Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Shadow Defender Daemon' = '"%ProgramFiles%\Shadow Defender\DefenderDaemon.exe" /Auto'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\diskpt] 'ImagePath' = 'SYSTEM32\drivers\diskpt.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\diskpt] 'Start' = '00000000'
Изменения в файловой системе:
Создает следующие файлы:
- C:\Yaron'S Team\x64\CmdTool.txt
- C:\Yaron'S Team\x86\Uninstall.exe
- %ProgramFiles%\Shadow Defender\Defender.exe
- %ProgramFiles%\Shadow Defender\DefenderDaemon.exe
- %ProgramFiles%\Shadow Defender\Commit.exe
- %ProgramFiles%\Shadow Defender\CmdTool.exe
- %ProgramFiles%\Shadow Defender\Service.exe
- %ProgramFiles%\Shadow Defender\ShellExt.dll
- %ProgramFiles%\Shadow Defender\res.ini
- %ProgramFiles%\Shadow Defender\CmdTool.txt
- C:\Yaron'S Team\x64\Defender.exe
- %ProgramFiles%\Shadow Defender\Help.chm
- <DRIVERS>\diskpt.sys
- %ProgramFiles%\Shadow Defender\Uninstall.exe
- %ProgramFiles%\Shadow Defender\user.dat
- %WINDIR%\diskpt.crt
- %ALLUSERSPROFILE%\Start Menu\Programs\Shadow Defender\Shadow Defender.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Shadow Defender\Help.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Shadow Defender\Uninstall Shadow Defender.lnk
- %ALLUSERSPROFILE%\Desktop\Shadow Defender.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Shadow Defender.lnk
- C:\Yaron'S Team\x86\Setup.exe
- C:\Yaron'S Team\x86\ShellExt.dll
- C:\Yaron'S Team\x86\Service.exe
- C:\Yaron'S Team\x86\diskpt.win10.sys
- C:\Yaron'S Team\x86\diskpt.sys
- C:\Yaron'S Team\x64\Help.chm
- C:\Yaron'S Team\x64\res.ini
- C:\Yaron'S Team\x86\CmdTool.txt
- C:\Yaron'S Team\x86\eula.rtf
- C:\Yaron'S Team\x86\Help.chm
- C:\Yaron'S Team\x86\res.ini
- C:\Yaron'S Team\ShadowD.exe
- C:\Yaron'S Team\x64\CmdTool.exe
- C:\Yaron'S Team\x64\Commit.exe
- %TEMP%\aut1.tmp
- %ProgramFiles%\Shadow Defender\eula.rtf
- C:\Yaron'S Team\x64\Daemon.exe
- C:\Yaron'S Team\x64\diskpt.win10.sys
- C:\Yaron'S Team\x64\Service.exe
- C:\Yaron'S Team\x64\Setup.exe
- C:\Yaron'S Team\x64\ShellExt.dll
- C:\Yaron'S Team\x64\Uninstall.exe
- C:\Yaron'S Team\x86\CmdTool.exe
- C:\Yaron'S Team\x86\Commit.exe
- C:\Yaron'S Team\x86\Daemon.exe
- C:\Yaron'S Team\x86\Defender.exe
- C:\Yaron'S Team\x64\eula.rtf
- C:\Yaron'S Team\x64\diskpt.sys
- %TEMP%\SD.exe
Удаляет следующие файлы:
- %TEMP%\aut1.tmp
- C:\Yaron'S Team\x64\ShellExt.dll
- C:\Yaron'S Team\x64\Setup.exe
- C:\Yaron'S Team\x64\Service.exe
- C:\Yaron'S Team\x64\res.ini
- C:\Yaron'S Team\x64\Help.chm
- C:\Yaron'S Team\x64\eula.rtf
- C:\Yaron'S Team\x64\diskpt.win10.sys
- C:\Yaron'S Team\x64\diskpt.sys
- C:\Yaron'S Team\x64\Defender.exe
- C:\Yaron'S Team\x64\Daemon.exe
- C:\Yaron'S Team\x64\Commit.exe
- C:\Yaron'S Team\x64\CmdTool.txt
- C:\Yaron'S Team\x64\CmdTool.exe
- C:\Yaron'S Team\x64\Uninstall.exe
- C:\Yaron'S Team\x86\Uninstall.exe
- C:\Yaron'S Team\x86\Setup.exe
- C:\Yaron'S Team\x86\Service.exe
- C:\Yaron'S Team\x86\res.ini
- C:\Yaron'S Team\x86\Help.chm
- C:\Yaron'S Team\x86\eula.rtf
- C:\Yaron'S Team\x86\diskpt.win10.sys
- C:\Yaron'S Team\x86\diskpt.sys
- C:\Yaron'S Team\x86\Defender.exe
- C:\Yaron'S Team\x86\Daemon.exe
- C:\Yaron'S Team\x86\Commit.exe
- C:\Yaron'S Team\x86\CmdTool.txt
- C:\Yaron'S Team\x86\CmdTool.exe
- C:\Yaron'S Team\ShadowD.exe
- C:\Yaron'S Team\x86\ShellExt.dll
- %TEMP%\SD.exe
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'Shadow Defender Daemon Window'
Создает и запускает на исполнение:
- 'C:\Yaron'S Team\ShadowD.exe'
- 'C:\Yaron'S Team\x86\Setup.exe' -silent
- '%TEMP%\SD.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c Ping -n 1 127.0.0.1 && Del /F/Q "%TEMP%\SD.exe"
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
