BackDoor.Siggen2.4541

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\firefoxf
<SYSTEM32>\tasks\registry
<SYSTEM32>\tasks\registryr
<SYSTEM32>\tasks\searchfilterhost
<SYSTEM32>\tasks\searchfilterhosts
<SYSTEM32>\tasks\apphostregistrationverifier
<SYSTEM32>\tasks\apphostregistrationverifiera
<SYSTEM32>\tasks\system
<SYSTEM32>\tasks\systems
<SYSTEM32>\tasks\searchprotocolhost
<SYSTEM32>\tasks\searchprotocolhosts
<SYSTEM32>\tasks\backgroundtaskhost
<SYSTEM32>\tasks\backgroundtaskhostb
<SYSTEM32>\tasks\lsass
<SYSTEM32>\tasks\lsassl
<SYSTEM32>\tasks\securityhealthservice
<SYSTEM32>\tasks\securityhealthservices
<SYSTEM32>\tasks\winlogon
<SYSTEM32>\tasks\winlogonw
<SYSTEM32>\tasks\idle
<SYSTEM32>\tasks\idlei
<SYSTEM32>\tasks\startmenuexperiencehost
<SYSTEM32>\tasks\startmenuexperiencehosts
<SYSTEM32>\tasks\smss
<SYSTEM32>\tasks\smsss
<SYSTEM32>\tasks\runtimebroker
<SYSTEM32>\tasks\runtimebrokerr
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\wudfhostw
<SYSTEM32>\tasks\wudfhost

Malicious functions

Launches a large number of processes

Modifies file system

Creates the following files

%TEMP%\content\5084-3204-<File name>.exe-19-50-12-900.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-25-119.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-24-431.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-23-817.dump
%WINDIR%\installer\{90160000-001f-0c0a-0000-0000000ff1ce}\0fc223bdacedc3
%WINDIR%\installer\{90160000-001f-0c0a-0000-0000000ff1ce}\firefox.exe
%TEMP%\content\4348-5032-<File name>.exe-19-51-22-444.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-21-348.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-21-019.dump
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\0b42e80b250186
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\apphostregistrationverifier.exe
%TEMP%\content\4348-5032-<File name>.exe-19-51-19-827.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-18-818.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-17-872.dump
%WINDIR%\branding\shellbrd\0fc223bdacedc3
%WINDIR%\branding\shellbrd\firefox.exe
%TEMP%\content\4348-5032-<File name>.exe-19-51-16-403.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-15-161.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-14-549.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-12-676.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-12-537.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-11-356.dump
<Current directory>\27d1bcfc3c54e0
<Current directory>\system.exe
%TEMP%\content\4348-5032-<File name>.exe-19-51-10-492.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-09-492.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-08-410.dump
%ProgramFiles(x86)%\mozilla firefox\e8aa3d0a77e909
%ALLUSERSPROFILE%\regid.1991-06.com.microsoft\winlogon.exe
%TEMP%\content\4348-5032-<File name>.exe-19-51-25-754.dump
%TEMP%\content\5036-1928-registry.exe-19-51-41-690.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-26-363.dump
%TEMP%\content\5036-3768-registry.exe-19-51-40-643.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-37-710.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-36-700.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-36-249.dump
%ProgramFiles(x86)%\microsoft sql server\110\shared\9e8d7a4ca61bd9
%ProgramFiles(x86)%\microsoft sql server\110\shared\runtimebroker.exe
%TEMP%\content\4348-5032-<File name>.exe-19-51-35-259.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-34-660.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-34-149.dump
C:\recovery\windowsre\480b7989c529f6
C:\recovery\windowsre\wudfhost.exe
%TEMP%\content\4348-5032-<File name>.exe-19-51-33-133.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-32-501.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-32-008.dump
%ProgramFiles(x86)%\opera\36.0.2130.46\resources\standard_themes\ee2ad38f3d4382
%ProgramFiles(x86)%\opera\36.0.2130.46\resources\standard_themes\registry.exe
%TEMP%\content\4348-5032-<File name>.exe-19-51-31-169.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-30-535.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-30-044.dump
%ProgramFiles%\windows nt\accessories\en-us\617403385cfa57
%ProgramFiles%\windows nt\accessories\en-us\searchfilterhost.exe
%TEMP%\content\4348-5032-<File name>.exe-19-51-29-298.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-28-749.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-27-610.dump
C:\recovery\windowsre\6203df4a6bafc7
C:\recovery\windowsre\lsass.exe
%TEMP%\content\4348-5032-<File name>.exe-19-51-26-473.dump
%ProgramFiles(x86)%\mozilla firefox\searchprotocolhost.exe
%ALLUSERSPROFILE%\regid.1991-06.com.microsoft\cc11b995f2a76d
%TEMP%\content\4348-5032-<File name>.exe-19-51-07-264.dump
C:\kms\0fc223bdacedc3
%TEMP%\content\5084-2840-<File name>.exe-19-50-41-523.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-40-163.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-39-189.dump
C:\kms\9e8d7a4ca61bd9
C:\kms\runtimebroker.exe
%TEMP%\content\5084-2840-<File name>.exe-19-50-36-840.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-35-632.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-34-216.dump
%ProgramFiles(x86)%\windows defender.bak\en-us\55b276f4edf653
%ProgramFiles(x86)%\windows defender.bak\en-us\startmenuexperiencehost.exe
%TEMP%\content\5084-2840-<File name>.exe-19-50-31-868.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-30-834.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-28-953.dump
%ALLUSERSPROFILE%\microsoft\speech_onecore\69ddcba757bf72
%ALLUSERSPROFILE%\microsoft\speech_onecore\smss.exe
%TEMP%\content\5084-2840-<File name>.exe-19-50-27-523.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-26-592.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-25-905.dump
C:\users\public\pictures\9e8d7a4ca61bd9
C:\users\public\pictures\runtimebroker.exe
%TEMP%\content\5084-2840-<File name>.exe-19-50-24-058.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-23-211.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-19-697.dump
<Current directory>\0fc223bdacedc3
<Current directory>\firefox.exe
%TEMP%\content\5084-3116-<File name>.exe-19-50-17-090.dump
%TEMP%\content\5084-3116-<File name>.exe-19-50-17-012.dump
C:\kms\firefox.exe
%TEMP%\content\5084-2840-<File name>.exe-19-50-43-266.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-05-400.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-44-666.dump
C:\kms\eddb19405b7ce1
C:\kms\backgroundtaskhost.exe
%TEMP%\content\4348-5032-<File name>.exe-19-51-04-554.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-04-530.dump
%TEMP%\content\4348-3480-<File name>.exe-19-51-03-208.dump
%LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
%TEMP%\content\5084-2840-<File name>.exe-19-50-59-106.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-58-209.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-57-451.dump
%ProgramFiles(x86)%\windows photo viewer\en-us\6203df4a6bafc7
%ProgramFiles(x86)%\windows photo viewer\en-us\lsass.exe
%TEMP%\content\5084-2840-<File name>.exe-19-50-56-282.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-55-336.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-54-401.dump
<Current directory>\926e3e4b62361b
<Current directory>\securityhealthservice.exe
%TEMP%\content\5084-2840-<File name>.exe-19-50-53-193.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-52-037.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-50-799.dump
C:\users\default user\cc11b995f2a76d
C:\users\default user\winlogon.exe
%TEMP%\content\5084-2840-<File name>.exe-19-50-48-839.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-47-576.dump
%TEMP%\content\5084-2840-<File name>.exe-19-50-47-254.dump
%ProgramFiles(x86)%\microsoft office\clipart\publisher\6ccacd8608530f
%ProgramFiles(x86)%\microsoft office\clipart\publisher\idle.exe
%TEMP%\content\5084-2840-<File name>.exe-19-50-45-742.dump
%TEMP%\content\4348-5032-<File name>.exe-19-51-06-269.dump
%TEMP%\content\5036-1928-registry.exe-19-51-41-715.dump

Modifies the following files

%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000

Network activity

Connects to

'wi########siwi.kriptonhosting.store':80

TCP

HTTP GET requests

http://wi########siwi.kriptonhosting.store/dokatkapidr.php?aP####################################################################################################################################...
http://wi########siwi.kriptonhosting.store/dokatkapidr.php?Vv####################################################################################################################################...

UDP

DNS ASK wi########siwi.kriptonhosting.store

Miscellaneous

Searches for the following windows

ClassName: 'OleMainThreadWndClass' WindowName: ''

Creates and executes the following

'%ProgramFiles(x86)%\opera\36.0.2130.46\resources\standard_themes\registry.exe'
'<Full path to file>' ' (with hidden window)
'%ProgramFiles(x86)%\opera\36.0.2130.46\resources\standard_themes\registry.exe' ' (with hidden window)

Restarts the analyzed sample

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'<Current directory>\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 8 /tr "'%WINDIR%\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "AppHostRegistrationVerifierA" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\AppHostRegistrationVerifier.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "AppHostRegistrationVerifier" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\AppHostRegistrationVerifier.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "AppHostRegistrationVerifierA" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90160000-0090-0409-0000-0000000FF1CE}-C\AppHostRegistrationVerifier.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'%WINDIR%\Branding\shellbrd\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 8 /tr "'%WINDIR%\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%WINDIR%\Branding\shellbrd\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'C:\kms\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'C:\kms\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'<Current directory>\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "System" /sc ONLOGON /tr "'<Current directory>\System.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'<Current directory>\System.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "SearchProtocolHostS" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Mozilla Firefox\SearchProtocolHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 8 /tr "'%WINDIR%\Branding\shellbrd\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'%ALLUSERSPROFILE%\regid.1991-06.com.microsoft\winlogon.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Microsoft SQL Server\110\Shared\RuntimeBroker.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "WUDFHostW" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Opera\36.0.2130.46\resources\standard_themes\Registry.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Registry" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Opera\36.0.2130.46\resources\standard_themes\Registry.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SearchProtocolHost" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Mozilla Firefox\SearchProtocolHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'%WINDIR%\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SearchFilterHost" /sc ONLOGON /tr "'%ProgramFiles%\Windows NT\Accessories\en-US\SearchFilterHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SearchFilterHostS" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\Windows NT\Accessories\en-US\SearchFilterHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'%ALLUSERSPROFILE%\regid.1991-06.com.microsoft\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SearchFilterHostS" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\Windows NT\Accessories\en-US\SearchFilterHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\regid.1991-06.com.microsoft\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SearchProtocolHostS" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Mozilla Firefox\SearchProtocolHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\kms\backgroundTaskHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\kms\backgroundTaskHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Microsoft\Speech_OneCore\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'<Current directory>\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 9 /tr "'<Current directory>\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBroker" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft SQL Server\110\Shared\RuntimeBroker.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 12 /tr "'%ALLUSERSPROFILE%\Microsoft\Speech_OneCore\smss.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\kms\RuntimeBroker.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'%ProgramFiles(x86)%\Windows Defender.bak\en-US\StartMenuExperienceHost.exe'" /f
'<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
'<SYSTEM32>\schtasks.exe' /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Defender.bak\en-US\StartMenuExperienceHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Windows Defender.bak\en-US\StartMenuExperienceHost.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\kms\RuntimeBroker.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 6 /tr "'%ALLUSERSPROFILE%\Microsoft\Speech_OneCore\smss.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Opera\36.0.2130.46\resources\standard_themes\Registry.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'C:\kms\firefox.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Microsoft Office\CLIPART\Publisher\Idle.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefox" /sc ONLOGON /tr "'C:\kms\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\kms\backgroundTaskHost.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\lsass.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'%ProgramFiles(x86)%\Windows Photo Viewer\en-US\lsass.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 12 /tr "'<Current directory>\SecurityHealthService.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "firefoxf" /sc MINUTE /mo 9 /tr "'C:\kms\firefox.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SecurityHealthService" /sc ONLOGON /tr "'<Current directory>\SecurityHealthService.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\kms\RuntimeBroker.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\winlogon.exe'" /f
'<SYSTEM32>\searchfilterhost.exe' 0 772 776 784 8192 780
'<SYSTEM32>\schtasks.exe' /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'%ProgramFiles(x86)%\Microsoft Office\CLIPART\Publisher\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Office\CLIPART\Publisher\Idle.exe'" /rl HIGHEST /f
'<SYSTEM32>\schtasks.exe' /create /tn "SecurityHealthServiceS" /sc MINUTE /mo 5 /tr "'<Current directory>\SecurityHealthService.exe'" /f
'<SYSTEM32>\schtasks.exe' /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'%ProgramFiles(x86)%\Microsoft SQL Server\110\Shared\RuntimeBroker.exe'" /rl HIGHEST /f

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней