Trojan.Encoder.41139

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BACHOKTECHET' = '"%LOCALAPPDATA%\194E1F27-9FC8-0395-4FCD-F9086C4C4FA6\BACHOKTECHET.exe" '
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8c.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8s.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\Software\Classes\mimicfile\shell\open\command] '' = 'notepad.exe "%LOCALAPPDATA%\README_SOLVETHIS.txt"'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKCU\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe] 'Debugger' = '<SYSTEM32>\Systray.exe'
[HKLM\Software\Classes\.com] '' = 'mimicfile'

Malicious functions

To complicate detection of its presence in the operating system,

modifies the following system settings:

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'

Searches for windows to

detect analytical utilities:

ClassName: 'RegmonClass', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''

Modifies file system

Creates the following files

<Current directory>\everything.exe
<Current directory>\everything.ini
<Current directory>\everything2.ini
<Current directory>\everything32.dll
<Current directory>\xdel.exe
%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\everything.exe
%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\everything.ini
%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\everything2.ini
%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\everything32.dll
%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\bachoktechet.exe
%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\xdel.exe
%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\session.tmp
C:\temp\session.tmp
C:\readme_solvethis.txt
%LOCALAPPDATA%\readme_solvethis.txt

Deletes the following files

<Current directory>\everything.exe
<Current directory>\xdel.exe
<Current directory>\everything.ini
<Current directory>\everything2.ini

Moves the following files

from %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.datastore@cyberfear.com
from %ProgramFiles%\microsoft office\office14\msaccess.exe to %ProgramFiles%\microsoft office\office14\msaccess.exe.datastore@cyberfear.com
from %ProgramFiles%\microsoft office\office14\excelcnv.exe to %ProgramFiles%\microsoft office\office14\excelcnv.exe.datastore@cyberfear.com
from %ProgramFiles%\microsoft office\office14\excel.exe to %ProgramFiles%\microsoft office\office14\excel.exe.datastore@cyberfear.com
from %ProgramFiles%\microsoft office\office14\outlook.exe to %ProgramFiles%\microsoft office\office14\outlook.exe.datastore@cyberfear.com
from %ProgramFiles%\microsoft office\office14\installed_resources14.xss to %ProgramFiles%\microsoft office\office14\installed_resources14.xss.datastore@cyberfear.com
from %ProgramFiles%\microsoft office\office14\groove.exe to %ProgramFiles%\microsoft office\office14\groove.exe.datastore@cyberfear.com
from %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex to %ProgramFiles%\microsoft office\office14\proof\msth7fr.lex.datastore@cyberfear.com
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\plug_ins\acroform.api.datastore@cyberfear.com
from %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat to %ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat.datastore@cyberfear.com
from %ProgramFiles%\mozilla thunderbird\omni.ja to %ProgramFiles%\mozilla thunderbird\omni.ja.datastore@cyberfear.com
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\telegram.exe.datastore@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.datastore@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar to %ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.datastore@cyberfear.com
from %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa to %ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.datastore@cyberfear.com
from %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde to %ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.datastore@cyberfear.com
from %ProgramFiles%\microsoft office\office14\mspub.exe to %ProgramFiles%\microsoft office\office14\mspub.exe.datastore@cyberfear.com
from %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx to %ProgramFiles%\microsoft office\templates\1033\blacktienewsletter.dotx.datastore@cyberfear.com

Modifies the following files

%ProgramFiles%\microsoft office\office14\accwiz\acwzmain.accde.datastore@cyberfear.com
%ProgramFiles%\microsoft office\office14\accwiz\acwztool.accde.datastore@cyberfear.com
%ProgramFiles%\java\jre1.8.0_45\lib\ext\jfxrt.jar.datastore@cyberfear.com
%ProgramFiles%\java\jre1.8.0_45\bin\server\classes.jsa.datastore@cyberfear.com
%ProgramFiles%\java\jre1.8.0_45\lib\rt.jar.datastore@cyberfear.com
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\jre1.8.0_45.msi.datastore@cyberfear.com
%ProgramFiles%\mozilla thunderbird\omni.ja.datastore@cyberfear.com
%ProgramFiles(x86)%\adobe\acrobat reader dc\reader\acrocef\icudtl.dat.datastore@cyberfear.com

Deletes itself.

Network activity

Connects to

'<LOCALNET>.105.0':445
'<LOCALNET>.105.161':445
'<LOCALNET>.105.162':445
'<LOCALNET>.105.163':445
'<LOCALNET>.105.164':445
'<LOCALNET>.105.165':445
'<LOCALNET>.105.166':445
'<LOCALNET>.105.167':445
'<LOCALNET>.105.168':445
'<LOCALNET>.105.169':445
'<LOCALNET>.105.170':445
'<LOCALNET>.105.171':445
'<LOCALNET>.105.172':445
'<LOCALNET>.105.173':445
'<LOCALNET>.105.175':445
'<LOCALNET>.105.189':445
'<LOCALNET>.105.176':445
'<LOCALNET>.105.177':445
'<LOCALNET>.105.178':445
'<LOCALNET>.105.179':445
'<LOCALNET>.105.180':445
'<LOCALNET>.105.181':445
'<LOCALNET>.105.182':445
'<LOCALNET>.105.183':445
'<LOCALNET>.105.184':445
'<LOCALNET>.105.185':445
'<LOCALNET>.105.186':445
'<LOCALNET>.105.187':445
'<LOCALNET>.105.188':445
'<LOCALNET>.105.160':445
'<LOCALNET>.105.174':445
'<LOCALNET>.105.159':445
'<LOCALNET>.105.142':445
'<LOCALNET>.105.129':445
'<LOCALNET>.105.130':445
'<LOCALNET>.105.131':445
'<LOCALNET>.105.132':445
'<LOCALNET>.105.133':445
'<LOCALNET>.105.134':445
'<LOCALNET>.105.135':445
'<LOCALNET>.105.136':445
'<LOCALNET>.105.137':445
'<LOCALNET>.105.138':445
'<LOCALNET>.105.139':445
'<LOCALNET>.105.140':445
'<LOCALNET>.105.141':445
'<LOCALNET>.105.143':445
'<LOCALNET>.105.157':445
'<LOCALNET>.105.144':445
'<LOCALNET>.105.145':445
'<LOCALNET>.105.146':445
'<LOCALNET>.105.147':445
'<LOCALNET>.105.148':445
'<LOCALNET>.105.149':445
'<LOCALNET>.105.150':445
'<LOCALNET>.105.151':445
'<LOCALNET>.105.152':445
'<LOCALNET>.105.153':445
'<LOCALNET>.105.154':445
'<LOCALNET>.105.155':445
'<LOCALNET>.105.156':445
'<LOCALNET>.105.158':445
'<LOCALNET>.105.207':445
'<LOCALNET>.105.253':445
'<LOCALNET>.105.192':445
'<LOCALNET>.105.225':445
'<LOCALNET>.105.226':445
'<LOCALNET>.105.227':445
'<LOCALNET>.105.228':445
'<LOCALNET>.105.229':445
'<LOCALNET>.105.230':445
'<LOCALNET>.105.231':445
'<LOCALNET>.105.232':445
'<LOCALNET>.105.233':445
'<LOCALNET>.105.234':445
'<LOCALNET>.105.235':445
'<LOCALNET>.105.236':445
'<LOCALNET>.105.237':445
'<LOCALNET>.105.239':445
'<LOCALNET>.105.191':445
'<LOCALNET>.105.240':445
'<LOCALNET>.105.241':445
'<LOCALNET>.105.242':445
'<LOCALNET>.105.243':445
'<LOCALNET>.105.244':445
'<LOCALNET>.105.245':445
'<LOCALNET>.105.246':445
'<LOCALNET>.105.247':445
'<LOCALNET>.105.248':445
'<LOCALNET>.105.249':445
'<LOCALNET>.105.250':445
'<LOCALNET>.105.251':445
'<LOCALNET>.105.252':445
'<LOCALNET>.105.224':445
'<LOCALNET>.105.128':445
'<LOCALNET>.105.223':445
'<LOCALNET>.105.206':445
'<LOCALNET>.105.193':445
'<LOCALNET>.105.194':445
'<LOCALNET>.105.195':445
'<LOCALNET>.105.196':445
'<LOCALNET>.105.197':445
'<LOCALNET>.105.198':445
'<LOCALNET>.105.199':445
'<LOCALNET>.105.200':445
'<LOCALNET>.105.201':445
'<LOCALNET>.105.202':445
'<LOCALNET>.105.203':445
'<LOCALNET>.105.204':445
'<LOCALNET>.105.205':445
'<LOCALNET>.105.190':445
'<LOCALNET>.105.221':445
'<LOCALNET>.105.208':445
'<LOCALNET>.105.209':445
'<LOCALNET>.105.210':445
'<LOCALNET>.105.211':445
'<LOCALNET>.105.212':445
'<LOCALNET>.105.213':445
'<LOCALNET>.105.214':445
'<LOCALNET>.105.215':445
'<LOCALNET>.105.216':445
'<LOCALNET>.105.217':445
'<LOCALNET>.105.218':445
'<LOCALNET>.105.219':445
'<LOCALNET>.105.220':445
