Trojan.Siggen32.19700

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'OutlookManager' = '"%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\windowsupdaterecovery
<SYSTEM32>\tasks\outlook cli manager update

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msedge.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM brave.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM opera.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM operagx.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM waterfox.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM palemoon.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM seamonkey.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM iridium.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM chromium.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM yandex.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM slimjet.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM torch.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM maxthon.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM dragon.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM browser.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM chrome_pwa_launcher.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM chrome_proxy.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msedge_pwa_launcher.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msedge_proxy.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msedgewebview2.exe /T
'<SYSTEM32>\taskkill.exe' /F /IM msedgewebview.exe /T

Reads files which store third party applications passwords

%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\dashborder_96.bmp
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\ovp25012015.doc
%HOMEPATH%\desktop\sdszfo.docx
%HOMEPATH%\desktop\toolbar.bmp
%APPDATA%\thunderbird\profiles.ini
%LOCALAPPDATA%\microsoft\edge\user data\default\web data
%LOCALAPPDATA%\microsoft\edge\user data\default\login data

Modifies file system

Creates the following files

%LOCALAPPDATA%\outlook\outlookcli\dllmanager\dllmanager.exe
nul
%TEMP%\oreshki_debug.log
%TEMP%\oreshki_staging1916891394\staging\userinformation.txt
%TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\current
%TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\log
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\crash reports\installtime20210406220621
%TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\manifest-000001
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\b376zl1q.default\times.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\abook.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addonstartup.json.lz4
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addons.json
%TEMP%\oreshki_staging1916891394\staging\grabber\desktop.ini
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\blist.sqlite
%TEMP%\oreshki_staging1916891394\staging\grabber\camera roll\desktop.ini
%TEMP%\oreshki_staging1916891394\staging\grabber\telegram.lnk
%TEMP%\oreshki_staging1916891394\staging\grabber\adhd_and_obesity.docx
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cert9.db
%TEMP%\oreshki_staging1916891394\staging\grabber\dashborder_96.bmp
%TEMP%\oreshki_staging1916891394\staging\grabber\default.bmp
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\compatibility.ini
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cookies.sqlite
%TEMP%\oreshki_staging1916891394\staging\grabber\nwfieldnotes1966.docx
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4
%TEMP%\oreshki_staging1916891394\staging\grabber\ovp25012015.doc
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1d...
%TEMP%\oreshki_staging1916891394\staging\grabber\sdszfo.docx
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb0505...
%TEMP%\oreshki_staging1916891394\staging\grabber\toolbar.bmp
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d...
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\session-state.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\state.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\directorytree.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\enigmail.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extension-preferences.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extensions.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\favicons.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\formhistory.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\global-messages-db.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\history.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\key4.db
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\mailviews.dat
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\openpgp.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\permissions.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\pkcs11.txt
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\places.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\prefs.js
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\search.json.mozlz4
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\sessioncheckpoints.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\times.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\webappsstore.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\xulstore.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\installs.ini
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles.ini
%TEMP%\db_1768815933725448900.dat
%TEMP%\db_1768815933726610500.dat
%TEMP%\mrjtxhibf_user_log.zip

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\outlook\outlookcli\dllmanager\dllmanager.exe

Deletes following files that it created itself

%TEMP%\db_1768815933726610500.dat
%TEMP%\db_1768815933725448900.dat
%TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\current
%TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\log
%TEMP%\oreshki_staging1916891394\staging\crypto\extensions\chromium_local_storage_0\manifest-000001
%TEMP%\oreshki_staging1916891394\staging\grabber\adhd_and_obesity.docx
%TEMP%\oreshki_staging1916891394\staging\grabber\camera roll\desktop.ini
%TEMP%\oreshki_staging1916891394\staging\grabber\dashborder_96.bmp
%TEMP%\oreshki_staging1916891394\staging\grabber\default.bmp
%TEMP%\oreshki_staging1916891394\staging\grabber\desktop.ini
%TEMP%\oreshki_staging1916891394\staging\grabber\nwfieldnotes1966.docx
%TEMP%\oreshki_staging1916891394\staging\grabber\ovp25012015.doc
%TEMP%\oreshki_staging1916891394\staging\grabber\sdszfo.docx
%TEMP%\oreshki_staging1916891394\staging\grabber\telegram.lnk
%TEMP%\oreshki_staging1916891394\staging\grabber\toolbar.bmp
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\crash reports\installtime20210406220621
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\installs.ini
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\b376zl1q.default\times.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\abook.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addons.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\addonstartup.json.lz4
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\blist.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cert9.db
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\compatibility.ini
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\cookies.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\crashes\store.json.mozlz4
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186027.740f65ac-6c92-4860-a433-5c4acb1d...
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186364.ea3bd3ee-1392-479f-ab3c-37fb0505...
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\archived\2024-08\1723427186367.5fb935d8-7cd4-40ee-aeeb-ffd7037d...
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\session-state.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\datareporting\state.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\directorytree.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\enigmail.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extension-preferences.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\extensions.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\favicons.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\formhistory.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\global-messages-db.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\history.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\key4.db
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\mailviews.dat
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\openpgp.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\permissions.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\pkcs11.txt
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\places.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\prefs.js
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\5fb935d8-7cd4-40ee-aeeb-ffd7037d7c83
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\740f65ac-6c92-4860-a433-5c4acb1df428
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\saved-telemetry-pings\ea3bd3ee-1392-479f-ab3c-37fb050509c4
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\search.json.mozlz4
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\sessioncheckpoints.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\.metadata-v2
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\storage.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\times.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\webappsstore.sqlite
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles\gbmwccb6.default-release\xulstore.json
%TEMP%\oreshki_staging1916891394\staging\mail\client_profiles\thunderbird_profile\profiles.ini
%TEMP%\oreshki_staging1916891394\staging\userinformation.txt

Network activity

Connects to

'ap#.##legram.org':443
'ip##fo.io':443
'x1.#.lencr.org':80

TCP

HTTP GET requests

http://x1.#.lencr.org/

Other

'ap#.##legram.org':443
'ip##fo.io':443

UDP

DNS ASK ap#.##legram.org
DNS ASK ip##fo.io
DNS ASK x1.#.lencr.org

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%LOCALAPPDATA%\outlook\outlookcli\dllmanager\dllmanager.exe'

Executes the following

'<SYSTEM32>\schtasks.exe' /create /tn WindowsUpdateRecovery /tr <Full path to file> /sc onlogon /rl highest /f
'<SYSTEM32>\schtasks.exe' /Create /TN "Outlook CLI Manager Update" /TR \"%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe\" /SC ONLOGON /RL HIGHEST /F
'<SYSTEM32>\schtasks.exe' /create /tn WindowsUpdateRecovery /tr %LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe /sc onlogon /rl highest /f
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -ExpandProperty Name"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -ExpandProperty Name"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty SerialNumber"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_PhysicalMedia | Select-Object -ExpandProperty SerialNumber"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-CimInstance -ClassName Win32_OperatingSystem).Caption + ' ' + (Get-CimInstance -ClassName Win32_OperatingSystem).Version"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$os = Get-CimInstance Win32_OperatingSystem; $uptime = (Get-Date) - $os.LastBootUpTime; \"$($uptime.Days)d $($uptime.Hours)h $($uptime.Minutes)m $($uptime.Seconds)s\""
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_Battery | Select-Object -ExpandProperty EstimatedChargeRemaining"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-CimInstance Win32_ComputerSystem).Model"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-Service | Where-Object { $_.Name -match 'vmtools|vbox' }"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Get-Clipboard
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName FirewallProduct | Select-Object -ExpandProperty displayName"
'<SYSTEM32>\netsh.exe' advfirewall show allprofiles state
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State | Select-Object -First 20 | Format-Table -HideTableHeaders | Out-String"
'<SYSTEM32>\netsh.exe' wlan show profiles
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-Process | Select-Object Name, Id | Format-Table -HideTableHeaders | Out-String"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName | Whe...
'<SYSTEM32>\schtasks.exe' /create /tn WindowsUpdateRecovery /tr <Full path to file> /sc onlogon /rl highest /f' (with hidden window)
'<SYSTEM32>\schtasks.exe' /Create /TN "Outlook CLI Manager Update" /TR \"%LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe\" /SC ONLOGON /RL HIGHEST /F' (with hidden window)
'<SYSTEM32>\schtasks.exe' /create /tn WindowsUpdateRecovery /tr %LOCALAPPDATA%\Outlook\OutlookCLI\DllManager\dllmanager.exe /sc onlogon /rl highest /f' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_Processor | Select-Object -ExpandProperty Name"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_VideoController | Select-Object -ExpandProperty Name"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty SerialNumber"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_PhysicalMedia | Select-Object -ExpandProperty SerialNumber"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-CimInstance -ClassName Win32_OperatingSystem).Caption + ' ' + (Get-CimInstance -ClassName Win32_OperatingSystem).Version"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "$os = Get-CimInstance Win32_OperatingSystem; $uptime = (Get-Date) - $os.LastBootUpTime; \"$($uptime.Days)d $($uptime.Hours)h $($uptime.Minutes)m $($uptime.Seconds)s\""' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -ClassName Win32_Battery | Select-Object -ExpandProperty EstimatedChargeRemaining"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(Get-CimInstance Win32_ComputerSystem).Model"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-Service | Where-Object { $_.Name -match 'vmtools|vbox' }"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Get-Clipboard' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName FirewallProduct | Select-Object -ExpandProperty displayName"' (with hidden window)
'<SYSTEM32>\netsh.exe' advfirewall show allprofiles state' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State | Select-Object -First 20 | Format-Table -HideTableHeaders | Out-String"' (with hidden window)
'<SYSTEM32>\netsh.exe' wlan show profiles' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-Process | Select-Object Name, Id | Format-Table -HideTableHeaders | Out-String"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName | Whe...' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM chrome.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM msedge.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM brave.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM opera.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM operagx.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM vivaldi.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM waterfox.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM palemoon.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM seamonkey.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM iridium.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM chromium.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM yandex.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM slimjet.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM torch.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM maxthon.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM dragon.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM browser.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM chrome_pwa_launcher.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM chrome_proxy.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM msedge_pwa_launcher.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM msedge_proxy.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM msedgewebview2.exe /T' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /IM msedgewebview.exe /T' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial