Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OutlookManager' = '"%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe"'
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\windowsupdaterecovery
- <SYSTEM32>\tasks\outlook cli manager update
Вредоносные функции
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM msedge.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM brave.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM opera.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM operagx.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM waterfox.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM palemoon.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM seamonkey.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM iridium.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM chromium.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM yandex.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM slimjet.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM torch.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM maxthon.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM dragon.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM browser.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM chrome_pwa_launcher.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM chrome_proxy.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM msedge_pwa_launcher.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM msedge_proxy.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM msedgewebview2.exe /T
- '<SYSTEM32>\taskkill.exe' /F /IM msedgewebview.exe /T
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ovp25012015.doc
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\toolbar.bmp
- %APPDATA%\thunderbird\profiles.ini
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\login data
Изменения в файловой системе
Создает следующие файлы
- %LOCALAPPDATA%\outlook\outlookcli\dllmanager\dllmanager.exe
- nul
- %TEMP%\oreshki_debug.log
- %TEMP%\oreshki_staging1916891394\staging\userinformation.txt
- %TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\current
- %TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\log
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\crash reports\installtime20210406220621
- %TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\manifest-000001
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\b376zl1q.default\times.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\abook.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addonstartup.json.lz4
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addons.json
- %TEMP%\oreshki_staging1916891394\staging\grabber\desktop.ini
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\blist.sqlite
- %TEMP%\oreshki_staging1916891394\staging\grabber\camera roll\desktop.ini
- %TEMP%\oreshki_staging1916891394\staging\grabber\telegram.lnk
- %TEMP%\oreshki_staging1916891394\staging\grabber\adhd_and_obesity.docx
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cert9.db
- %TEMP%\oreshki_staging1916891394\staging\grabber\dashborder_96.bmp
- %TEMP%\oreshki_staging1916891394\staging\grabber\default.bmp
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\compatibility.ini
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cookies.sqlite
- %TEMP%\oreshki_staging1916891394\staging\grabber\nwfieldnotes1966.docx
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4
- %TEMP%\oreshki_staging1916891394\staging\grabber\ovp25012015.doc
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1d...
- %TEMP%\oreshki_staging1916891394\staging\grabber\sdszfo.docx
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb0505...
- %TEMP%\oreshki_staging1916891394\staging\grabber\toolbar.bmp
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d...
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\session-state.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\state.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\directorytree.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\enigmail.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extension-preferences.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extensions.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\favicons.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\formhistory.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\global-messages-db.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\history.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\key4.db
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\mailviews.dat
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\openpgp.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\permissions.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\pkcs11.txt
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\places.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\prefs.js
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\search.json.mozlz4
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\sessioncheckpoints.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\times.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\webappsstore.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\xulstore.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\installs.ini
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles.ini
- %TEMP%\db_1768815933725448900.dat
- %TEMP%\db_1768815933726610500.dat
- %TEMP%\mrjtxhibf_user_log.zip
Присваивает атрибут 'скрытый' для следующих файлов
- %LOCALAPPDATA%\outlook\outlookcli\dllmanager\dllmanager.exe
Удаляет файлы, которые сам же создал
- %TEMP%\db_1768815933726610500.dat
- %TEMP%\db_1768815933725448900.dat
- %TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\current
- %TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\log
- %TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\manifest-000001
- %TEMP%\oreshki_staging1916891394\staging\grabber\adhd_and_obesity.docx
- %TEMP%\oreshki_staging1916891394\staging\grabber\camera roll\desktop.ini
- %TEMP%\oreshki_staging1916891394\staging\grabber\dashborder_96.bmp
- %TEMP%\oreshki_staging1916891394\staging\grabber\default.bmp
- %TEMP%\oreshki_staging1916891394\staging\grabber\desktop.ini
- %TEMP%\oreshki_staging1916891394\staging\grabber\nwfieldnotes1966.docx
- %TEMP%\oreshki_staging1916891394\staging\grabber\ovp25012015.doc
- %TEMP%\oreshki_staging1916891394\staging\grabber\sdszfo.docx
- %TEMP%\oreshki_staging1916891394\staging\grabber\telegram.lnk
- %TEMP%\oreshki_staging1916891394\staging\grabber\toolbar.bmp
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\crash reports\installtime20210406220621
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\installs.ini
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\b376zl1q.default\times.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\abook.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addons.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addonstartup.json.lz4
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\blist.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cert9.db
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\compatibility.ini
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cookies.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1d...
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb0505...
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d...
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\session-state.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\state.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\directorytree.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\enigmail.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extension-preferences.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extensions.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\favicons.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\formhistory.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\global-messages-db.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\history.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\key4.db
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\mailviews.dat
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\openpgp.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\permissions.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\pkcs11.txt
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\places.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\prefs.js
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\search.json.mozlz4
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\sessioncheckpoints.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\times.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\webappsstore.sqlite
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\xulstore.json
- %TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles.ini
- %TEMP%\oreshki_staging1916891394\staging\userinformation.txt
Сетевая активность
Подключается к
- 'ap#.##legram.org':443
- 'ip##fo.io':443
- 'x1.#.lencr.org':80
TCP
Запросы HTTP GET
- http://x1.#.lencr.org/
Другие
- 'ap#.##legram.org':443
- 'ip##fo.io':443
UDP
- DNS ASK ap#.##legram.org
- DNS ASK ip##fo.io
- DNS ASK x1.#.lencr.org
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%LOCALAPPDATA%\outlook\outlookcli\dllmanager\dllmanager.exe'
Запускает на исполнение
- '<SYSTEM32>\schtasks.exe' /create /tn WindowsUpdateRecovery /tr <Полный путь к файлу> /sc onlogon /rl highest /f (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /Create /TN "Outlook CLI Manager Update" /TR \"%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe\" /SC ONLOGON /RL HIGHEST /F (со скрытым окном)
- '<SYSTEM32>\schtasks.exe' /create /tn WindowsUpdateRecovery /tr %LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe /sc onlogon /rl highest /f (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -ExpandProperty Name" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -ExpandProperty Name" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty SerialNumber" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_PhysicalMedia | Select-Object -ExpandProperty SerialNumber" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-CimInstance -ClassName Win32_OperatingSystem).Caption + ' ' + (Get-CimInstance -ClassName Win32_OperatingSystem).Version" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$os = Get-CimInstance Win32_OperatingSystem; $uptime = (Get-Date) - $os.LastBootUpTime; \"$($uptime.Days)d $($uptime.Hours)h $($uptime.Minutes)m $($uptime.Seconds)s\"" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_Battery | Select-Object -ExpandProperty EstimatedChargeRemaining" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-CimInstance Win32_ComputerSystem).Model" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-Service | Where-Object { $_.Name -match 'vmtools|vbox' }" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Get-Clipboard (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName FirewallProduct | Select-Object -ExpandProperty displayName" (со скрытым окном)
- '<SYSTEM32>\netsh.exe' advfirewall show allprofiles state (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State | Select-Object -First 20 | Format-Table -HideTableHeaders | Out-String" (со скрытым окном)
- '<SYSTEM32>\netsh.exe' wlan show profiles (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-Process | Select-Object Name, Id | Format-Table -HideTableHeaders | Out-String" (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName | Whe... (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM msedge.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM brave.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM opera.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM operagx.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM waterfox.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM palemoon.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM seamonkey.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM iridium.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM chromium.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM yandex.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM slimjet.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM torch.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM maxthon.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM dragon.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM browser.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM chrome_pwa_launcher.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM chrome_proxy.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM msedge_pwa_launcher.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM msedge_proxy.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM msedgewebview2.exe /T (со скрытым окном)
- '<SYSTEM32>\taskkill.exe' /F /IM msedgewebview.exe /T (со скрытым окном)
