Trojan.Encoder.35668

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Creates the following files on removable media

<Drive name for removable media>:\split.avi.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
<Drive name for removable media>:\dialmap.bmp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
<Drive name for removable media>:\default.bmp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
<Drive name for removable media>:\unlock-info.txt
<Drive name for removable media>:\000814251_video_01.avi.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
<Drive name for removable media>:\dashborder_144.bmp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
<Drive name for removable media>:\delete.avi.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
<Drive name for removable media>:\coffee.bmp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic

Malicious functions

Executes the following

'%WINDIR%\syswow64\net.exe' stop MSDTC
'%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT
'%WINDIR%\syswow64\net.exe' stop MSSQLSERVER
'%WINDIR%\syswow64\net.exe' stop vds
'%WINDIR%\syswow64\net.exe' stop vss
'%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable
'%WINDIR%\syswow64\net.exe' stop SQLWriter
'%WINDIR%\syswow64\net.exe' stop SQLBrowser
'%WINDIR%\syswow64\net.exe' stop MSSQL$CONTOSO1

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\<File name>.exe
C:\far2\plugins\farcmds\farcmdseng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\farcmds\farcmdseng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\liclua.exe.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\farcmds\farcmds.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\1033\aceintl.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\farcmds\farcmds.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\farcmds\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\farcmds\farcmdsrus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\farcmds\farcmdsrus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\emenu\hotkeyclipboard.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\emenu\hotkey.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\emenu\emenurus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\emenu\emenurus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\emenu\emenueng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\emenu\emenueng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\emenu\emenudel.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\grphflt\png32.flt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\compare\compare.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\filecase\caseeng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\notes.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\ftprus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\ftprus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\ftpeng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\osetupui.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\oarpmany.exe.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\ftpeng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\ftpcmds_rus.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\help\msitss55.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\ftpcmds.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\filecase\filecase.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\filecase\filecase.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\1033\alrtintl.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\filecase\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\filecase\caserus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\filecase\caserus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\emenu\emenu.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\emenu\hotkeyproperties.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\emenu\emenu.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\emenu\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\editcase\editcase.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\brackets\brackeng.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\compare\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\brackets\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\brackets\brackrus.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\brackets\brackrus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\brackets\brackrus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\brackets\brackets.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\brackets\brackets.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\brackets\brackeng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\compare\cmprus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\brackets\brackeng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\brackets\brackdel.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\autowrap\wraprus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\autowrap\wrapeng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\autowrap\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\autowrap\autowrap.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\notes_rus.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\filecase\caseeng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\compare\compare.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\compare\comprus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\compare\cmpeng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\fltldr.exe.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\editcase\editcase.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\acetxt.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\editcase\ecaserus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\editcase\ecaserus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\editcase\ecaseeng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\editcase\ecaseeng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\editcase\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\drawline\drawrus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\drawline\drawrus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\drawline\drawline.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\grphflt\gifimp32.flt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\drawline\drawline.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\drawline\draweng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\drawline\draweng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\drawline\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\compare\compeng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\techinfo.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\smart tag\fplace.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\techinfo_rus.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\acewss.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\tmppanel.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\tmpeng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\tmpeng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\shortcuts_rus.temp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\shortcuts_rus.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\shortcuts_eng.temp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\shortcuts_eng.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\disks_rus.temp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\disks_eng.temp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\textconv\wpft632.cnv.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\proclist\procrus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\proclist\procrus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\proclist\proclist.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\proclist\proclist.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\proclist\proceng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\tmppanel.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\tmprus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\autowrap\autowrap.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\pluginsdk\headers.c\farcolor.hpp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\acer3x.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\proof\mswds_en.lex.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\pluginsdk\headers.pas\pluginw.pas.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\pluginsdk\headers.pas\farkeysw.pas.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\pluginsdk\headers.pas\farcolorw.pas.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\pluginsdk\headers.c\plugin.hpp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\pluginsdk\headers.c\farkeys.hpp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\proclist\proceng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\aceoledb.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\aceodbc.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\hlfviewer\hlfviewerrus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\hlfviewer\hlfviewereng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\hlfviewer\hlfviewereng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\hlfviewer\hlfviewer.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\hlfviewer\hlfviewer.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\hlfviewer\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\lib\progress_zema.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\smart tag\fperson.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\lib\progress_wesha.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\lib\progress_jm.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\lib\progress_farcopy.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\lib\ftpprogress.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\smart tag\fstock.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\lib\ftpprogress.fll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\lib\ftpdirlist.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\msclientdatamgr\mscdm.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\proof\mswds_fr.lex.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\lib\ftpdirlist.fll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\hlfviewer\hlfviewerrus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\network\network.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\source engine\ose.exe.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\smart tag\lists\basmla.xsl.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\network\network.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\network\netrus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\network\netrus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\network\neteng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\textconv\wpft532.cnv.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\network\neteng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\network\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\macroview\macroview.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\macroview\macroview.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\macroview\macrorus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\macroview\macrorus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\smart tag\ietag.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\macroview\macroeng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\macroview\macroeng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\office14\aceexch.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\macroview\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\proclist\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\tmppanel\tmprus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\arclite\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\fexcept\excdump.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\greenmile.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\farcolors242.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\dn_like.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\descript.ion.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\import_colors.bat.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\hell.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\vaxcolors.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\nc5pal2.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\import_colors.bat.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\hell.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\greenmile.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\black_from_myodov.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\farger.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\nc5pal2.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\f9table.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\f9deactivatemenu.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\f3.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\edit_savefile.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\edit_saveandexit.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\edit_notepad.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\dialog_altdown.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\descript.ion.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\ctrlf10.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\ctrldel.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\altx.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\altsearch.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\encyclopedia\tap\code.idb.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\altscreens.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\farftp.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\altmenu.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\vaxcolors.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\farcolors242.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\black_from_july.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\dn_like.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\descript.ion.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\unlock-info.txt
C:\far2\farrus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\far.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
D:\install.log.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\farhun.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\fareng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\farcze.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\changelog_eng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%ALLUSERSPROFILE%\rsakey.key
%ALLUSERSPROFILE%\prvkey.txt
%WINDIR%\temp\tar84b.tmp
%WINDIR%\temp\cab84a.tmp
%ALLUSERSPROFILE%\pkey.txt
%ALLUSERSPROFILE%\idk.txt
C:\far2\addons\macros\macroconsts.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\default_highlighting\rodion_doroshkevich.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\fareng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\farpol.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\clearpluginscache.cmd.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\custom_highlighting\black_from_july.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
D:\unlock-info.txt
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\import_colors.bat.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\export_colors.bat.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\colors\descript.ion.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\readme.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\descript.ion.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\savesettings.cmd.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\restoresettings.cmd.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\file_id.diz.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\farspa.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\farrus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\farhun.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\arclite\7z.sfx.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\arclite\7zcon.sfx.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\openinglastfile.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\fexcept\demangle32.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\fexcept\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\encyclopedia\tap\code.bin.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\ose.exe.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\encyclopedia\tap\12_r0m.tap.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\rus\techinfo.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\rus\plugins_review.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\rus\plugins_install.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\rus\far_faq.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\rus\bug_report.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\rus\arc_support.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\eng\techinfo.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\eng\plugins_review.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\eng\plugins_install.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\eng\far_faq.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\eng\bug_report.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dwdcw20.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\osetupui.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\grphflt\wpgimp32.flt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\fexcept\fexcept.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\arclite\arclite_rus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\grphflt\jpegim32.flt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\equation\eqnedt32.hlp.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\arclite\arclite_rus.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\arclite\arclite_eng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\arclite\arclite_eng.hlf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\arclite\7zsd.sfx.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\arclite\7zs2con.sfx.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\arclite\7zs2.sfx.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\align\changelog.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\align\alignrus.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\align\aligneng.lng.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\branding.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\align\align.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\align\align.dll.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dwtrig20.exe.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\fexcept\setfarexceptionhandler.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\documentation\eng\arc_support.txt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\shiftf1.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\xlat\russian\qwerty.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\shiftbs.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_selectfromclipboard.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_numpad.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_mousewheeltilt.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_lynx_mot.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_jumptoselectedfile.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_esc.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_del.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_ctrlshiftpgupdn.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_ctrlshiftbackslash.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\plugins\ftp\farftp.map.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_ctrlright.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_ctrlq.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_ctrlleft.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_ctrlins__.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_bs.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_apps.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_altbs.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\panel_spacetoselect.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
%CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.flt.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\xlat\russian\ctrlshiftx.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\shifttab.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\xlat\russian\ctrlr.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\xlat\russian\apps.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\xlat\russian\altr.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\xlat\descript.ion.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\shell\farhere.inf.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\shell\descript.ion.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\setup\windowsgui.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\setup\executor_cmd.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\setup\executor_4nt.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\setup\descript.ion.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\setup\default165.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\wheelscreenswitch.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\view_space.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\view_shiftinssearch.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\view_pgdn.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\view_nextprevfile.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\macros\view_ctrlupdown.reg.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\far2\addons\xlat\russian\descript.ion.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.(cw-fl3059128647)(lokilocker@tutanota.com).oiltraffic

Deletes the following files

%WINDIR%\temp\cab84a.tmp
%WINDIR%\temp\tar84b.tmp

Modifies the following files

C:\far2\changelog_eng
<Drive name for removable media>:\dialmap.bmp
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg
C:\far2\addons\colors\custom_highlighting\black_from_july.reg
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg
C:\far2\addons\colors\import_colors.bat
C:\far2\addons\colors\export_colors.bat
C:\far2\addons\colors\descript.ion
C:\far2\addons\readme.txt
C:\far2\addons\descript.ion
C:\far2\savesettings.cmd
C:\far2\restoresettings.cmd
C:\far2\file_id.diz
C:\far2\farspa.lng
C:\far2\farrus.lng
C:\far2\farpol.lng
C:\far2\farhun.lng
C:\far2\farger.lng
C:\far2\fareng.lng
C:\far2\farcze.lng
C:\far2\clearpluginscache.cmd
C:\far2\far.map
C:\far2\farrus.hlf
C:\far2\changelog
C:\far2\farhun.hlf
D:\install.log
C:\far2\fareng.hlf
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg
<Drive name for removable media>:\split.avi

Modifies multiple files.

Network activity

Connects to

'localhost':49175
'localhost':49177
'ap#.#y-ip.io':443
'microsoft.com':80

TCP

HTTP GET requests

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Other

'localhost':49175
'localhost':49177
'localhost':49178
'ap#.#y-ip.io':443

UDP

DNS ASK ap#.#y-ip.io
DNS ASK microsoft.com

Miscellaneous

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c net stop MSDTC
'%WINDIR%\syswow64\net1.exe' stop SQLBrowser
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLBrowser
'%WINDIR%\syswow64\net1.exe' stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c netsh firewall set opmode mode=disable
'%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
'%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall set currentprofile state off
'%WINDIR%\syswow64\net1.exe' stop vss
'%WINDIR%\syswow64\cmd.exe' /c net stop vss
'%WINDIR%\syswow64\net1.exe' stop vds
'%WINDIR%\syswow64\cmd.exe' /c net stop vds
'%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQLSERVER
'%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLSERVERAGENT
'%WINDIR%\syswow64\cmd.exe' /c wbadmin delete catalog -quiet
'%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} recoveryenabled no
'%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\net1.exe' stop MSDTC
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$CONTOSO1
'%WINDIR%\syswow64\net1.exe' stop MSSQL$CONTOSO1

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial