Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Shadow Defender Daemon' = '"%ProgramFiles%\Shadow Defender\DefenderDaemon.exe" /Auto'
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\diskpt] 'ImagePath' = 'SYSTEM32\drivers\diskpt.sys'
- [HKLM\SYSTEM\CurrentControlSet\Services\diskpt] 'Start' = '00000000'
- [HKLM\System\CurrentControlSet\Services\{0CBD4F48-3751-475D-BE88-4F271385B672}] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\{0CBD4F48-3751-475D-BE88-4F271385B672}] 'ImagePath' = '%ProgramFiles%\Shadow Defender\Service.exe'
Создает следующие сервисы
- '{0CBD4F48-3751-475D-BE88-4F271385B672}' %ProgramFiles%\Shadow Defender\Service.exe
Изменения в файловой системе
Создает следующие файлы
- C:\kinghaze\x64\cmdtool.txt
- C:\kinghaze\x86\shellext.dll
- C:\kinghaze\x86\uninstall.exe
- %ProgramFiles%\shadow defender\defender.exe
- %ProgramFiles%\shadow defender\defenderdaemon.exe
- %ProgramFiles%\shadow defender\commit.exe
- %ProgramFiles%\shadow defender\cmdtool.exe
- %ProgramFiles%\shadow defender\service.exe
- %ProgramFiles%\shadow defender\shellext.dll
- C:\kinghaze\x86\service.exe
- C:\kinghaze\x86\setup.exe
- %ProgramFiles%\shadow defender\res.ini
- %ProgramFiles%\shadow defender\eula.rtf
- <DRIVERS>\diskpt.sys
- %ProgramFiles%\shadow defender\uninstall.exe
- %ProgramFiles%\shadow defender\user.dat
- %WINDIR%\diskpt.crt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\shadow defender\shadow defender.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\shadow defender\help.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\shadow defender\uninstall shadow defender.lnk
- %ProgramFiles%\shadow defender\cmdtool.txt
- %ProgramFiles%\shadow defender\help.chm
- C:\kinghaze\x86\diskpt.win10.sys
- C:\kinghaze\x86\diskpt.sys
- C:\kinghaze\x86\defender.exe
- C:\kinghaze\x64\help.chm
- C:\kinghaze\x64\res.ini
- C:\kinghaze\x86\cmdtool.txt
- C:\kinghaze\x86\eula.rtf
- C:\kinghaze\x86\help.chm
- C:\kinghaze\x86\res.ini
- C:\kinghaze\kur.exe
- C:\kinghaze\x64\cmdtool.exe
- C:\kinghaze\x64\commit.exe
- C:\kinghaze\x64\eula.rtf
- C:\kinghaze\x64\daemon.exe
- C:\kinghaze\x64\diskpt.sys
- C:\kinghaze\x64\diskpt.win10.sys
- C:\kinghaze\x64\service.exe
- C:\kinghaze\x64\setup.exe
- C:\kinghaze\x64\shellext.dll
- C:\kinghaze\x64\uninstall.exe
- C:\kinghaze\x86\cmdtool.exe
- C:\kinghaze\x86\commit.exe
- C:\kinghaze\x86\daemon.exe
- C:\kinghaze\x64\defender.exe
- C:\users\public\desktop\shadow defender.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\shadow defender.lnk
Удаляет следующие файлы
- C:\kinghaze\kur.exe
- C:\kinghaze\x86\setup.exe
- C:\kinghaze\x86\service.exe
- C:\kinghaze\x86\res.ini
- C:\kinghaze\x86\help.chm
- C:\kinghaze\x86\eula.rtf
- C:\kinghaze\x86\diskpt.win10.sys
- C:\kinghaze\x86\diskpt.sys
- C:\kinghaze\x86\defender.exe
- C:\kinghaze\x86\daemon.exe
- C:\kinghaze\x86\commit.exe
- C:\kinghaze\x86\cmdtool.txt
- C:\kinghaze\x86\cmdtool.exe
- C:\kinghaze\x86\shellext.dll
- C:\kinghaze\x64\uninstall.exe
- C:\kinghaze\x64\setup.exe
- C:\kinghaze\x64\service.exe
- C:\kinghaze\x64\res.ini
- C:\kinghaze\x64\help.chm
- C:\kinghaze\x64\eula.rtf
- C:\kinghaze\x64\diskpt.win10.sys
- C:\kinghaze\x64\diskpt.sys
- C:\kinghaze\x64\defender.exe
- C:\kinghaze\x64\daemon.exe
- C:\kinghaze\x64\commit.exe
- C:\kinghaze\x64\cmdtool.txt
- C:\kinghaze\x64\cmdtool.exe
- C:\kinghaze\x64\shellext.dll
- C:\kinghaze\x86\uninstall.exe
Другое
Ищет следующие окна
- ClassName: '' WindowName: 'Shadow Defender Daemon Window'
Создает и запускает на исполнение
- 'C:\kinghaze\kur.exe'
- 'C:\kinghaze\x64\setup.exe' -silent
- '%ProgramFiles%\shadow defender\service.exe' /install
Запускает на исполнение
- '%ProgramFiles%\shadow defender\service.exe' /install (со скрытым окном)
