Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\kangle] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\kangle] 'ImagePath' = '%ProgramFiles(x86)%\Bangteng\Kangle\bin\kangle.exe --ntsrv'
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' stop kangle
Изменения в файловой системе
Создает следующие файлы
- C:\ho\cj.asp
- C:\llq\复件 (7) certutil.lnk
- C:\llq\复件 (7) cs.htm
- C:\llq\复件 (7) seyishi.crt
- C:\llq\复件 (7) seyishi.key
- C:\llq\复件 (8) ca15.cer
- C:\llq\复件 (8) certutil.lnk
- C:\llq\复件 (8) cs.htm
- C:\llq\复件 (8) seyishi.crt
- C:\llq\复件 (8) seyishi.key
- C:\llq\复件 (6) seyishi.key
- C:\llq\复件 (7) ca15.cer
- C:\llq\复件 (9) ca15.cer
- C:\llq\复件 (9) seyishi.crt
- C:\llq\复件 (9) seyishi.key
- C:\llq\复件 ca15.cer
- C:\llq\复件 certutil.lnk
- C:\llq\复件 cs.htm
- C:\llq\复件 seyishi.crt
- C:\llq\复件 seyishi.key
- C:\llq\复件 复件 ca15.cer
- C:\llq\复件 复件 certutil.lnk
- C:\llq\复件 (9) certutil.lnk
- C:\llq\复件 (9) cs.htm
- C:\llq\复件 复件 seyishi.crt
- C:\llq\复件 复件 cs.htm
- C:\llq\复件 (6) certutil.lnk
- C:\llq\复件 (2) certutil.lnk
- C:\llq\复件 (2) cs.htm
- C:\llq\复件 (2) seyishi.crt
- C:\llq\复件 (2) seyishi.key
- C:\llq\复件 (3) ca15.cer
- C:\llq\复件 (3) certutil.lnk
- C:\llq\复件 (3) cs.htm
- C:\llq\复件 (3) seyishi.crt
- C:\llq\复件 (6) cs.htm
- C:\llq\seyishi.key
- C:\llq\复件 (6) seyishi.crt
- C:\llq\复件 (3) seyishi.key
- C:\llq\复件 (4) seyishi.crt
- C:\llq\复件 (4) seyishi.key
- C:\llq\复件 (5) ca15.cer
- C:\llq\复件 (5) certutil.lnk
- C:\llq\复件 (5) cs.htm
- C:\llq\复件 (5) seyishi.crt
- C:\llq\复件 (5) seyishi.key
- C:\llq\复件 (6) ca15.cer
- C:\llq\复件 (4) ca15.cer
- C:\llq\复件 (4) certutil.lnk
- C:\llq\复件 (4) cs.htm
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.0_0\js\mark.js
- C:\llq\复件 复件 seyishi.key
- %WINDIR%\winsxs\installtemp\20190716030155117.0\msvcr90.dll
- %ProgramFiles(x86)%\bangteng\kangle\bin\libeay32.dll
- %WINDIR%\winsxs\installtemp\20190716030155117.0\msvcm90.dll
- %ProgramFiles(x86)%\bangteng\kangle\webadmin\logo.gif
- %ProgramFiles(x86)%\bangteng\kangle\bin\webdav.dll
- %ProgramFiles(x86)%\bangteng\kangle\etc\lang_en.xml
- %ProgramFiles(x86)%\bangteng\kangle\.autoupdate.conf
- %ProgramFiles(x86)%\bangteng\kangle\copyright.rtf
- %WINDIR%\winsxs\installtemp\20190716030155117.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.cat
- %WINDIR%\winsxs\installtemp\20190716030155335.0\9.0.21022.8.cat
- %ProgramFiles(x86)%\bangteng\kangle\webadmin\core.whm
- %ProgramFiles(x86)%\bangteng\kangle\bin\zlib1.dll
- %ProgramFiles(x86)%\bangteng\kangle\bin\ssleay32.dll
- %ProgramFiles(x86)%\bangteng\kangle\etc\lang.xml
- %ProgramFiles(x86)%\bangteng\kangle\etc\lang_zh.xml
- %WINDIR%\installer\fda21.msi
- %ProgramFiles(x86)%\bangteng\kangle\var\kangle.pid
- %ProgramFiles(x86)%\bangteng\kangle\var\server.log
- %WINDIR%\installer\msid2e7.tmp
- %TEMP%\cfgd459.tmp
- %WINDIR%\installer\fda24.ipi
- %WINDIR%\winsxs\installtemp\20190716030155117.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.manifest
- %WINDIR%\winsxs\installtemp\20190716030155335.0\9.0.21022.8.policy
- %ProgramFiles(x86)%\bangteng\kangle\bin\extworker.exe
- %ProgramFiles(x86)%\bangteng\kangle\bin\kangle.exe
- %ProgramFiles(x86)%\bangteng\kangle\bin\sqlite3.dll
- %ProgramFiles(x86)%\bangteng\kangle\etc\config.xml
- %WINDIR%\certutil.log
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\error[1]
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\error[1]
- nul
- <LS_APPDATA>\microsoft\windows\history\history.ie5\mshist012019071620190717\index.dat
- %WINDIR%\installer\fda1b.msi
- %WINDIR%\installer\msie248.tmp
- %TEMP%\cfge5e2.tmp
- %WINDIR%\installer\msie641.tmp
- %WINDIR%\installer\fda1e.ipi
- C:\youdao\pf\config.xml
- %WINDIR%\installer\msieff6.tmp
- %ProgramFiles(x86)%\bangteng\kangle\bin\pcre.dll
- %WINDIR%\assembly\tmp\1a4wos1o\netisapi.dll
- %ProgramFiles(x86)%\bangteng\kangle\bin\netisapi.dll
- %ProgramFiles(x86)%\bangteng\kangle\bin\autoupdate.exe
- %ProgramFiles(x86)%\bangteng\kangle\webadmin\kangle.css
- %ProgramFiles(x86)%\bangteng\kangle\www\index.html
- %ProgramFiles(x86)%\bangteng\kangle\bin\libiconv2.dll
- %ProgramFiles(x86)%\bangteng\kangle\bin\kasp.dll
- %WINDIR%\winsxs\installtemp\20190716030155117.0\msvcp90.dll
- C:\llq\seyishi.crt
- C:\config.msi\fda1f.rbs
- C:\llq\复件 (2) ca15.cer
- C:\llq\cs.htm
- C:\llq\cj\favorites\聚划算.url
- C:\llq\cj\favorites\网址大全.url
- C:\llq\ca15.cer
- C:\llq\certutil.lnk
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.5_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.6_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.7_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.8_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.0.9_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.0_0\bubble_compiled.js
- C:\kl\cj.lnk
- C:\kl\certutil11.exe
- C:\kl\kl318kj.lnk
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.1_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.5_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\bubble_compiled.js
- C:\llq\cj\appdata\local\360chrome\chrome\user data\default\extensions\dlmbnmecnkclepjchnmjnoecnhlokdld\71.24.6_0\include.preload.js
- C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.postload.js
- C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\bcajlbggkngndkclhoihkflldkaeeohm\4.2.3_0\include.preload.js
- C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.postload.js
- C:\llq\cj\appdata\local\google\chrome\user data\default\extensions\ohjkicjidmohhfcjjlahfppkdblibkkb\14.21.0_0\include.preload.js
- C:\llq\cj\appdata\local\liebao\user data\default\extensions\ikhdkkncnoglghljlkmcimlnlhkeamad\4.3_0\js\content.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.2_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.3_0\bubble_compiled.js
- C:\llq\cj\appdata\local\2345explorer\user data\default\extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\2.1.4_0\bubble_compiled.js
- C:\kl\certutilgl.lnk
- C:\kl\certutil.lnk
- C:\llq\cj\appdata\local\tencent\qqbrowser\content.js
- C:\hos\hosts
- C:\iifb\bd.html
- C:\iifb\bd1.html
- C:\iifb\bd2.html
- C:\iifb\bd3.html
- C:\iifb\bd4.html
- C:\iifb\gg.html
- C:\iifb\gg1.html
- C:\iifb\gg2.html
- C:\iifb\mm.html
- C:\hos\h357.asp
- C:\iifb\pc.html
- C:\iifb\ss.html
- C:\iifb\tp.html
- C:\iifb\tp1.html
- C:\iifb\tp2.html
- C:\iifb\tp3.html
- C:\kl\1i4i5.bat
- C:\kl\201906pc13.cmd
- C:\kl\3msistub2.exe
- C:\kl\apache.msi
- C:\kl\ccc.cmd
- C:\iifb\so360.html
- %WINDIR%\installer\msid588.tmp
- %ProgramFiles%\bangteng\kangle\etc\config.xml
- C:\llq\cj\appdata\local\tencent\qqbrowser\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.3_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\cjpd.js
- C:\llq\cj\appdata\roaming\360se6\user data\default\extensions\nfbikdkjfjcejddbdcpbafnclkfdhijd\52.41.34_0\js\main.js
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default-big.png
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\default.ico
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\manifest.xml
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sg.js
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.aifenhui\1.0.0\sgs.js
- C:\llq\cj\appdata\roaming\sogouexplorer\extension\com.sogou.muti-translate\1.7.1.33\js\main.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.7_0\content.js
- C:\llq\cj\appdata\roaming\sogouexplorer\extension3.db
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.9_0\content.js
- C:\llq\cj\appdata\roaming\sogouexplorer\favorite3.dat
- C:\llq\cj\favorites\links\天 猫.url
- C:\llq\cj\favorites\links\爱淘宝.url
- C:\llq\cj\favorites\links\百 度.url
- C:\llq\cj\favorites\links\网址大全.url
- C:\llq\cj\favorites\links\聚划算.url
- C:\llq\cj\favorites\天 猫.url
- C:\llq\cj\favorites\爱淘宝.url
- C:\llq\cj\favorites\百 度.url
- C:\llq\cj\appdata\roaming\sogouexplorer\extension4.db
- C:\kl\cj2.lnk
- C:\llq\cj\favorites\links\desktop.ini
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.8_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.6_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.5_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.4_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.5_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.6_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.7_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.8_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.9_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.0_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.1_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.3.2_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.2_0\js\mark.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.10_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.3_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.4_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.5_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.6_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.7_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.8_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.9_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.1_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.2_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.3_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.2.2_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hlppekcioiicbfafmmgikkdkljnjpiao\5.3.4_0\content.js
- C:\llq\cj\appdata\local\tencent\qqbrowser\user data\default\extensions\hhpcbicladjgggnafdhakomeffbblhkf\3.2.1_0\js\mark.js
- C:\config.msi\fda25.rbs
Присваивает атрибут 'скрытый' для следующих файлов
- C:\config.msi\fda20.rbf
Удаляет следующие файлы
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\error[1]
- C:\kl\1i4i5.bat
- C:\kl\certutil11.exe
- C:\kl\3msistub2.exe
- %WINDIR%\installer\fda24.ipi
- C:\config.msi\fda25.rbs
- %WINDIR%\installer\msid588.tmp
- %WINDIR%\installer\msid2e7.tmp
- %WINDIR%\installer\fda1e.ipi
- %WINDIR%\installer\fda1b.msi
- C:\config.msi\fda1f.rbs
- C:\config.msi\fda20.rbf
- %WINDIR%\installer\msieff6.tmp
- %WINDIR%\winsxs\installtemp\20190716030155117.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.manifest
- %WINDIR%\winsxs\installtemp\20190716030155117.0\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.cat
- %WINDIR%\winsxs\installtemp\20190716030155117.0\msvcr90.dll
- %WINDIR%\winsxs\installtemp\20190716030155117.0\msvcp90.dll
- %WINDIR%\winsxs\installtemp\20190716030155117.0\msvcm90.dll
- %WINDIR%\winsxs\installtemp\20190716030155335.0\9.0.21022.8.policy
- %WINDIR%\winsxs\installtemp\20190716030155335.0\9.0.21022.8.cat
- %WINDIR%\installer\msie641.tmp
- %WINDIR%\installer\msie248.tmp
- C:\kl\apache.msi
- C:\kl\201906pc13.cmd
Перемещает следующие файлы
- %ProgramFiles(x86)%\bangteng\kangle\etc\config.xml в C:\config.msi\fda20.rbf
Подменяет следующие файлы
- %ProgramFiles(x86)%\bangteng\kangle\etc\config.xml
Самоудаляется.
Сетевая активность
TCP
Запросы HTTP GET
- http://42.##f235.com/gogg/hx/
UDP
- DNS ASK 42.##f235.com
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Создает и запускает на исполнение
- 'C:\kl\certutil11.exe' -addstore -enterprise "root" C:\llq\ca15.cer
- '%ProgramFiles(x86)%\bangteng\kangle\bin\kangle.exe' --install
- '%ProgramFiles(x86)%\bangteng\kangle\bin\kangle.exe' --ntsrv
- '%ProgramFiles(x86)%\bangteng\kangle\bin\kangle.exe' "--shutdown" "12776" "--active" "12772" "--notice" "12768" "--worker_index" "0" "--ppid" "2416"
- 'C:\kl\3msistub2.exe' C:\kl\Apache.msi /quiet /norestart
- '%ProgramFiles(x86)%\bangteng\kangle\bin\kangle.exe' "--shutdown" "12776" "--active" "12772" "--notice" "12768" "--worker_index" "0" "--ppid" "2072"
- '%ProgramFiles(x86)%\bangteng\kangle\bin\extworker.exe'
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\201906pc13.cmd" h"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" h"' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\1i4i5.bat" "
- '%WINDIR%\syswow64\net1.exe' stop kangle
- '%WINDIR%\syswow64\attrib.exe' <DRIVERS>\etc\hosts -h -r
- '%WINDIR%\syswow64\cacls.exe' "<DRIVERS>\etc\hosts" /p everyone:f
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles%\Bangteng\Kangle\etc\config.xml" /p everyone:r
- '%WINDIR%\syswow64\cacls.exe' "%ProgramFiles(x86)%\Bangteng\Kangle\etc\config.xml" /p everyone:r
- '%WINDIR%\syswow64\cacls.exe' "C:\Youdao\pf\config.xml" /p everyone:r
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo y"
- '%WINDIR%\syswow64\find.exe' /i "zhs0816.com" "C:\Youdao\pf\config.xml"
- '%WINDIR%\syswow64\xcopy.exe' /y C:\Youdao\pf "%ProgramFiles%\Bangteng\Kangle\etc" /e
- '%WINDIR%\syswow64\xcopy.exe' /y C:\Youdao\pf "%ProgramFiles(x86)%\Bangteng\Kangle\etc" /e
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo d"
- '%WINDIR%\syswow64\msiexec.exe' -Embedding 6477C2DCFBA5C07DBBFC4722A771515F
- '%WINDIR%\syswow64\msiexec.exe' /i C:\kl\Apache.msi /quiet /norestart
- '%WINDIR%\syswow64\msiexec.exe' -Embedding C96EA7DD27C08EC156F53CC45EB60359
- '%WINDIR%\syswow64\ping.exe' -n 2 localhost
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n "120"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" h"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\201906pc13.cmd" h"
- '%WINDIR%\syswow64\mshta.exe' vbscript:createobject("wscript.shell").run("""C:\kl\ccc.cmd"" h",0)(window.close)
- '%WINDIR%\syswow64\mshta.exe' vbscript:createobject("wscript.shell").run("""C:\kl\201906pc13.cmd"" h",0)(window.close)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\ccc.cmd" "
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\kl\201906pc13.cmd" "
- '%WINDIR%\syswow64\msiexec.exe' /i C:\kl\Apache.msi /qn
- '%WINDIR%\syswow64\net.exe' start kangle
- '%WINDIR%\syswow64\net1.exe' start kangle
