Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Создает следующие файлы на съемном носителе
- <Имя диска съемного носителя>:\readme.txt
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' stop MSDTC
- '%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\net.exe' stop MSSQLSERVER
- '%WINDIR%\syswow64\net.exe' stop vds
- '%WINDIR%\syswow64\net.exe' stop SQLWriter
- '%WINDIR%\syswow64\net.exe' stop SQLBrowser
- '%WINDIR%\syswow64\net.exe' stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable
Читает файлы, отвечающие за хранение паролей сторонними программами
- %APPDATA%\mozilla\firefox\profiles.ini
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\default.bmp
- %APPDATA%\thunderbird\profiles.ini
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Изменения в файловой системе
Создает следующие файлы
- <Текущая директория>\output.bmp
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\readme.txt
- %HOMEPATH%\favorites\links\readme.txt
- %HOMEPATH%\pictures\readme.txt
- %HOMEPATH%\saved games\readme.txt
- %HOMEPATH%\videos\readme.txt
- %LOCALAPPDATA%low\oracle\java\au\readme.txt
- %HOMEPATH%\favorites\links for united states\readme.txt
- %LOCALAPPDATA%\google\chrome\application\readme.txt
- %HOMEPATH%\searches\readme.txt
- %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\readme.txt
- %LOCALAPPDATA%low\sun\java\deployment\readme.txt
- %APPDATA%\thunderbird\crash reports\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\readme.txt
- %APPDATA%\thunderbird\readme.txt
- %LOCALAPPDATA%\google\chrome\user data\readme.txt
- %TEMP%\readme.txt
- %APPDATA%\telegram desktop\readme.txt
- %HOMEPATH%\links\readme.txt
- C:\kms\readme.txt
- D:\readme.txt
- C:\users\readme.txt
- <Текущая директория>\readme.txt
- %HOMEPATH%\readme.txt
- %LOCALAPPDATA%\readme.txt
- %LOCALAPPDATA%\gdipfontcachev1.dat
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\readme.txt
- %HOMEPATH%\favorites\msn websites\readme.txt
- %APPDATA%\mozilla\firefox\readme.txt
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\readme.txt
- %HOMEPATH%\desktop\readme.txt
- %HOMEPATH%\documents\readme.txt
- %HOMEPATH%\favorites\readme.txt
- %HOMEPATH%\downloads\readme.txt
- %HOMEPATH%\contacts\readme.txt
- %HOMEPATH%\music\readme.txt
- C:\readme.txt
- %APPDATA%\mozilla\firefox\crash reports\readme.txt
- %TEMP%\opera installer\readme.txt
Удаляет следующие файлы
- <Текущая директория>\output.bmp
Перемещает следующие файлы
- %LOCALAPPDATA%\gdipfontcachev1.dat в %LOCALAPPDATA%\helpbackyourfile@onionmail.orggdipfontcachev1.dat
- %TEMP%\javadeployreg.log в %TEMP%\helpbackyourfile@onionmail.orgjavadeployreg.log
- %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt в %TEMP%\helpbackyourfile@onionmail.orgdd_wcf_ca_smci_20230913_002946_802.txt
- %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt в %TEMP%\helpbackyourfile@onionmail.orgdd_wcf_ca_smci_20230913_002944_977.txt
- %TEMP%\dd_vcredist_x86_20230912172350.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172350.log
- %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log
- %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log
- %TEMP%\dd_vcredist_x86_20230912172322.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172322.log
- %TEMP%\jusched.log в %TEMP%\helpbackyourfile@onionmail.orgjusched.log
- %TEMP%\jawshtml.html в %TEMP%\helpbackyourfile@onionmail.orgjawshtml.html
- %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log
- %TEMP%\dd_vcredist_x86_20230912172157.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172157.log
- %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log
- %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log
- %TEMP%\dd_vcredist_x86_20230912171936.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171936.log
- %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log
- %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log
- %TEMP%\dd_vcredist_x86_20230912172224.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172224.log
- %TEMP%\dd_vcredist_amd64_20230912171641.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171641.log
- %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt в %TEMP%\helpbackyourfile@onionmail.orgmicrosoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt
- %TEMP%\user.bmp в %TEMP%\helpbackyourfile@onionmail.orguser.bmp
- %TEMP%\tmpaddon в %TEMP%\helpbackyourfile@onionmail.orgtmpaddon
- %TEMP%\setupexe(202309121734336dc).log в %TEMP%\helpbackyourfile@onionmail.orgsetupexe(202309121734336dc).log
- %TEMP%\rgia609.tmp-tmp в %TEMP%\helpbackyourfile@onionmail.orgrgia609.tmp-tmp
- %TEMP%\rgia609.tmp в %TEMP%\helpbackyourfile@onionmail.orgrgia609.tmp
- %TEMP%\readme.txt в %TEMP%\helpbackyourfile@onionmail.orgreadme.txt
- %TEMP%\ose00000.exe в %TEMP%\helpbackyourfile@onionmail.orgose00000.exe
- %TEMP%\opera_crashreporter.log в %TEMP%\helpbackyourfile@onionmail.orgopera_crashreporter.log
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997.html в %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x86 redistributable setup_20230912_171631997.html
- %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt в %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793.html в %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20230912_171623793.html
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt в %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215.html в %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20230912_171604215.html
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt в %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\helpbackyourfile@onionmail.orgreadme.txt
- %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt в %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt
- %TEMP%\microsoft .net framework 4.8 setup_20230912_173103134.html в %TEMP%\helpbackyourfile@onionmail.orgmicrosoft .net framework 4.8 setup_20230912_173103134.html
- %TEMP%\microsoft .net framework 4 setup_20230912_172639823.html в %TEMP%\helpbackyourfile@onionmail.orgmicrosoft .net framework 4 setup_20230912_172639823.html
- %TEMP%\dd_vcredist_x86_20230912171759.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171759.log
- %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log
- %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log
- %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log
- %TEMP%\dd_vcredist_x86_20230912171710.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171710.log
- %TEMP%\aspnetsetup_00000.log в %TEMP%\helpbackyourfile@onionmail.orgaspnetsetup_00000.log
- %TEMP%\dd_setuputility.txt в %TEMP%\helpbackyourfile@onionmail.orgdd_setuputility.txt
- %APPDATA%\thunderbird\crash reports\installtime20210406220621 в %APPDATA%\thunderbird\crash reports\helpbackyourfile@onionmail.orginstalltime20210406220621
- %APPDATA%\thunderbird\profiles.ini в %APPDATA%\thunderbird\helpbackyourfile@onionmail.orgprofiles.ini
- %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt в %TEMP%\helpbackyourfile@onionmail.orgdd_ndp48-x86-x64-allos-enu_decompression_log.txt
- %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt в %TEMP%\helpbackyourfile@onionmail.orgdd_dotnetfx40_full_x86_x64_decompression_log.txt
- %TEMP%\chrome_installer.log в %TEMP%\helpbackyourfile@onionmail.orgchrome_installer.log
- %TEMP%\aspnetsetup_00001.log в %TEMP%\helpbackyourfile@onionmail.orgaspnetsetup_00001.log
- %TEMP%\armui.ini в %TEMP%\helpbackyourfile@onionmail.orgarmui.ini
- %APPDATA%\telegram desktop\unins000.dat в %APPDATA%\telegram desktop\helpbackyourfile@onionmail.orgunins000.dat
- %TEMP%\adobesfx.log в %TEMP%\helpbackyourfile@onionmail.orgadobesfx.log
- %TEMP%\adobearm.log в %TEMP%\helpbackyourfile@onionmail.orgadobearm.log
- %APPDATA%\thunderbird\installs.ini в %APPDATA%\thunderbird\helpbackyourfile@onionmail.orginstalls.ini
- %APPDATA%\telegram desktop\telegram.exe в %APPDATA%\telegram desktop\helpbackyourfile@onionmail.orgtelegram.exe
- %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 в %APPDATA%\mozilla\firefox\crash reports\helpbackyourfile@onionmail.orginstalltime20200708170202
- %APPDATA%\mozilla\firefox\profiles.ini в %APPDATA%\mozilla\firefox\helpbackyourfile@onionmail.orgprofiles.ini
- %APPDATA%\mozilla\firefox\installs.ini в %APPDATA%\mozilla\firefox\helpbackyourfile@onionmail.orginstalls.ini
- %TEMP%\wallpaper.bmp в %TEMP%\helpbackyourfile@onionmail.orgwallpaper.bmp
- %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt в %TEMP%\helpbackyourfile@onionmail.orgmicrosoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt
- %TEMP%\dd_vcredistui12db.txt в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredistui12db.txt
- %APPDATA%\telegram desktop\updater.exe в %APPDATA%\telegram desktop\helpbackyourfile@onionmail.orgupdater.exe
- %TEMP%\dd_vcredistmsi12db.txt в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredistmsi12db.txt
- %TEMP%\dd_vcredist_amd64_20230912172315.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172315.log
- %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log
- %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log
- %TEMP%\dd_vcredist_amd64_20230912172247.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172247.log
- %TEMP%\dd_vcredist_amd64_20230912172134.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172134.log
- %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log
- %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log
- %TEMP%\dd_vcredist_amd64_20230912172034.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172034.log
- %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log
- %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log
- %TEMP%\dd_vcredist_amd64_20230912171824.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171824.log
- %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log
- %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log
- %TEMP%\dd_vcredist_amd64_20230912171735.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171735.log
- %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log
- %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log в %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log
- %APPDATA%\telegram desktop\unins000.exe в %APPDATA%\telegram desktop\helpbackyourfile@onionmail.orgunins000.exe
- %TEMP%\wmsetup.log в %TEMP%\helpbackyourfile@onionmail.orgwmsetup.log
Изменяет следующие файлы
- D:\install.log
- %HOMEPATH%\saved games\desktop.ini
- %HOMEPATH%\pictures\desktop.ini
- %HOMEPATH%\favorites\links\web slice gallery.url
- %HOMEPATH%\favorites\links\desktop.ini
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest
- %APPDATA%\thunderbird\installs.ini
- %HOMEPATH%\links\desktop.lnk
- %HOMEPATH%\desktop\desktop.ini
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winre.wim
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\links\desktop.ini
- %HOMEPATH%\music\desktop.ini
- %HOMEPATH%\contacts\desktop.ini
- %HOMEPATH%\downloads\desktop.ini
- %HOMEPATH%\favorites\desktop.ini
- %HOMEPATH%\documents\desktop.ini
- %HOMEPATH%\desktop\applicantform_en.doc
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\boot.sdi
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\mozilla\firefox\installs.ini
- C:\kms\kms_vl_all_aio_debug.log
- C:\users\desktop.ini
- C:\kms\kms_vl_all_aio.cmd
- %HOMEPATH%\videos\desktop.ini
- %TEMP%\adobearm.log
Изменяет множество файлов.
Подменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt
- %TEMP%\readme.txt
Самоперемещается
- из <Полный путь к файлу> в <Текущая директория>\helpbackyourfile@onionmail.org<Имя файла>.exe
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Сетевая активность
UDP
- 'localhost':56169
- 'localhost':49992
Другое
Ищет следующие окна
- ClassName: 'SystemTray_Main' WindowName: ''
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSDTC
- '%WINDIR%\syswow64\net1.exe' stop MSDTC
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLSERVERAGENT
- '%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSSQLSERVER
- '%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER
- '%WINDIR%\syswow64\net1.exe' stop vds
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log Application
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLWriter
- '%WINDIR%\syswow64\net1.exe' stop SQLWriter
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLBrowser
- '%WINDIR%\syswow64\net1.exe' stop SQLBrowser
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\net1.exe' stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
- '%WINDIR%\syswow64\cmd.exe' /c wmic.exe SHADOWCOPY /nointeractive
- '%WINDIR%\syswow64\wevtutil.exe' clear-log "windows powershell"
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log "windows powershell"
- '%WINDIR%\syswow64\wevtutil.exe' clear-log System
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log System
- '%WINDIR%\syswow64\wevtutil.exe' clear-log Security
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log Security
- '%WINDIR%\syswow64\wevtutil.exe' clear-log Application
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop vds
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete systemstatebackup -keepversions:0
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete backup
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete catalog –quiet
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe DELETE SYSTEMSTATEBACKUP –deleteOldest
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe DELETE SYSTEMSTATEBACKUP
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit.exe /set {default} recoveryenabled No
- '%WINDIR%\syswow64\cmd.exe' /c netsh.exe advfirewall set currentprofile state off
- '%WINDIR%\syswow64\cmd.exe' /c netsh.exe firewall set opmode mode=disable
