Trojan.Siggen32.60794

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\SYSTEM\CurrentControlSet\Services\AXMZAOKB] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\AXMZAOKB] 'ImagePath' = '%ALLUSERSPROFILE%\svchost'
[HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\TEMP\psaqzhkauftv.sys'

Создает следующие сервисы

'AXMZAOKB' %ALLUSERSPROFILE%\svchost
'WinRing0_1_2_0' %WINDIR%\TEMP\psaqzhkauftv.sys

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Журнал событий Windows (Windows Event Logging)

добавляет исключения антивируса:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$p='%TEMP%\<Имя файла>.exe'; Add-MpPreference -ExclusionPath $p -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess $p -Error...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Внедряет код в

следующие системные процессы:

<SYSTEM32>\conhost.exe
%WINDIR%\explorer.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\<Имя файла>.exe
%TEMP%\_mei15482\vcruntime140.dll
%TEMP%\_mei15482\_bz2.pyd
%TEMP%\_mei15482\_ctypes.pyd
%TEMP%\_mei15482\_decimal.pyd
%TEMP%\_mei15482\_hashlib.pyd
%TEMP%\_mei15482\_lzma.pyd
%TEMP%\_mei15482\_socket.pyd
%TEMP%\_mei15482\_ssl.pyd
%TEMP%\_mei15482\_zstd.pyd
%TEMP%\_mei15482\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-fibers-l1-1-1.dll
%TEMP%\_mei15482\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei15482\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%TEMP%\_mei15482\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei15482\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei15482\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei15482\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-sysinfo-l1-2-0.dll
%TEMP%\_mei15482\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei15482\base_library.zip
%TEMP%\_mei15482\libcrypto-3.dll
%TEMP%\_mei15482\libffi-8.dll
%TEMP%\_mei15482\libssl-3.dll
%TEMP%\_mei15482\python314.dll
%TEMP%\_mei15482\select.pyd
%TEMP%\_mei15482\ucrtbase.dll
%TEMP%\_mei15482\unicodedata.pyd
%TEMP%\5iy8hmoc
%TEMP%\tmpy0sxg0cf\zenin dlc 0.38.2.exe
%TEMP%\tmpy0sxg0cf\mallema.exe
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3dff7f-fe0.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3dff82-6b0.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\log
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\cookies
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
%LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
%ALLUSERSPROFILE%\svchost
%WINDIR%\temp\__psscriptpolicytest_i1sca20e.bzq.ps1
%WINDIR%\temp\__psscriptpolicytest_bswg2ff3.jda.psm1
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-11-062.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-11-404.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-11-513.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-11-864.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-11-907.dump
%WINDIR%\temp\__psscriptpolicytest_eys1wugb.bhn.ps1
%WINDIR%\temp\__psscriptpolicytest_wzl1j0xa.few.psm1
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-12-139.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-12-170.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-12-419.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-12-953.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-13-260.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-13-379.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-14-052.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-14-166.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-14-277.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-14-905.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-14-952.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-15-004.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-15-036.dump
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-15-682.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-15-752.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-15-783.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-15-830.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-15-852.dump
%WINDIR%\temp\content\3768-2256-powershell.exe-21-27-15-930.dump
<SYSTEM32>\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
%WINDIR%\temp\psaqzhkauftv.sys
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
%LOCALAPPDATA%\microsoft\edge\user data\last browser
%LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log

Удаляет файлы, которые сам же создал

%TEMP%\5iy8hmoc
%TEMP%\tmpy0sxg0cf\zenin dlc 0.38.2.exe
%TEMP%\tmpy0sxg0cf\mallema.exe
%TEMP%\_mei15482\api-ms-win-core-console-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-fibers-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-fibers-l1-1-1.dll
%TEMP%\_mei15482\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei15482\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-kernel32-legacy-l1-1-1.dll
%TEMP%\_mei15482\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei15482\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei15482\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei15482\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-sysinfo-l1-2-0.dll
%TEMP%\_mei15482\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei15482\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei15482\base_library.zip
%TEMP%\_mei15482\libcrypto-3.dll
%TEMP%\_mei15482\libffi-8.dll
%TEMP%\_mei15482\libssl-3.dll
%TEMP%\_mei15482\python314.dll
%TEMP%\_mei15482\select.pyd
%TEMP%\_mei15482\ucrtbase.dll
%TEMP%\_mei15482\unicodedata.pyd
%TEMP%\_mei15482\vcruntime140.dll
%TEMP%\_mei15482\_bz2.pyd
%TEMP%\_mei15482\_ctypes.pyd
%TEMP%\_mei15482\_decimal.pyd
%TEMP%\_mei15482\_hashlib.pyd
%TEMP%\_mei15482\_lzma.pyd
%TEMP%\_mei15482\_socket.pyd
%TEMP%\_mei15482\_ssl.pyd
%TEMP%\_mei15482\_zstd.pyd
%TEMP%\<Имя файла>.exe
%LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
%WINDIR%\temp\__psscriptpolicytest_i1sca20e.bzq.ps1
%WINDIR%\temp\__psscriptpolicytest_bswg2ff3.jda.psm1
%WINDIR%\temp\__psscriptpolicytest_eys1wugb.bhn.ps1
%WINDIR%\temp\__psscriptpolicytest_wzl1j0xa.few.psm1
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3dff7f-fe0.pma
%LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-6a3dff82-6b0.pma
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001

Перемещает следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\current
%LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
%LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
%LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
%LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
%LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp в %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\edge\user data\last version
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
%LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
%LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
%LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
%TEMP%\.ses

Подменяет следующие файлы

%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG

Сетевая активность

Подключается к

'co####.edge.skype.com':443
't.#e':443
'po##.#ashvault.pro':443
'pa###bin.com':443

TCP

Другие

'co####.edge.skype.com':443
'po##.#ashvault.pro':443
'pa###bin.com':443

UDP

DNS ASK co####.edge.skype.com
DNS ASK t.#e
DNS ASK po##.#ashvault.pro
DNS ASK pa###bin.com

Другое

Ищет следующие окна

ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'

Создает и запускает на исполнение

'%TEMP%\<Имя файла>.exe'
'%TEMP%\tmpy0sxg0cf\zenin dlc 0.38.2.exe'
'%TEMP%\tmpy0sxg0cf\mallema.exe'
'%ALLUSERSPROFILE%\svchost'

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c start "" "https://t.me/seedcr4ck"
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument https://t.me/seedcr4ck
'%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate https://t.me/seedcr4ck (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c wusa /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop UsoSvc
'<SYSTEM32>\sc.exe' stop WaaSMedicSvc
'<SYSTEM32>\wusa.exe' /uninstall /kb:890830 /quiet /norestart
'<SYSTEM32>\sc.exe' stop wuauserv
'<SYSTEM32>\sc.exe' stop bits
'<SYSTEM32>\sc.exe' stop dosvc
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -hibernate-timeout-dc 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-ac 0
'<SYSTEM32>\powercfg.exe' /x -standby-timeout-dc 0
'<SYSTEM32>\sc.exe' delete "AXMZAOKB"
'<SYSTEM32>\sc.exe' create "AXMZAOKB" binpath= "%ALLUSERSPROFILE%\svchost" start= "auto"
'<SYSTEM32>\sc.exe' stop eventlog
'<SYSTEM32>\sc.exe' start "AXMZAOKB"
'<SYSTEM32>\conhost.exe'
'%WINDIR%\explorer.exe'
'%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,10764686716098410316,3457983612210242432,131072 --lang=en-US --service-sandbox-type=none --mojo-...
'%TEMP%\<Имя файла>.exe' (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней