svchost.exe' -k secsvcs
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'%TEMP%\7zipsfx.000\7za.exe' i' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c' (with hidden window)
'%TEMP%\7zipsfx.000\7za.exe' x -y -p5056156942493511584 Everything64.dll' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\yourdata.exe' -e ul2' (with hidden window)
'<SYSTEM32>\powercfg.exe' -H off' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c DC.exe /D' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "' (with hidden window)
'%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\everything.exe' -startup' (with hidden window)
'%TEMP%\7zipsfx.000\5koto.exe' ' (with hidden window)
'%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\yourdata.exe' -e ul1' (with hidden window)
'%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\yourdata.exe' -e watch -pid 2000 -!' (with hidden window)
'%LOCALAPPDATA%\{9cf35124-2a95-8bc1-6bed-e1481ca3c123}\yourdata.exe' ' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней