Trojan.StartPage1.64471

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe] 'Debugger' = '<SYSTEM32>\svchost.exe'
[HKLM\SOFTWARE\CLASSES\.bat] '' = 'txtfile'
[HKLM\SOFTWARE\CLASSES\.cmd] '' = 'txtfile'

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\<Имя файла>.exe
<SYSTEM32>\tasks\miscfost
<SYSTEM32>\tasks\flash
<SYSTEM32>\tasks\netframework

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\cefragsvc] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\cefragsvc] 'ImagePath' = '%WINDIR%\<Имя файла>.exe'
[HKLM\System\CurrentControlSet\Services\npf] 'ImagePath' = 'system32\drivers\npf.sys'
[HKLM\System\CurrentControlSet\Services\Jklmno] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Jklmno] 'ImagePath' = '<SYSTEM32>\oqumwuc.exe'

Создает следующие сервисы

'cefragsvc' %WINDIR%\<Имя файла>.exe
'npf' system32\drivers\npf.sys
'Jklmno' <SYSTEM32>\oqumwuc.exe

Создает следующие файлы на съемном носителе

<Имя диска съемного носителя>:\fuckoff.exe
<Имя диска съемного носителя>:\flashplayer.dll

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\net.exe' stop SharedAccess
'%WINDIR%\syswow64\net.exe' stop MpsSvc
'%WINDIR%\syswow64\net.exe' stop LanmanServer

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\<Имя файла>.exe
nul
%WINDIR%\ime\<Имя файла>.exe
<DRIVERS>\npf.sys
%WINDIR%\dllhost\migrationdump\packet.dll
%WINDIR%\dllhost\migrationdump\msvcr100d.dll
%WINDIR%\dllhost\migrationdump\wpcap.dll
%WINDIR%\dllhost\migrationdump\dialers.exe
%WINDIR%\dllhost\migrationdump\msvcr100.dll
%WINDIR%\dllhost\eternalblue\appcapture_x64.dll
%WINDIR%\dllhost\eternalblue\appcapture_x32.dll
%WINDIR%\dllhost\eternalblue\svchost.xml
%WINDIR%\dllhost\eternalblue\spoolsrv.xml
%WINDIR%\dllhost\eternalblue\specials\cnli-1.dll
%WINDIR%\dllhost\eternalblue\specials\coli-0.dll
%WINDIR%\dllhost\eternalblue\specials\crli-0.dll
%WINDIR%\dllhost\eternalblue\specials\exma-1.dll
%WINDIR%\dllhost\eternalblue\specials\libeay32.dll
%WINDIR%\dllhost\eternalblue\specials\libxml2.dll
%WINDIR%\dllhost\eternalblue\specials\posh-0.dll
%WINDIR%\dllhost\eternalblue\specials\spoolsrv.exe
%WINDIR%\dllhost\eternalblue\specials\ssleay32.dll
%WINDIR%\dllhost\eternalblue\specials\svchost.exe
%WINDIR%\dllhost\eternalblue\specials\tibe-2.dll
%WINDIR%\dllhost\eternalblue\specials\trch-1.dll
%WINDIR%\dllhost\eternalblue\specials\trfo-2.dll
%WINDIR%\dllhost\eternalblue\specials\tucl-1.dll
%WINDIR%\dllhost\eternalblue\specials\ucl.dll
%WINDIR%\dllhost\eternalblue\specials\xdvl-0.dll
%WINDIR%\dllhost\eternalblue\specials\zlib1.dll
%WINDIR%\dllhost\eternalblue\specials\svchost.xml
%WINDIR%\dllhost\eternalblue\specials\spoolsrv.xml
%WINDIR%\svchost.xml
%WINDIR%\spoolsrv.xml
%WINDIR%\dllhost\eternalblue139\appcapture_x64.dll
%WINDIR%\dllhost\eternalblue139\appcapture_x32.dll
%WINDIR%\dllhost\eternalblue139\svchost.xml
%WINDIR%\dllhost\eternalblue139\spoolsrv.xml
%WINDIR%\dllhost\eternalblue139\specials\cnli-1.dll
%WINDIR%\dllhost\eternalblue139\specials\coli-0.dll
%WINDIR%\dllhost\eternalblue139\specials\crli-0.dll
%WINDIR%\dllhost\eternalblue139\specials\exma-1.dll
%WINDIR%\dllhost\eternalblue139\specials\libeay32.dll
%WINDIR%\dllhost\eternalblue139\specials\libxml2.dll
%WINDIR%\dllhost\eternalblue139\specials\posh-0.dll
%WINDIR%\dllhost\eternalblue139\specials\spoolsrv.exe
%WINDIR%\dllhost\eternalblue139\specials\ssleay32.dll
%WINDIR%\dllhost\eternalblue139\specials\svchost.exe
%WINDIR%\dllhost\eternalblue139\specials\tibe-2.dll
%WINDIR%\dllhost\eternalblue139\specials\trch-1.dll
%WINDIR%\dllhost\eternalblue139\specials\trfo-2.dll
%WINDIR%\dllhost\eternalblue139\specials\tucl-1.dll
%WINDIR%\dllhost\eternalblue139\specials\ucl.dll
%WINDIR%\dllhost\eternalblue139\specials\xdvl-0.dll
%WINDIR%\dllhost\eternalblue139\specials\zlib1.dll
%WINDIR%\dllhost\eternalblue139\specials\svchost.xml
%WINDIR%\dllhost\eternalblue139\specials\spoolsrv.xml
%WINDIR%\dllhost\mssql\code.sql
%WINDIR%\dllhost\mssql\http.sql
%WINDIR%\dllhost\mssql\isql.exe
%WINDIR%\dllhost\mssql\sqlack.exe
%WINDIR%\dllhost\mssql\msvcr71.dll
%WINDIR%\dllhost\mssql\ntwdblib.dll
%WINDIR%\dllhost\mssql\user.txt
%WINDIR%\dllhost\mssql\pass.txt
%WINDIR%\temp\fzdk.king
%WINDIR%\temp\networks\taskmgr.exe
%WINDIR%\temp\vmnat.exe
%WINDIR%\temp\networks\config.json
%WINDIR%\syswow64\oqumwuc.exe
%WINDIR%\flashplayer_e.lnk
%WINDIR%\flashplayer_f.lnk
%WINDIR%\flashplayer_g.lnk
%WINDIR%\flashplayer_h.lnk
%WINDIR%\flashplayer_i.lnk
%WINDIR%\flashplayer_j.lnk
%WINDIR%\flashplayer_k.lnk
%WINDIR%\flashplayer_l.lnk
%WINDIR%\flashplayer_m.lnk
%WINDIR%\flashplayer_n.lnk
%WINDIR%\flashplayer_o.lnk
%WINDIR%\flashplayer_p.lnk
%WINDIR%\flashplayer_q.lnk
%WINDIR%\flashplayer_r.lnk
%WINDIR%\flashplayer_s.lnk
%WINDIR%\flashplayer_t.lnk
%WINDIR%\flashplayer_u.lnk
%WINDIR%\flashplayer_v.lnk
%WINDIR%\flashplayer_w.lnk
%WINDIR%\flashplayer_x.lnk
%WINDIR%\flashplayer_y.lnk
%WINDIR%\flashplayer_z.lnk
%WINDIR%\flashplayercplapp.cpl
%WINDIR%\flashplayer_d.lnk
%WINDIR%\temp\1021010\....\temporaryfile

Присваивает атрибут 'скрытый' для следующих файлов

%WINDIR%\svchost.xml
%WINDIR%\spoolsrv.xml
%WINDIR%\<Имя файла>.exe
%WINDIR%\syswow64\oqumwuc.exe
%WINDIR%\flashplayer_e.lnk
%WINDIR%\flashplayer_f.lnk
%WINDIR%\flashplayer_g.lnk
%WINDIR%\flashplayer_h.lnk
%WINDIR%\flashplayer_i.lnk
%WINDIR%\flashplayer_j.lnk
%WINDIR%\flashplayer_k.lnk
%WINDIR%\flashplayer_l.lnk
%WINDIR%\flashplayer_m.lnk
%WINDIR%\flashplayer_n.lnk
%WINDIR%\flashplayer_o.lnk
%WINDIR%\flashplayer_p.lnk
%WINDIR%\flashplayer_q.lnk
%WINDIR%\flashplayer_r.lnk
%WINDIR%\flashplayer_s.lnk
%WINDIR%\flashplayer_t.lnk
%WINDIR%\flashplayer_u.lnk
%WINDIR%\flashplayer_v.lnk
%WINDIR%\flashplayer_w.lnk
%WINDIR%\flashplayer_x.lnk
%WINDIR%\flashplayer_y.lnk
%WINDIR%\flashplayer_z.lnk
%WINDIR%\flashplayercplapp.cpl
%WINDIR%\flashplayer_d.lnk
<Имя диска съемного носителя>:\flashplayer.dll

Удаляет следующие файлы

<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\tasks\opera scheduled autoupdate 1723415083
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (automated)
<SYSTEM32>\tasks\microsoft\windows\active directory rights management services client\ad rms rights policy template management (manual)
<SYSTEM32>\tasks\microsoft\windows\appid\policyconverter
<SYSTEM32>\tasks\microsoft\windows\appid\verifiedpublishercertstorecheck
<SYSTEM32>\tasks\microsoft\windows\application experience\aitagent
<SYSTEM32>\tasks\microsoft\windows\application experience\programdataupdater
<SYSTEM32>\tasks\microsoft\windows\autochk\proxy
<SYSTEM32>\tasks\microsoft\windows\bluetooth\uninstalldevicetask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\systemtask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask
<SYSTEM32>\tasks\microsoft\windows\certificateservicesclient\usertask-roam
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\consolidator
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\kernelceiptask
<SYSTEM32>\tasks\microsoft\windows\customer experience improvement program\usbceip
<SYSTEM32>\tasks\microsoft\windows\defrag\scheduleddefrag
<SYSTEM32>\tasks\microsoft\windows\diagnosis\scheduled
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticdatacollector
<SYSTEM32>\tasks\microsoft\windows\diskdiagnostic\microsoft-windows-diskdiagnosticresolver
<SYSTEM32>\tasks\microsoft\windows\location\notifications
<SYSTEM32>\tasks\microsoft\windows\maintenance\winsat
<SYSTEM32>\tasks\microsoft\windows\media center\activatewindowssearch
<SYSTEM32>\tasks\microsoft\windows\media center\configureinternettimeservice
<SYSTEM32>\tasks\microsoft\windows\media center\dispatchrecoverytasks
<SYSTEM32>\tasks\microsoft\windows\media center\ehdrminit
<SYSTEM32>\tasks\microsoft\windows\media center\installplayready
<SYSTEM32>\tasks\microsoft\windows\media center\mcupdate
<SYSTEM32>\tasks\microsoft\windows\media center\mediacenterrecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\objectstorerecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\ocuractivate
<SYSTEM32>\tasks\microsoft\windows\media center\ocurdiscovery
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscovery
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw1
<SYSTEM32>\tasks\microsoft\windows\media center\pbdadiscoveryw2
<SYSTEM32>\tasks\microsoft\windows\media center\periodicscanretry
<SYSTEM32>\tasks\microsoft\windows\media center\pvrrecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\pvrscheduletask
<SYSTEM32>\tasks\microsoft\windows\media center\recordingrestart
<SYSTEM32>\tasks\microsoft\windows\media center\registersearch
<SYSTEM32>\tasks\microsoft\windows\media center\reindexsearchroot
<SYSTEM32>\tasks\microsoft\windows\media center\sqlliterecoverytask
<SYSTEM32>\tasks\microsoft\windows\media center\updaterecordpath
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\corruptiondetector
<SYSTEM32>\tasks\microsoft\windows\memorydiagnostic\decompressionfailuredetector
<SYSTEM32>\tasks\microsoft\windows\mobilepc\hotstart
<SYSTEM32>\tasks\microsoft\windows\mui\lpremove
<SYSTEM32>\tasks\microsoft\windows\multimedia\systemsoundsservice
<SYSTEM32>\tasks\microsoft\windows\nettrace\gathernetworkinfo
<SYSTEM32>\tasks\microsoft\windows\offline files\background synchronization
<SYSTEM32>\tasks\microsoft\windows\offline files\logon synchronization
<SYSTEM32>\tasks\microsoft\windows\perftrack\backgroundconfigsurveyor
<SYSTEM32>\tasks\microsoft\windows\power efficiency diagnostics\analyzesystem
<SYSTEM32>\tasks\microsoft\windows\rac\ractask
<SYSTEM32>\tasks\microsoft\windows\ras\mobilitymanager
<SYSTEM32>\tasks\microsoft\windows\registry\regidlebackup
<SYSTEM32>\tasks\microsoft\windows\remoteassistance\remoteassistancetask
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrols
<SYSTEM32>\tasks\microsoft\windows\shell\windowsparentalcontrolsmigration
<SYSTEM32>\tasks\microsoft\windows\sideshow\autowake
<SYSTEM32>\tasks\microsoft\windows\sideshow\gadgetmanager
<SYSTEM32>\tasks\microsoft\windows\sideshow\sessionagent
<SYSTEM32>\tasks\microsoft\windows\sideshow\systemdataproviders
<SYSTEM32>\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask
<SYSTEM32>\tasks\microsoft\windows\systemrestore\sr
<SYSTEM32>\tasks\microsoft\windows\task manager\interactive
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict1
<SYSTEM32>\tasks\microsoft\windows\tcpip\ipaddressconflict2
<SYSTEM32>\tasks\microsoft\windows\textservicesframework\msctfmonitor
<SYSTEM32>\tasks\microsoft\windows\time synchronization\synchronizetime
<SYSTEM32>\tasks\microsoft\windows\upnp\upnphostconfig
<SYSTEM32>\tasks\microsoft\windows\user profile service\hiveuploadtask
<SYSTEM32>\tasks\microsoft\windows\wdi\resolutionhost
<SYSTEM32>\tasks\microsoft\windows\windows error reporting\queuereporting
<SYSTEM32>\tasks\microsoft\windows\windows filtering platform\bfeonservicestarttypechange
<SYSTEM32>\tasks\microsoft\windows\windows media sharing\updatelibrary
<SYSTEM32>\tasks\microsoft\windows\windowsbackup\confignotification
<SYSTEM32>\tasks\microsoft\windows\windowscolorsystem\calibration loader
<SYSTEM32>\tasks\microsoft\windows defender\mpidletask
<SYSTEM32>\tasks\mozilla\firefox default browser agent 308046b0af4a39cb
<SYSTEM32>\tasks\officesoftwareprotectionplatform\svcrestarttask

Перемещает следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\<Имя файла>.exe в %TEMP%\987969\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1020152\....\temporaryfile
<Имя диска съемного носителя>:\fuckoff.exe в %WINDIR%\temp\1021010\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1021915\....\temporaryfile
%WINDIR%\temp\vmnat.exe в %WINDIR%\syswow64\1022633.bak
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1023709\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1025472\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1027188\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1028920\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1030620\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1032336\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1034037\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1035753\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1037484\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1039200\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1040916\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1042617\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1044348\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1046080\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1047889\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1049683\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1051415\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1053131\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1054847\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1056563\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1058295\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1060026\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1061742\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1063458\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1065174\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1066890\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1068606\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1070322\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1072023\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1073754\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1075564\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1077264\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1078980\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1080712\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1082475\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1084284\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1086078\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1087857\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1089635\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1091382\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1093130\....\temporaryfile
%WINDIR%\temp\networks\config.json в %WINDIR%\temp\1094877\....\temporaryfile

Подменяет следующие файлы

%WINDIR%\temp\networks\config.json

Самоперемещается

из <Полный путь к файлу> в %TEMP%\979467\....\temporaryfile

Сетевая активность

Подключается к

'li##.#ingminer.club':8887
'20##.ip138.com':80
'ra#.##ngminer.club':5188

TCP

Запросы HTTP GET

http://li##.###gminer.club:8887/Cfg.ini via li##.#ingminer.club

UDP

DNS ASK li##.#ingminer.club
DNS ASK 20##.ip138.com
DNS ASK ra#.##ngminer.club
'localhost':60902
'localhost':51270

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\<Имя файла>.exe'
'%WINDIR%\temp\networks\taskmgr.exe'
'%WINDIR%\temp\vmnat.exe'
'<Имя диска съемного носителя>:\fuckoff.exe'
'%WINDIR%\syswow64\oqumwuc.exe'
'%WINDIR%\ime\<Имя файла>.exe'
'%WINDIR%\dllhost\migrationdump\dialers.exe' -iL %WINDIR%\dllhost\Struts045\Scan\IpDuan.txt -oJ %WINDIR%\dllhost\Struts045\Scan\Ips.txt --open --rate 4096 -p 88

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 6 >nul&&start %WINDIR%\<Имя файла>.exe (со скрытым окном)
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 6
'%WINDIR%\syswow64\cmd.exe' /c schtasks /delete /tn * /f (со скрытым окном)
'%WINDIR%\syswow64\schtasks.exe' /delete /tn * /f
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /sc minute /mo 1 /tn "Miscfost" /ru system /tr "cmd /c %WINDIR%\ime\<Имя файла>.exe" (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /sc minute /mo 1 /tn "Netframework" /ru system /tr "cmd /c echo Y|cacls %WINDIR%\<Имя файла>.exe /p everyone:F" (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c schtasks /create /sc minute /mo 1 /tn "Flash" /ru system /tr "cmd /c echo Y|cacls %WINDIR%\TEMP\Networks\taskmgr.exe /p everyone:F" (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c net stop SharedAccess (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c net stop MpsSvc (со скрытым окном)
'%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "Miscfost" /ru system /tr "cmd /c %WINDIR%\ime\<Имя файла>.exe"
'%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "Netframework" /ru system /tr "cmd /c echo Y|cacls %WINDIR%\<Имя файла>.exe /p everyone:F"
'%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "Flash" /ru system /tr "cmd /c echo Y|cacls %WINDIR%\TEMP\Networks\taskmgr.exe /p everyone:F"
'%WINDIR%\syswow64\cmd.exe' /c net stop LanmanServer (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c sc config LanmanServer start= disabled (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' config LanmanServer start= disabled
'%WINDIR%\syswow64\net1.exe' stop MpsSvc
'%WINDIR%\syswow64\net1.exe' stop SharedAccess
'%WINDIR%\syswow64\net1.exe' stop LanmanServer
'%WINDIR%\syswow64\cmd.exe' /c sc create npf binpath= system32\drivers\npf.sys type= kernel start= demand (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' create npf binpath= system32\drivers\npf.sys type= kernel start= demand
'<SYSTEM32>\cmd.exe' /c echo Y|cacls %WINDIR%\TEMP\Networks\taskmgr.exe /p everyone:F (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c echo Y|cacls %WINDIR%\<Имя файла>.exe /p everyone:F (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c %WINDIR%\ime\<Имя файла>.exe (со скрытым окном)
'<SYSTEM32>\cacls.exe' %WINDIR%\TEMP\Networks\taskmgr.exe /p everyone:F
'<SYSTEM32>\cmd.exe' /S /D /c" echo Y"
'<SYSTEM32>\cacls.exe' %WINDIR%\<Имя файла>.exe /p everyone:F
'%WINDIR%\temp\networks\taskmgr.exe' (со скрытым окном)
'<Имя диска съемного носителя>:\fuckoff.exe' (со скрытым окном)
'%WINDIR%\dllhost\migrationdump\dialers.exe' -iL %WINDIR%\dllhost\Struts045\Scan\IpDuan.txt -oJ %WINDIR%\dllhost\Struts045\Scan\Ips.txt --open --rate 4096 -p 88 (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней