Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\microsoft\windows\windows filtering platform\rthdvbg_firewall_xx
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\RtHDVBgGJ] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\RtHDVBgGJ] 'ImagePath' = '<SYSTEM32>\srvany.exe'
Создает следующие сервисы
- 'RtHDVBgGJ' <SYSTEM32>\srvany.exe
Изменения в файловой системе
Создает следующие файлы
- %WINDIR%\temp\vbdllbak\rthdvbg_firewall_xx.xml
- %WINDIR%\servicing\powerrun\sdelete.exe
- %WINDIR%\servicing\powerrun\powerrun.exe
- %WINDIR%\temp\autd125.tmp
- %WINDIR%\temp\autd115.tmp
- %WINDIR%\temp\2g5w3a2e.tmp
- %WINDIR%\temp\autd0f5.tmp
- %WINDIR%\temp\autb7ad.tmp
- %WINDIR%\temp\autb7ac.tmp
- %WINDIR%\temp\2sii9r7i.tmp
- %WINDIR%\temp\autb79b.tmp
- %WINDIR%\servicing\rthdvbg\kaijidaima.bak
- %TEMP%\autb118.tmp
- %TEMP%\2g6r4v0m.tmp
- %TEMP%\autb0f7.tmp
- %WINDIR%\temp\vbdllbak\czwj.vbs
- %WINDIR%\kaijidaima.exe
- %WINDIR%\syswow64\startmenu.vbs
- %WINDIR%\temp\vbdllbak\sdelete.exe
- %WINDIR%\syswow64\instsrv.exe
- %WINDIR%\syswow64\srvany.exe
- %WINDIR%\temp\vbdllbak\setacl.exe
- %WINDIR%\temp\vbdllbak\powerrun.exe
- %TEMP%\autb107.tmp
- %WINDIR%\servicing\sessions\2022-7211300.xml
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\kaijidaima.exe
- %WINDIR%\syswow64\srvany.exe
- %WINDIR%\syswow64\instsrv.exe
Удаляет следующие файлы
- %TEMP%\autb0f7.tmp
- %WINDIR%\tezzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
- %WINDIR%\tezzzzzzzzzzzzzzzzzzzz.zzz
- %WINDIR%\tezzzzzzzzzzzzzzzz.zzz
- %WINDIR%\temp\2g5w3a2e.tmp
- %WINDIR%\temp\autd125.tmp
- %WINDIR%\temp\autd115.tmp
- %WINDIR%\tezzzzzzzzzzzzzzzzzzz.zzz
- %WINDIR%\temp\autd0f5.tmp
- %WINDIR%\temp\autb7ad.tmp
- %WINDIR%\temp\autb7ac.tmp
- %WINDIR%\temp\autb79b.tmp
- %TEMP%\2g6r4v0m.tmp
- %TEMP%\autb118.tmp
- %TEMP%\autb107.tmp
- %WINDIR%\temp\2sii9r7i.tmp
- %WINDIR%\tezzzzzzzzzzzzzzzzzz.zzz
Перемещает следующие файлы
- %WINDIR%\temp\vbdllbak\czwj.vbs в %WINDIR%\teaaaaaaaaaaaaaaaa.aaa
- %WINDIR%\teppppppppppppppppppp.ppp в %WINDIR%\teqqqqqqqqqqqqqqqqqqq.qqq
- %WINDIR%\teooooooooooooooooooo.ooo в %WINDIR%\teppppppppppppppppppp.ppp
- %WINDIR%\tennnnnnnnnnnnnnnnnnn.nnn в %WINDIR%\teooooooooooooooooooo.ooo
- %WINDIR%\temmmmmmmmmmmmmmmmmmm.mmm в %WINDIR%\tennnnnnnnnnnnnnnnnnn.nnn
- %WINDIR%\telllllllllllllllllll.lll в %WINDIR%\temmmmmmmmmmmmmmmmmmm.mmm
- %WINDIR%\tekkkkkkkkkkkkkkkkkkk.kkk в %WINDIR%\telllllllllllllllllll.lll
- %WINDIR%\tejjjjjjjjjjjjjjjjjjj.jjj в %WINDIR%\tekkkkkkkkkkkkkkkkkkk.kkk
- %WINDIR%\teiiiiiiiiiiiiiiiiiii.iii в %WINDIR%\tejjjjjjjjjjjjjjjjjjj.jjj
- %WINDIR%\tehhhhhhhhhhhhhhhhhhh.hhh в %WINDIR%\teiiiiiiiiiiiiiiiiiii.iii
- %WINDIR%\teggggggggggggggggggg.ggg в %WINDIR%\tehhhhhhhhhhhhhhhhhhh.hhh
- %WINDIR%\tefffffffffffffffffff.fff в %WINDIR%\teggggggggggggggggggg.ggg
- %WINDIR%\teeeeeeeeeeeeeeeeeeee.eee в %WINDIR%\tefffffffffffffffffff.fff
- %WINDIR%\teddddddddddddddddddd.ddd в %WINDIR%\teeeeeeeeeeeeeeeeeeee.eee
- %WINDIR%\terrrrrrrrrrrrrrrrrrr.rrr в %WINDIR%\tesssssssssssssssssss.sss
- %WINDIR%\teqqqqqqqqqqqqqqqqqqq.qqq в %WINDIR%\terrrrrrrrrrrrrrrrrrr.rrr
- %WINDIR%\teaaaaaaaaaaaaaaaaaaa.aaa в %WINDIR%\tebbbbbbbbbbbbbbbbbbb.bbb
- %WINDIR%\temp\vbdllbak\sdelete.exe в %WINDIR%\teaaaaaaaaaaaaaaaaaaa.aaa
- %WINDIR%\teyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy в %WINDIR%\tezzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz.zzz
- %WINDIR%\texxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx в %WINDIR%\teyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy.yyy
- %WINDIR%\tewwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www в %WINDIR%\texxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xxx
- %WINDIR%\tevvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv в %WINDIR%\tewwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.www
- %WINDIR%\teuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu в %WINDIR%\tevvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.vvv
- %WINDIR%\tettttttttttttttttttttttttttttttt.ttt в %WINDIR%\teuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu.uuu
- %WINDIR%\tesssssssssssssssssssssssssssssss.sss в %WINDIR%\tettttttttttttttttttttttttttttttt.ttt
- %WINDIR%\terrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr в %WINDIR%\tesssssssssssssssssssssssssssssss.sss
- %WINDIR%\teqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq в %WINDIR%\terrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr.rrr
- %WINDIR%\teppppppppppppppppppppppppppppppp.ppp в %WINDIR%\teqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.qqq
- %WINDIR%\teooooooooooooooooooooooooooooooo.ooo в %WINDIR%\teppppppppppppppppppppppppppppppp.ppp
- %WINDIR%\teccccccccccccccccccc.ccc в %WINDIR%\teddddddddddddddddddd.ddd
- %WINDIR%\teffffffffffffffffffff.fff в %WINDIR%\tegggggggggggggggggggg.ggg
- %WINDIR%\tesssssssssssssssssss.sss в %WINDIR%\tettttttttttttttttttt.ttt
- %WINDIR%\tewwwwwwwwwwwwwwwwww.www в %WINDIR%\texxxxxxxxxxxxxxxxxx.xxx
- %WINDIR%\tevvvvvvvvvvvvvvvvvv.vvv в %WINDIR%\tewwwwwwwwwwwwwwwwww.www
- %WINDIR%\teuuuuuuuuuuuuuuuuuu.uuu в %WINDIR%\tevvvvvvvvvvvvvvvvvv.vvv
- %WINDIR%\tetttttttttttttttttt.ttt в %WINDIR%\teuuuuuuuuuuuuuuuuuu.uuu
- %WINDIR%\tessssssssssssssssss.sss в %WINDIR%\tetttttttttttttttttt.ttt
- %WINDIR%\terrrrrrrrrrrrrrrrrr.rrr в %WINDIR%\tessssssssssssssssss.sss
- %WINDIR%\teqqqqqqqqqqqqqqqqqq.qqq в %WINDIR%\terrrrrrrrrrrrrrrrrr.rrr
- %WINDIR%\tepppppppppppppppppp.ppp в %WINDIR%\teqqqqqqqqqqqqqqqqqq.qqq
- %WINDIR%\teoooooooooooooooooo.ooo в %WINDIR%\tepppppppppppppppppp.ppp
- %WINDIR%\tennnnnnnnnnnnnnnnnn.nnn в %WINDIR%\teoooooooooooooooooo.ooo
- %WINDIR%\temmmmmmmmmmmmmmmmmm.mmm в %WINDIR%\tennnnnnnnnnnnnnnnnn.nnn
- %WINDIR%\tellllllllllllllllll.lll в %WINDIR%\temmmmmmmmmmmmmmmmmm.mmm
- %WINDIR%\tekkkkkkkkkkkkkkkkkk.kkk в %WINDIR%\tellllllllllllllllll.lll
- %WINDIR%\tejjjjjjjjjjjjjjjjjj.jjj в %WINDIR%\tekkkkkkkkkkkkkkkkkk.kkk
- %WINDIR%\teiiiiiiiiiiiiiiiiii.iii в %WINDIR%\tejjjjjjjjjjjjjjjjjj.jjj
- %WINDIR%\tehhhhhhhhhhhhhhhhhh.hhh в %WINDIR%\teiiiiiiiiiiiiiiiiii.iii
- %WINDIR%\tegggggggggggggggggg.ggg в %WINDIR%\tehhhhhhhhhhhhhhhhhh.hhh
- %WINDIR%\teffffffffffffffffff.fff в %WINDIR%\tegggggggggggggggggg.ggg
- %WINDIR%\teeeeeeeeeeeeeeeeeee.eee в %WINDIR%\teffffffffffffffffff.fff
- %WINDIR%\tedddddddddddddddddd.ddd в %WINDIR%\teeeeeeeeeeeeeeeeeee.eee
- %WINDIR%\tecccccccccccccccccc.ccc в %WINDIR%\tedddddddddddddddddd.ddd
- %WINDIR%\tebbbbbbbbbbbbbbbbbb.bbb в %WINDIR%\tecccccccccccccccccc.ccc
- %WINDIR%\teaaaaaaaaaaaaaaaaaa.aaa в %WINDIR%\tebbbbbbbbbbbbbbbbbb.bbb
- %WINDIR%\temp\vbdllbak\setacl.exe в %WINDIR%\teaaaaaaaaaaaaaaaaaa.aaa
- %WINDIR%\teyyyyyyyyyyyyyyyyyyy.yyy в %WINDIR%\tezzzzzzzzzzzzzzzzzzz.zzz
- %WINDIR%\texxxxxxxxxxxxxxxxxxx.xxx в %WINDIR%\teyyyyyyyyyyyyyyyyyyy.yyy
- %WINDIR%\tewwwwwwwwwwwwwwwwwww.www в %WINDIR%\texxxxxxxxxxxxxxxxxxx.xxx
- %WINDIR%\tevvvvvvvvvvvvvvvvvvv.vvv в %WINDIR%\tewwwwwwwwwwwwwwwwwww.www
- %WINDIR%\teuuuuuuuuuuuuuuuuuuu.uuu в %WINDIR%\tevvvvvvvvvvvvvvvvvvv.vvv
- %WINDIR%\tennnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn в %WINDIR%\teooooooooooooooooooooooooooooooo.ooo
- %WINDIR%\tebbbbbbbbbbbbbbbbbbb.bbb в %WINDIR%\teccccccccccccccccccc.ccc
- %WINDIR%\temmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm в %WINDIR%\tennnnnnnnnnnnnnnnnnnnnnnnnnnnnnn.nnn
- %WINDIR%\telllllllllllllllllllllllllllllll.lll в %WINDIR%\temmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm.mmm
- %WINDIR%\tekkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk в %WINDIR%\telllllllllllllllllllllllllllllll.lll
- %WINDIR%\teoooooooooooooooo.ooo в %WINDIR%\tepppppppppppppppp.ppp
- %WINDIR%\tebbbbbbbbbbbbbbbbbbbb.bbb в %WINDIR%\tecccccccccccccccccccc.ccc
- %WINDIR%\teaaaaaaaaaaaaaaaaaaaa.aaa в %WINDIR%\tebbbbbbbbbbbbbbbbbbbb.bbb
- %WINDIR%\temp\vbdllbak\powerrun.exe в %WINDIR%\teaaaaaaaaaaaaaaaaaaaa.aaa
- %WINDIR%\teyyyyyyyyyyyyyyyy.yyy в %WINDIR%\tezzzzzzzzzzzzzzzz.zzz
- %WINDIR%\texxxxxxxxxxxxxxxx.xxx в %WINDIR%\teyyyyyyyyyyyyyyyy.yyy
- %WINDIR%\tewwwwwwwwwwwwwwww.www в %WINDIR%\texxxxxxxxxxxxxxxx.xxx
- %WINDIR%\tevvvvvvvvvvvvvvvv.vvv в %WINDIR%\tewwwwwwwwwwwwwwww.www
- %WINDIR%\teuuuuuuuuuuuuuuuu.uuu в %WINDIR%\tevvvvvvvvvvvvvvvv.vvv
- %WINDIR%\tetttttttttttttttt.ttt в %WINDIR%\teuuuuuuuuuuuuuuuu.uuu
- %WINDIR%\tessssssssssssssss.sss в %WINDIR%\tetttttttttttttttt.ttt
- %WINDIR%\terrrrrrrrrrrrrrrr.rrr в %WINDIR%\tessssssssssssssss.sss
- %WINDIR%\teqqqqqqqqqqqqqqqq.qqq в %WINDIR%\terrrrrrrrrrrrrrrr.rrr
- %WINDIR%\tepppppppppppppppp.ppp в %WINDIR%\teqqqqqqqqqqqqqqqq.qqq
- %WINDIR%\tennnnnnnnnnnnnnnn.nnn в %WINDIR%\teoooooooooooooooo.ooo
- %WINDIR%\tedddddddddddddddddddd.ddd в %WINDIR%\teeeeeeeeeeeeeeeeeeeee.eee
- %WINDIR%\temmmmmmmmmmmmmmmm.mmm в %WINDIR%\tennnnnnnnnnnnnnnn.nnn
- %WINDIR%\tellllllllllllllll.lll в %WINDIR%\temmmmmmmmmmmmmmmm.mmm
- %WINDIR%\tekkkkkkkkkkkkkkkk.kkk в %WINDIR%\tellllllllllllllll.lll
- %WINDIR%\tejjjjjjjjjjjjjjjj.jjj в %WINDIR%\tekkkkkkkkkkkkkkkk.kkk
- %WINDIR%\teiiiiiiiiiiiiiiii.iii в %WINDIR%\tejjjjjjjjjjjjjjjj.jjj
- %WINDIR%\tehhhhhhhhhhhhhhhh.hhh в %WINDIR%\teiiiiiiiiiiiiiiii.iii
- %WINDIR%\tegggggggggggggggg.ggg в %WINDIR%\tehhhhhhhhhhhhhhhh.hhh
- %WINDIR%\teffffffffffffffff.fff в %WINDIR%\tegggggggggggggggg.ggg
- %WINDIR%\teeeeeeeeeeeeeeeee.eee в %WINDIR%\teffffffffffffffff.fff
- %WINDIR%\tedddddddddddddddd.ddd в %WINDIR%\teeeeeeeeeeeeeeeee.eee
- %WINDIR%\tecccccccccccccccc.ccc в %WINDIR%\tedddddddddddddddd.ddd
- %WINDIR%\tebbbbbbbbbbbbbbbb.bbb в %WINDIR%\tecccccccccccccccc.ccc
- %WINDIR%\teaaaaaaaaaaaaaaaa.aaa в %WINDIR%\tebbbbbbbbbbbbbbbb.bbb
- %WINDIR%\texxxxxxxxxxxxxxxxxx.xxx в %WINDIR%\teyyyyyyyyyyyyyyyyyy.yyy
- %WINDIR%\tettttttttttttttttttt.ttt в %WINDIR%\teuuuuuuuuuuuuuuuuuuu.uuu
- %WINDIR%\teeeeeeeeeeeeeeeeeeeee.eee в %WINDIR%\teffffffffffffffffffff.fff
- %WINDIR%\tehhhhhhhhhhhhhhhhhhhh.hhh в %WINDIR%\teiiiiiiiiiiiiiiiiiiii.iii
- %WINDIR%\tecccccccccccccccccccc.ccc в %WINDIR%\tedddddddddddddddddddd.ddd
- %WINDIR%\tejjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj в %WINDIR%\tekkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk.kkk
- %WINDIR%\teiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii в %WINDIR%\tejjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj.jjj
- %WINDIR%\tehhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh в %WINDIR%\teiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.iii
- %WINDIR%\teggggggggggggggggggggggggggggggg.ggg в %WINDIR%\tehhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.hhh
- %WINDIR%\tefffffffffffffffffffffffffffffff.fff в %WINDIR%\teggggggggggggggggggggggggggggggg.ggg
- %WINDIR%\teeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee в %WINDIR%\tefffffffffffffffffffffffffffffff.fff
- %WINDIR%\teddddddddddddddddddddddddddddddd.ddd в %WINDIR%\teeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eee
- %WINDIR%\teccccccccccccccccccccccccccccccc.ccc в %WINDIR%\teddddddddddddddddddddddddddddddd.ddd
- %WINDIR%\tebbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb в %WINDIR%\teccccccccccccccccccccccccccccccc.ccc
- %WINDIR%\teaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa в %WINDIR%\tebbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb.bbb
- %WINDIR%\temp\vbdllbak\rthdvbg_firewall_xx.xml в %WINDIR%\teaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaa
- %WINDIR%\teyyyyyyyyyyyyyyyyyyyy.yyy в %WINDIR%\tezzzzzzzzzzzzzzzzzzzz.zzz
- %WINDIR%\texxxxxxxxxxxxxxxxxxxx.xxx в %WINDIR%\teyyyyyyyyyyyyyyyyyyyy.yyy
- %WINDIR%\tewwwwwwwwwwwwwwwwwwww.www в %WINDIR%\texxxxxxxxxxxxxxxxxxxx.xxx
- %WINDIR%\tevvvvvvvvvvvvvvvvvvvv.vvv в %WINDIR%\tewwwwwwwwwwwwwwwwwwww.www
- %WINDIR%\teuuuuuuuuuuuuuuuuuuuu.uuu в %WINDIR%\tevvvvvvvvvvvvvvvvvvvv.vvv
- %WINDIR%\tetttttttttttttttttttt.ttt в %WINDIR%\teuuuuuuuuuuuuuuuuuuuu.uuu
- %WINDIR%\tessssssssssssssssssss.sss в %WINDIR%\tetttttttttttttttttttt.ttt
- %WINDIR%\terrrrrrrrrrrrrrrrrrrr.rrr в %WINDIR%\tessssssssssssssssssss.sss
- %WINDIR%\teqqqqqqqqqqqqqqqqqqqq.qqq в %WINDIR%\terrrrrrrrrrrrrrrrrrrr.rrr
- %WINDIR%\tepppppppppppppppppppp.ppp в %WINDIR%\teqqqqqqqqqqqqqqqqqqqq.qqq
- %WINDIR%\teoooooooooooooooooooo.ooo в %WINDIR%\tepppppppppppppppppppp.ppp
- %WINDIR%\tennnnnnnnnnnnnnnnnnnn.nnn в %WINDIR%\teoooooooooooooooooooo.ooo
- %WINDIR%\temmmmmmmmmmmmmmmmmmmm.mmm в %WINDIR%\tennnnnnnnnnnnnnnnnnnn.nnn
- %WINDIR%\tellllllllllllllllllll.lll в %WINDIR%\temmmmmmmmmmmmmmmmmmmm.mmm
- %WINDIR%\tekkkkkkkkkkkkkkkkkkkk.kkk в %WINDIR%\tellllllllllllllllllll.lll
- %WINDIR%\tejjjjjjjjjjjjjjjjjjjj.jjj в %WINDIR%\tekkkkkkkkkkkkkkkkkkkk.kkk
- %WINDIR%\teiiiiiiiiiiiiiiiiiiii.iii в %WINDIR%\tejjjjjjjjjjjjjjjjjjjj.jjj
- %WINDIR%\tegggggggggggggggggggg.ggg в %WINDIR%\tehhhhhhhhhhhhhhhhhhhh.hhh
- %WINDIR%\teyyyyyyyyyyyyyyyyyy.yyy в %WINDIR%\tezzzzzzzzzzzzzzzzzz.zzz
Другое
Создает и запускает на исполнение
- '%WINDIR%\temp\vbdllbak\powerrun.exe' %WINDIR%\temp\vbdllbak\czwj.vbs
- '%WINDIR%\syswow64\instsrv.exe' RtHDVBgGJ <SYSTEM32>\srvany.exe
- '%WINDIR%\servicing\powerrun\sdelete.exe' -s -p 3 %WINDIR%\temp\vbdllbak
- '%WINDIR%\temp\vbdllbak\setacl.exe' -silent -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RtHDVBgGJ" -ot reg -actn setprot -op "dacl:p_nc;sacl:p_nc" -actn ace -ace "n:administrators;p:read;m:set"
- '%WINDIR%\temp\vbdllbak\setacl.exe' -silent -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RtHDVBgGJ" -ot reg -actn setprot -op "dacl:p_nc;sacl:p_nc" -actn ace -ace "n:system;p:read;m:set"
- '%WINDIR%\temp\vbdllbak\setacl.exe' -silent -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RtHDVBgGJ" -ot reg -actn setprot -op "dacl:p_nc;sacl:p_nc" -actn ace -ace "n:users;p:read;m:set"
- '%WINDIR%\temp\vbdllbak\setacl.exe' -on "<SYSTEM32>\srvany.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"
- '<SYSTEM32>\wscript.exe' "%WINDIR%\temp\vbdllbak\czwj.vbs"
- '%WINDIR%\temp\vbdllbak\setacl.exe' -on "%WINDIR%\kaijidaima.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"
- '%WINDIR%\temp\vbdllbak\setacl.exe' -silent -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RtHDVBgGJ" -ot reg -actn setowner -ownr "n:nt service\trustedinstaller"
- '%WINDIR%\temp\vbdllbak\setacl.exe' -silent -on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RtHDVBgGJ" -ot reg -actn setprot -op "dacl:p_nc;sacl:p_nc" -actn ace -ace "n:nt service\trustedinstaller;p:full;m:set"
- '%WINDIR%\temp\vbdllbak\setacl.exe' -on "<SYSTEM32>\instsrv.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"
- '%WINDIR%\temp\vbdllbak\powerrun.exe' /TI/ %WINDIR%\temp\vbdllbak\czwj.vbs
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "\RtHDVBg_firewall_xx" /f' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "\Microsoft\Windows\Windows Filtering Platform\RtHDVBg_firewall_xx" /f' (со скрытым окном)
- '%WINDIR%\temp\vbdllbak\setacl.exe' -on "<SYSTEM32>\instsrv.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"' (со скрытым окном)
- '%WINDIR%\syswow64\instsrv.exe' RtHDVBgGJ <SYSTEM32>\srvany.exe' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "\Microsoft\Windows\Windows Filtering Platform\RtHDVBg_firewall_xx" /xml "%WINDIR%\temp\vbdllbak\RtHDVBg_firewall_xx.xml" /f' (со скрытым окном)
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r users:rx' (со скрытым окном)
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r Administrators:rx' (со скрытым окном)
- '%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r Administrators:rx' (со скрытым окном)
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f' (со скрытым окном)
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r Administrators:rx' (со скрытым окном)
- '%WINDIR%\temp\vbdllbak\setacl.exe' -on "%WINDIR%\kaijidaima.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"' (со скрытым окном)
- '%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f' (со скрытым окном)
- '%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r users:rx' (со скрытым окном)
- '%WINDIR%\temp\vbdllbak\setacl.exe' -on "<SYSTEM32>\srvany.exe" -ot file -actn setowner -ownr "n:NT Service\TrustedInstaller"' (со скрытым окном)
- '%WINDIR%\temp\vbdllbak\powerrun.exe' %WINDIR%\temp\vbdllbak\czwj.vbs' (со скрытым окном)
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r users:rx' (со скрытым окном)
- '%WINDIR%\syswow64\sc.exe' sdset RtHDVBgGJ D:AR(A;;CCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)' (со скрытым окном)
- '%WINDIR%\servicing\powerrun\sdelete.exe' -s -p 3 %WINDIR%\temp\vbdllbak' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cacls.exe' %WINDIR%\kaijidaima.exe /p system:r
- '%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r Administrators:rx
- '%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r users:rx
- '%WINDIR%\syswow64\icacls.exe' %WINDIR%\kaijidaima.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f
- '%WINDIR%\syswow64\cacls.exe' <SYSTEM32>\srvany.exe /p system:r
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r Administrators:rx
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r users:rx
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\srvany.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f
- '%WINDIR%\syswow64\cacls.exe' <SYSTEM32>\instsrv.exe /p system:r
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r Administrators:rx
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r users:rx
- '%WINDIR%\syswow64\icacls.exe' <SYSTEM32>\instsrv.exe /inheritance:d /grant:r "NT Service\TrustedInstaller":f
- '%WINDIR%\syswow64\sc.exe' sdset RtHDVBgGJ D:AR(A;;CCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "\RtHDVBg_firewall_xx" /f
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "\Microsoft\Windows\Windows Filtering Platform\RtHDVBg_firewall_xx" /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "\Microsoft\Windows\Windows Filtering Platform\RtHDVBg_firewall_xx" /xml "%WINDIR%\temp\vbdllbak\RtHDVBg_firewall_xx.xml" /f