'<LOCALNET>.105.222':445
'<LOCALNET>.105.238':445
'<LOCALNET>.105.127':445
'<LOCALNET>.105.110':445
'<LOCALNET>.105.33':445
'<LOCALNET>.105.34':445
'<LOCALNET>.105.35':445
'<LOCALNET>.105.36':445
'<LOCALNET>.105.37':445
'<LOCALNET>.105.38':445
'<LOCALNET>.105.39':445
'<LOCALNET>.105.40':445
'<LOCALNET>.105.41':445
'<LOCALNET>.105.42':445
'<LOCALNET>.105.43':445
'<LOCALNET>.105.44':445
'<LOCALNET>.105.45':445
'<LOCALNET>.105.47':445
'<LOCALNET>.105.61':445
'<LOCALNET>.105.48':445
'<LOCALNET>.105.49':445
'<LOCALNET>.105.50':445
'<LOCALNET>.105.51':445
'<LOCALNET>.105.52':445
'<LOCALNET>.105.53':445
'<LOCALNET>.105.54':445
'<LOCALNET>.105.55':445
'<LOCALNET>.105.56':445
'<LOCALNET>.105.57':445
'<LOCALNET>.105.58':445
'<LOCALNET>.105.59':445
'<LOCALNET>.105.60':445
'<LOCALNET>.105.32':445
'<LOCALNET>.105.46':445
'<LOCALNET>.105.31':445
'<LOCALNET>.105.14':445
'<LOCALNET>.105.1':445
'<LOCALNET>.105.2':445
'<LOCALNET>.105.3':445
'<LOCALNET>.105.4':445
'<LOCALNET>.105.5':445
'<LOCALNET>.105.6':445
'<LOCALNET>.105.7':445
'<LOCALNET>.105.8':445
'<LOCALNET>.105.9':445
'<LOCALNET>.105.10':445
'<LOCALNET>.105.11':445
'<LOCALNET>.105.12':445
'<LOCALNET>.105.13':445
'<LOCALNET>.105.15':445
'<LOCALNET>.105.29':445
'<LOCALNET>.105.16':445
'<LOCALNET>.105.17':445
'<LOCALNET>.105.18':445
'<LOCALNET>.105.19':445
'<LOCALNET>.105.20':445
'<LOCALNET>.105.21':445
'<LOCALNET>.105.22':445
'<LOCALNET>.105.23':445
'<LOCALNET>.105.24':445
'<LOCALNET>.105.25':445
'<LOCALNET>.105.26':445
'<LOCALNET>.105.27':445
'<LOCALNET>.105.28':445
'<LOCALNET>.105.30':445
'<LOCALNET>.105.79':445
'<LOCALNET>.105.125':445
'<LOCALNET>.105.64':445
'<LOCALNET>.105.97':445
'<LOCALNET>.105.98':445
'<LOCALNET>.105.99':445
'<LOCALNET>.105.100':445
'<LOCALNET>.105.101':445
'<LOCALNET>.105.102':445
'<LOCALNET>.105.103':445
'<LOCALNET>.105.104':445
'<LOCALNET>.105.105':445
'<LOCALNET>.105.106':445
'<LOCALNET>.105.107':445
'<LOCALNET>.105.108':445
'<LOCALNET>.105.109':445
'<LOCALNET>.105.111':445
'<LOCALNET>.105.63':445
'<LOCALNET>.105.112':445
'<LOCALNET>.105.113':445
'<LOCALNET>.105.114':445
'<LOCALNET>.105.115':445
'<LOCALNET>.105.116':445
'<LOCALNET>.105.117':445
'<LOCALNET>.105.118':445
'<LOCALNET>.105.119':445
'<LOCALNET>.105.120':445
'<LOCALNET>.105.121':445
'<LOCALNET>.105.122':445
'<LOCALNET>.105.123':445
'<LOCALNET>.105.124':445
'<LOCALNET>.105.96':445
'<LOCALNET>.105.126':445
'<LOCALNET>.105.95':445
'<LOCALNET>.105.78':445
'<LOCALNET>.105.65':445
'<LOCALNET>.105.66':445
'<LOCALNET>.105.67':445
'<LOCALNET>.105.68':445
'<LOCALNET>.105.69':445
'<LOCALNET>.105.70':445
'<LOCALNET>.105.71':445
'<LOCALNET>.105.72':445
'<LOCALNET>.105.73':445
'<LOCALNET>.105.74':445
'<LOCALNET>.105.75':445
'<LOCALNET>.105.76':445
'<LOCALNET>.105.77':445
'<LOCALNET>.105.62':445
'<LOCALNET>.105.93':445
'<LOCALNET>.105.80':445
'<LOCALNET>.105.81':445
'<LOCALNET>.105.82':445
'<LOCALNET>.105.83':445
'<LOCALNET>.105.84':445
'<LOCALNET>.105.85':445
'<LOCALNET>.105.86':445
'<LOCALNET>.105.87':445
'<LOCALNET>.105.88':445
'<LOCALNET>.105.89':445
'<LOCALNET>.105.90':445
'<LOCALNET>.105.91':445
'<LOCALNET>.105.92':445
'<LOCALNET>.105.94':445
'<LOCALNET>.105.254':445

Miscellaneous

Searches for the following windows

ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: '18467-41' WindowName: ''
ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'EVERYTHING_TASKBAR_NOTIFICATION' WindowName: ''

Creates and executes the following

'%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\bachoktechet.exe'
'%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\bachoktechet.exe' -e watch -pid 108 -!
'%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\bachoktechet.exe' -e ul1
'%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\everything.exe' -startup
'%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\bachoktechet.exe' -e ul2

Executes the following

'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
'<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'<SYSTEM32>\powercfg.exe' -H off
'<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
'%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\bachoktechet.exe' ' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"' (with hidden window)
'<SYSTEM32>\powercfg.exe' -S e9a42b02-d5df-448d-aa00-03f14749eb61' (with hidden window)
'<SYSTEM32>\powercfg.exe' -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-VM | Stop-VM"' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\bachoktechet.exe' -e ul2' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0' (with hidden window)
'%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\bachoktechet.exe' -e ul1' (with hidden window)
'%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\everything.exe' -startup' (with hidden window)
'%LOCALAPPDATA%\194e1f27-9fc8-0395-4fcd-f9086c4c4fa6\bachoktechet.exe' -e watch -pid 108 -!' (with hidden window)
'<SYSTEM32>\powercfg.exe' -H off' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\powercfg.exe' -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial