Trojan.Encoder.37855

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Creates the following files on removable media

<Drive name for removable media>:\readme.txt

Malicious functions

To complicate detection of its presence in the operating system,

deletes volume shadow copies.

Executes the following

'%WINDIR%\syswow64\net.exe' stop MSDTC
'%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT
'%WINDIR%\syswow64\net.exe' stop MSSQLSERVER
'%WINDIR%\syswow64\net.exe' stop vds
'%WINDIR%\syswow64\net.exe' stop SQLWriter
'%WINDIR%\syswow64\net.exe' stop SQLBrowser
'%WINDIR%\syswow64\net.exe' stop MSSQL$CONTOSO1
'%WINDIR%\syswow64\netsh.exe' advfirewall set currentprofile state off
'%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable

Reads files which store third party applications passwords

%HOMEPATH%\desktop\64bit_notes.htm
%HOMEPATH%\desktop\trivial-merge.html
%HOMEPATH%\desktop\tileimage.bmp
%APPDATA%\thunderbird\profiles.ini
%HOMEPATH%\desktop\split.avi
%HOMEPATH%\desktop\sdksampleprivdeveloper.cer
%HOMEPATH%\desktop\sdkfailsafeemulator.cer
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\join.avi
%HOMEPATH%\desktop\ituneshelpunavailable.html
%HOMEPATH%\desktop\howto-index.html
%HOMEPATH%\desktop\holycrosschurchinstructions.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\february_catalogue__2015.doc
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\about.htm
%APPDATA%\mozilla\firefox\profiles.ini
%HOMEPATH%\desktop\weeklysheet1215.doc

Modifies file system

Creates the following files

<Current directory>\output.bmp
%APPDATA%\telegram desktop\readme.txt
%APPDATA%\thunderbird\readme.txt
%APPDATA%\mozilla\firefox\readme.txt
%TEMP%\readme.txt
%LOCALAPPDATA%low\oracle\java\au\readme.txt
%APPDATA%\thunderbird\crash reports\readme.txt
%LOCALAPPDATA%low\sun\java\deployment\readme.txt
%HOMEPATH%\documents\readme.txt
%LOCALAPPDATA%low\sun\java\jre1.8.0_45_x64\readme.txt
%APPDATA%\mozilla\firefox\crash reports\readme.txt
%LOCALAPPDATA%\google\chrome\user data\readme.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\readme.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\extensions\readme.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\readme.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\pepperflash\readme.txt
%HOMEPATH%\searches\readme.txt
%HOMEPATH%\favorites\msn websites\readme.txt
%HOMEPATH%\favorites\links for united states\readme.txt
%HOMEPATH%\pictures\readme.txt
%LOCALAPPDATA%\gdipfontcachev1.dat
C:\readme.txt
C:\kms\readme.txt
<Current directory>\readme.txt
C:\users\readme.txt
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\readme.txt
%HOMEPATH%\readme.txt
%HOMEPATH%\contacts\readme.txt
%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\readme.txt
%LOCALAPPDATA%\google\chrome\application\readme.txt
%HOMEPATH%\desktop\readme.txt
%HOMEPATH%\favorites\readme.txt
%HOMEPATH%\music\readme.txt
%HOMEPATH%\links\readme.txt
%HOMEPATH%\favorites\links\readme.txt
%LOCALAPPDATA%\readme.txt
%HOMEPATH%\saved games\readme.txt
%HOMEPATH%\videos\readme.txt
D:\readme.txt
%HOMEPATH%\downloads\readme.txt
%TEMP%\opera installer\readme.txt

Deletes the following files

<Current directory>\output.bmp

Moves the following files

from %LOCALAPPDATA%\gdipfontcachev1.dat to %LOCALAPPDATA%\quickly@onionmail.orggdipfontcachev1.dat
from %TEMP%\jawshtml.html to %TEMP%\quickly@onionmail.orgjawshtml.html
from %TEMP%\javadeployreg.log to %TEMP%\quickly@onionmail.orgjavadeployreg.log
from %TEMP%\dd_wcf_ca_smci_20230531_225945_094.txt to %TEMP%\quickly@onionmail.orgdd_wcf_ca_smci_20230531_225945_094.txt
from %TEMP%\dd_wcf_ca_smci_20230531_225943_157.txt to %TEMP%\quickly@onionmail.orgdd_wcf_ca_smci_20230531_225943_157.txt
from %TEMP%\dd_vcredist_x86_20220928170410.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170410.log
from %TEMP%\dd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170335_002_vcruntimeadditional_x86.log
from %TEMP%\dd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170335_001_vcruntimeminimum_x86.log
from %TEMP%\dd_vcredist_x86_20220928170335.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170335.log
from %TEMP%\dd_vcredist_x86_20220928170221.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170221.log
from %TEMP%\dd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170143_002_vcruntimeadditional_x86.log
from %TEMP%\dd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170143_001_vcruntimeminimum_x86.log
from %TEMP%\dd_vcredist_x86_20220928170143.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928170143.log
from %TEMP%\dd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165916_001_vcruntimeadditional_x86.log
from %TEMP%\dd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165916_000_vcruntimeminimum_x86.log
from %TEMP%\dd_vcredist_x86_20220928165916.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165916.log
from %TEMP%\dd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165710_1_vcruntimeadditional_x86.log
from %TEMP%\dd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165710_0_vcruntimeminimum_x86.log
from %TEMP%\jusched.log to %TEMP%\quickly@onionmail.orgjusched.log
from %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt to %TEMP%\quickly@onionmail.orgmicrosoft .net framework 4 setup_20230531_155457219-msi_netfx_extended_x64.msi.txt
from %TEMP%\wallpaper.bmp to %TEMP%\quickly@onionmail.orgwallpaper.bmp
from %TEMP%\microsoft .net framework 4 setup_20230531_155457219.html to %TEMP%\quickly@onionmail.orgmicrosoft .net framework 4 setup_20230531_155457219.html
from %TEMP%\user.bmp to %TEMP%\quickly@onionmail.orguser.bmp
from %TEMP%\tmpaddon to %TEMP%\quickly@onionmail.orgtmpaddon
from %TEMP%\setupexe(20220928171621f0c).log to %TEMP%\quickly@onionmail.orgsetupexe(20220928171621f0c).log
from %TEMP%\rgi5839.tmp-tmp to %TEMP%\quickly@onionmail.orgrgi5839.tmp-tmp
from %TEMP%\rgi5839.tmp to %TEMP%\quickly@onionmail.orgrgi5839.tmp
from %TEMP%\readme.txt to %TEMP%\quickly@onionmail.orgreadme.txt
from %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt to %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\quickly@onionmail.orgreadme.txt
from %TEMP%\ose00000.exe to %TEMP%\quickly@onionmail.orgose00000.exe
from %TEMP%\opera_crashreporter.log to %TEMP%\quickly@onionmail.orgopera_crashreporter.log
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913.html to %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x86 redistributable setup_20220928_165304913.html
from %TEMP%\microsoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt to %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x86 redistributable setup_20220928_165304913-msi_vc_red.msi.txt
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616.html to %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20220928_165235616.html
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt to %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20220928_165235616-msi_vc_red.msi.txt
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616.html to %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20220928_164850616.html
from %TEMP%\microsoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt to %TEMP%\quickly@onionmail.orgmicrosoft visual c++ 2010 x64 redistributable setup_20220928_164850616-msi_vc_red.msi.txt
from %TEMP%\microsoft .net framework 4.8 setup_20230531_160116688.html to %TEMP%\quickly@onionmail.orgmicrosoft .net framework 4.8 setup_20230531_160116688.html
from %TEMP%\microsoft .net framework 4.8 setup_20220928_170905091.html to %TEMP%\quickly@onionmail.orgmicrosoft .net framework 4.8 setup_20220928_170905091.html
from %TEMP%\dd_vcredist_x86_20220928165710.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165710.log
from %TEMP%\microsoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt to %TEMP%\quickly@onionmail.orgmicrosoft .net framework 4 setup_20230531_155457219-msi_netfx_core_x64.msi.txt
from %TEMP%\dd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165536_1_vcruntimeadditional_x86.log
from %TEMP%\dd_setuputility.txt to %TEMP%\quickly@onionmail.orgdd_setuputility.txt
from %TEMP%\dd_dotnetfx40_full_x86_x64_decompression_log.txt to %TEMP%\quickly@onionmail.orgdd_dotnetfx40_full_x86_x64_decompression_log.txt
from %TEMP%\chrome_installer.log to %TEMP%\quickly@onionmail.orgchrome_installer.log
from %TEMP%\aspnetsetup_00001.log to %TEMP%\quickly@onionmail.orgaspnetsetup_00001.log
from %TEMP%\aspnetsetup_00000.log to %TEMP%\quickly@onionmail.orgaspnetsetup_00000.log
from %APPDATA%\telegram desktop\updater.exe to %APPDATA%\telegram desktop\quickly@onionmail.orgupdater.exe
from %TEMP%\armui.ini to %TEMP%\quickly@onionmail.orgarmui.ini
from %APPDATA%\telegram desktop\unins000.exe to %APPDATA%\telegram desktop\quickly@onionmail.orgunins000.exe
from %APPDATA%\mozilla\firefox\crash reports\installtime20200708170202 to %APPDATA%\mozilla\firefox\crash reports\quickly@onionmail.orginstalltime20200708170202
from %TEMP%\adobesfx.log to %TEMP%\quickly@onionmail.orgadobesfx.log
from %APPDATA%\telegram desktop\unins000.dat to %APPDATA%\telegram desktop\quickly@onionmail.orgunins000.dat
from %TEMP%\adobearm.log to %TEMP%\quickly@onionmail.orgadobearm.log
from %APPDATA%\thunderbird\crash reports\installtime20210406220621 to %APPDATA%\thunderbird\crash reports\quickly@onionmail.orginstalltime20210406220621
from %APPDATA%\mozilla\firefox\profiles.ini to %APPDATA%\mozilla\firefox\quickly@onionmail.orgprofiles.ini
from %APPDATA%\mozilla\firefox\installs.ini to %APPDATA%\mozilla\firefox\quickly@onionmail.orginstalls.ini
from %APPDATA%\thunderbird\profiles.ini to %APPDATA%\thunderbird\quickly@onionmail.orgprofiles.ini
from %APPDATA%\thunderbird\installs.ini to %APPDATA%\thunderbird\quickly@onionmail.orginstalls.ini
from %APPDATA%\telegram desktop\telegram.exe to %APPDATA%\telegram desktop\quickly@onionmail.orgtelegram.exe
from %TEMP%\dd_ndp48-x86-x64-allos-enu_decompression_log.txt to %TEMP%\quickly@onionmail.orgdd_ndp48-x86-x64-allos-enu_decompression_log.txt
from %TEMP%\dd_vcredistmsi7a3c.txt to %TEMP%\quickly@onionmail.orgdd_vcredistmsi7a3c.txt
from %TEMP%\dd_vcredist_x86_20220928165536.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165536.log
from %TEMP%\dd_vcredistui7a3c.txt to %TEMP%\quickly@onionmail.orgdd_vcredistui7a3c.txt
from %TEMP%\dd_vcredist_amd64_20220928170328.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928170328.log
from %TEMP%\dd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928170250_002_vcruntimeadditional_x64.log
from %TEMP%\dd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928170250_001_vcruntimeminimum_x64.log
from %TEMP%\dd_vcredist_amd64_20220928170250.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928170250.log
from %TEMP%\dd_vcredist_amd64_20220928170114.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928170114.log
from %TEMP%\dd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165956_002_vcruntimeadditional_x64.log
from %TEMP%\dd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165956_001_vcruntimeminimum_x64.log
from %TEMP%\dd_vcredist_amd64_20220928165956.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165956.log
from %TEMP%\dd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165746_001_vcruntimeadditional_x64.log
from %TEMP%\dd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165746_000_vcruntimeminimum_x64.log
from %TEMP%\dd_vcredist_amd64_20220928165746.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165746.log
from %TEMP%\dd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165628_1_vcruntimeadditional_x64.log
from %TEMP%\dd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165628_0_vcruntimeminimum_x64.log
from %TEMP%\dd_vcredist_amd64_20220928165628.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165628.log
from %TEMP%\dd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165349_1_vcruntimeadditional_x64.log
from %TEMP%\dd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165349_0_vcruntimeminimum_x64.log
from %TEMP%\dd_vcredist_amd64_20220928165349.log to %TEMP%\quickly@onionmail.orgdd_vcredist_amd64_20220928165349.log
from %TEMP%\dd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log to %TEMP%\quickly@onionmail.orgdd_vcredist_x86_20220928165536_0_vcruntimeminimum_x86.log
from %TEMP%\wmsetup.log to %TEMP%\quickly@onionmail.orgwmsetup.log

Modifies the following files

D:\install.log
%HOMEPATH%\favorites\links\desktop.ini
%HOMEPATH%\links\desktop.ini
%HOMEPATH%\music\desktop.ini
%HOMEPATH%\favorites\desktop.ini
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\winre.wim
%HOMEPATH%\downloads\desktop.ini
%HOMEPATH%\contacts\user.contact
%HOMEPATH%\desktop\google chrome.lnk
%HOMEPATH%\desktop\desktop.ini
%HOMEPATH%\desktop\delete.avi
%HOMEPATH%\desktop\default.bmp
%HOMEPATH%\desktop\dashborder_192.bmp
%HOMEPATH%\desktop\dashborder_120.bmp
%HOMEPATH%\desktop\correct.avi
%HOMEPATH%\desktop\archer.avi
%HOMEPATH%\desktop\api-hashmap.html
%HOMEPATH%\documents\desktop.ini
%HOMEPATH%\desktop\alert.htm
%HOMEPATH%\desktop\advice_process.htm
%HOMEPATH%\desktop\about.html
%HOMEPATH%\desktop\about.htm
%HOMEPATH%\desktop\64bit_notes.htm
C:\recovery\fc7d0508-3f8d-11ed-bf82-c9aa0b5639b5\boot.sdi
%HOMEPATH%\contacts\desktop.ini
C:\users\desktop.ini
C:\kms\kms_vl_all_aio_debug.log
C:\kms\kms_vl_all_aio.cmd
%HOMEPATH%\saved games\desktop.ini
%HOMEPATH%\videos\desktop.ini

Modifies multiple files.

Substitutes the following files

%LOCALAPPDATA%\google\chrome\application\42.0.2311.135\locales\readme.txt
%TEMP%\readme.txt

Moves itself

from <Full path to file> to <Current directory>\quickly@onionmail.org<File name>.exe

Modifies user data files (Trojan.Encoder).

Network activity

UDP

'localhost':59019
'localhost':63912

Miscellaneous

Searches for the following windows

ClassName: 'SystemTray_Main' WindowName: ''

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
'%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSDTC
'%WINDIR%\syswow64\net1.exe' stop MSDTC
'%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLSERVERAGENT
'%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT
'%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSSQLSERVER
'%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER
'%WINDIR%\syswow64\net1.exe' stop vds
'%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log Application
'%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLWriter
'%WINDIR%\syswow64\net1.exe' stop SQLWriter
'%WINDIR%\syswow64\cmd.exe' /c net.exe stop SQLBrowser
'%WINDIR%\syswow64\net1.exe' stop SQLBrowser
'%WINDIR%\syswow64\cmd.exe' /c net.exe stop MSSQL$CONTOSO1
'%WINDIR%\syswow64\net1.exe' stop MSSQL$CONTOSO1
'%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
'%WINDIR%\syswow64\cmd.exe' /c wmic.exe SHADOWCOPY /nointeractive
'%WINDIR%\syswow64\wevtutil.exe' clear-log "windows powershell"
'%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log "windows powershell"
'%WINDIR%\syswow64\wevtutil.exe' clear-log System
'%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log System
'%WINDIR%\syswow64\wevtutil.exe' clear-log Security
'%WINDIR%\syswow64\cmd.exe' /c wevtutil.exe clear-log Security
'%WINDIR%\syswow64\wevtutil.exe' clear-log Application
'%WINDIR%\syswow64\cmd.exe' /c net.exe stop vds
'%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete systemstatebackup -keepversions:0
'%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete backup
'%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe delete catalog –quiet
'%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe DELETE SYSTEMSTATEBACKUP –deleteOldest
'%WINDIR%\syswow64\cmd.exe' /c wbadmin.exe DELETE SYSTEMSTATEBACKUP
'%WINDIR%\syswow64\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
'%WINDIR%\syswow64\cmd.exe' /c bcdedit.exe /set {default} recoveryenabled No
'%WINDIR%\syswow64\cmd.exe' /c netsh.exe advfirewall set currentprofile state off
'%WINDIR%\syswow64\cmd.exe' /c netsh.exe firewall set opmode mode=disable

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial