Trojan.Siggen33.58677

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
[HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'WindowsDefenderSvc' = 'C:\BlackSuitBoot\svc.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,C:\BlackSuitBoot\svc.exe'
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,C:\BlackSuitBoot\svc.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\windowsdefendersvc

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\BlackSuit] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\BlackSuit] 'ImagePath' = '"C:\BlackSuitBoot\svc.exe"'

Creates the following services

'BlackSuit' C:\BlackSuitBoot\svc.exe

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

Windows Recovery Environment (WinRE)

Modifies file system

Creates the following files

C:\blacksuitboot\svc.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\svc.exe
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\jthd6w06na.r49ssc.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\57c4g1jtqh.yzbdfi.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\kicgg36wgq.5ih322.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\x6hc5zxpyr.ys14bk.blacksuit
C:\blacksuitboot\bg.mp4
C:\blacksuitboot\video.log
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\tz4ny9uo8w.jwob44.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\vlrwddyvo0.7aqcn5.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\iad6r3ueve.rp9ejx.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pxs2cf1gbr.8uchla.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\yewzqiu5b3.cx1k3h.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\lqwrr7z2z3.bcqg42.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\pfo02ij3ib.9gro7n.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\t156pm2td2.ispnl3.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\a7ycdaiatj.kcjvrj.blacksuit
C:\msocache\all users\{90160000-0011-0000-0000-0000000ff1ce}-c\u4hynit45w.izby39.blacksuit
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\5bccf6dh7f.bfxftj.blacksuit
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\j1l7j7wh9t.vopnzd.blacksuit
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\1mo7xqkkbs.570emn.blacksuit
C:\msocache\all users\{90160000-0016-0409-0000-0000000ff1ce}-c\irnrk1pd09.88hw4h.blacksuit
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\jcsyofd2r0.w04sbh.blacksuit
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\1lmbf3um6f.bis13p.blacksuit
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\det5seoizc.chw6uf.blacksuit
C:\msocache\all users\{90160000-0018-0409-0000-0000000ff1ce}-c\fl3efn6uuw.ibd6m4.blacksuit
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\5whahxn1az.wou13h.blacksuit
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\sl3mtcpu3o.704rol.blacksuit
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\xrrwqq0wc3.68zpj7.blacksuit
C:\msocache\all users\{90160000-0019-0409-0000-0000000ff1ce}-c\mdsfpaa5nq.j1lmql.blacksuit
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\wau0wr45c1.b9u99n.blacksuit
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\29qbhsrahe.y11h73.blacksuit
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\at75ta8r0k.11b6kv.blacksuit
C:\msocache\all users\{90160000-001a-0409-0000-0000000ff1ce}-c\qqrsjl8q6e.lwohwi.blacksuit
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\d3tajz8glq.ni5nle.blacksuit
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\ouhf4sqgxc.syc1cx.blacksuit
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\pu32tlokrs.4falv0.blacksuit
C:\msocache\all users\{90160000-001b-0409-0000-0000000ff1ce}-c\7enshu5voi.dh93db.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\v9i5gkdmum.r01e3s.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\glcrdk4tv6.5thicu.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.en\p38pef6owp.m734od.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\q9s3eoj31y.k650ml.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\ieay92lok3.tlh05y.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.es\vy9rwd1brn.n711cb.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\3w3mbxv7f8.eyybtz.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\k9w6iz0fjh.2h38l2.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\proof.fr\qgudx95zpl.4xppdr.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\cockdacosx.qak2y4.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\17zakn4yar.m6jrk3.blacksuit
C:\msocache\all users\{90160000-002c-0409-0000-0000000ff1ce}-c\ob60gjt2yd.g9tg7n.blacksuit
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\1rcq5dmzco.ujapwn.blacksuit
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\p5ps3t1qf0.1chxy0.blacksuit
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\rdlx99exon.758ip7.blacksuit
C:\msocache\all users\{90160000-0044-0409-0000-0000000ff1ce}-c\1efu1na6pr.7tdchf.blacksuit
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\3ku1b2qcs0.wojoil.blacksuit
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\nok8nrrj6m.qh5ozx.blacksuit
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\t7c1k6n1sb.75uhlj.blacksuit
C:\msocache\all users\{90160000-0090-0409-0000-0000000ff1ce}-c\1wxjtbkh02.1qez95.blacksuit
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\kfthxqgk9j.ust3pc.blacksuit
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\dx478kcswc.6cpcsy.blacksuit
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\1cwazi17fp.mwfbu8.blacksuit
C:\msocache\all users\{90160000-00a1-0409-0000-0000000ff1ce}-c\sggfw6zxmx.sfgt4p.blacksuit
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\zneeo3ed2o.awerj8.blacksuit
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\9buaswfwvp.do5d1k.blacksuit
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\4wv2gb47nf.7ulu96.blacksuit
C:\msocache\all users\{90160000-00ba-0409-0000-0000000ff1ce}-c\4xw0obfvjs.l7vdle.blacksuit
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\65pgza66ho.thk3ud.blacksuit
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\0lk24go14k.0qc6xh.blacksuit
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\0ht1f9emyh.vfve3x.blacksuit
C:\msocache\all users\{90160000-00e1-0409-0000-0000000ff1ce}-c\1lb9s3wit9.jgm72e.blacksuit
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\d2jqgjwt3a.si1v4y.blacksuit
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\6pd3p4a12w.fuenzk.blacksuit
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\6sg5u2kzq1.t5sjg4.blacksuit
C:\msocache\all users\{90160000-00e2-0409-0000-0000000ff1ce}-c\ouibw7xlo6.7acd8f.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\226pd0sp08.pk41wt.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\76gcihcceg.qe3psc.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\j831f9gjsv.2qyi6e.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\zzz2u3o1g1.dwcbku.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\zaz6qzplxe.1oz4yi.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\r5rqkqh9ct.6ncggg.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\0zytq1b74g.aqxd5w.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\y6w60ykua1.y664nn.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\20ryw0evpl.dn8z1z.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\8dr4uzd4tq.h33ttc.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\c1tdeir0vo.j1oeea.blacksuit
C:\msocache\all users\{90160000-0115-0409-0000-0000000ff1ce}-c\gnlztp3oy5.qjei8t.blacksuit
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\445q3acwtx.ny1jzf.blacksuit
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\ge34zonp14.yua19l.blacksuit
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\1klbxoc4ua.dn2flm.blacksuit
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\ltim6nr4zf.bj0xsz.blacksuit
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\tvxg7lg4da.6bc3bf.blacksuit
C:\msocache\all users\{90160000-0116-0409-1000-0000000ff1ce}-c\jqbrk2ck2y.gn7h89.blacksuit
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\dx0rr4bt7h.xihiu0.blacksuit
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\i2b5sqtw0o.w5do6x.blacksuit
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\9gau7ols8c.lxfzed.blacksuit
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\access.en-us\ofu70zub74.f0uxje.blacksuit
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\4ues9phcao.q05far.blacksuit
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\rzoyjnuno4.0kyjyk.blacksuit
C:\msocache\all users\{90160000-0117-0409-0000-0000000ff1ce}-c\74y3lyob9r.pkvz8v.blacksuit
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\by35qzbz4d.ak7y3v.blacksuit
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\fh8mvcq3hd.lsctd1.blacksuit
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\ibor8eqhs4.t3tezi.blacksuit
C:\msocache\all users\{90160000-012b-0409-0000-0000000ff1ce}-c\z1348esaya.ow2l1q.blacksuit
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\cybakyct8o.59aunk.blacksuit
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\5f6fqoqebl.p1w11a.blacksuit
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\re5tgtq55i.y2hr3f.blacksuit
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\muhqf8ur92.j6j7dm.blacksuit
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\749jd47pzu.0uzddh.blacksuit
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\8gcneqe22i.uap58j.blacksuit
%ALLUSERSPROFILE%\microsoft\appv\setup\g77mpbsne6.j5rgi7.blacksuit
%ALLUSERSPROFILE%\microsoft\crypto\systemkeys\zgd4abd0vm.89z4b0.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\ahpa7zkaac.tvryz1.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\zruhfurp5y.hsobug.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\gzbjsntxwb.6aiwpj.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\1b6fxjnwie.k5tikm.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\wjl9sir6ed.hj2kka.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\mviacmvr53.2hjyaf.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\0nimipk4nq.e51zxo.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\wwtubmd0mb.jq8ldl.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\4i463duye8.49un1c.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\vc4ccap64z.kiclnu.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\j66yeunkzo.fkdoqs.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wdwlyd3fb1.lpsvhe.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\kg9z9wuxek.3zjr6t.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\m2zrtc1f67.hstch1.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\zazuyj137a.j5fq3x.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\stmn72eoek.rq9fds.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\cfjio2u7vz.14rqjm.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\380o9xc391.wfoc26.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\760rg15kmy.o749is.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\cc9mb5nwwp.tewmrt.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\3d2jglb89x.0gd83n.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\zz1c4f20pj.yi5szp.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\9atziy7sxi.gbybw3.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\xtbpjyufr4.f2brd7.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\u2hojmzvbp.is13bv.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\1sbrxqo5m5.4pvtjs.blacksuit
%ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\774ubqhdvh.r3v2x3.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\67p461zk12.sbk2um.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\tta1hifara.6m5564.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\v6jxxrekbx.zy551d.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\6ontdx2vy6.vsz550.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosis\downloadedsettings\sqzu6s7l84.yjegti.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosis\swj7fnv5kf.obex7t.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosis\8mgnok500v.hyg9t1.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosis\jew2hto6f3.v7px7d.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosis\scenariossqlstore\dztbmq8csp.iyx402.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosis\tenantstorage\p-aria\mksvml112i.j0vvd2.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\2fi4difgw1.gm3ykk.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\ham5qnoe99.enic8b.blacksuit
%ALLUSERSPROFILE%\microsoft\diagnosticlogcsp\collectors\9x5pgf13m2.yx3cju.blacksuit
%ALLUSERSPROFILE%\microsoft\identitycrl\int\mwloywvbeb.33rogs.blacksuit
%ALLUSERSPROFILE%\microsoft\identitycrl\production\8xsj2audwq.kh3koy.blacksuit
%ALLUSERSPROFILE%\microsoft\mf\cj8e7p8pgp.0ihu0i.blacksuit
%ALLUSERSPROFILE%\microsoft\mf\q409pr56g2.u2ufb6.blacksuit
%ALLUSERSPROFILE%\microsoft\network\downloader\o5uxihi90c.h4kah9.blacksuit
%ALLUSERSPROFILE%\microsoft\network\downloader\j3utw40tdy.tpoxs9.blacksuit
%ALLUSERSPROFILE%\microsoft\network\downloader\9svh2apky0.yum0oy.blacksuit
%ALLUSERSPROFILE%\microsoft\network\downloader\41j7tiawx4.uymlap.blacksuit
%ALLUSERSPROFILE%\microsoft\network\downloader\bve2cmkc14.tmtsvo.blacksuit
%ALLUSERSPROFILE%\microsoft\network\downloader\jdzqxwyh6t.tmdqef.blacksuit
%ALLUSERSPROFILE%\microsoft\network\downloader\0mt7en6njo.r5r5dk.blacksuit
%ALLUSERSPROFILE%\microsoft\office\aetrvvu5mx.zhgxuh.blacksuit
%ALLUSERSPROFILE%\microsoft\office\8t1rzwlwqa.fta8wq.blacksuit
%ALLUSERSPROFILE%\microsoft\office\b7vy1qvima.vahr7n.blacksuit
%ALLUSERSPROFILE%\microsoft\office\q1852cyx3u.383qpx.blacksuit
%ALLUSERSPROFILE%\microsoft\office\d3nef1rp2n.zo606d.blacksuit
%ALLUSERSPROFILE%\microsoft\office\i6r0hh1nbz.dez9m3.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\47epnp8lom.b3yffd.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\847gafaxoq.bi2drt.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\p97esgsmz7.bxz3vv.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\5420pqpnkq.c00itc.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\1qip70n4dz.kar9am.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\fmr7ufigd4.hphyy0.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\eup907zsf7.pzwwtm.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\m4iwg7ydjs.z06qf1.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\gatherlogs\systemindex\59cx7elf9e.lbcnf2.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\73czw93cnd.8c3dy4.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\lczkyy0sj5.le4pm8.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\propmap\9qr1vefv12.qcskps.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\p6x9x36usg.nnvste.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\zykxd255x8.x0vn23.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\projects\systemindex\secstore\ttulnoji25.0w193o.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\xr20zhx4hp.4rv7m2.blacksuit
%ALLUSERSPROFILE%\microsoft\search\data\applications\windows\3t20ze9kg8.zfv9mb.blacksuit
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\ys4pn5yb9p.28ndc7.blacksuit
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\axy28pc08r.biiofb.blacksuit
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\o2r3ujnbxm.1oh91v.blacksuit
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\boux6pt2gv.p116bw.blacksuit
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\6ifdd8h8hm.srf1ns.blacksuit
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\vysts3zig2.rw0y89.blacksuit
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\eob6id2rfz.4hppa4.blacksuit
%ALLUSERSPROFILE%\microsoft\smsrouter\messagestore\xg4w2y6d8m.a4miky.blacksuit
%ALLUSERSPROFILE%\microsoft\storage health\vev318enjl.0jiibd.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\oj2zf7rkgn.eixipx.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\nzzp10d82i.lz2j6a.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\abh9x18crf.gj89p9.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\rousknjpja.byuik8.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\yfhif2mhbq.zw2660.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\xkvc9eq6fm.cwi0o5.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\dswf3580oo.ek9q9d.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\3vw9m499yp.8uh2mj.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\076tr4f4nw.elnjki.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\wil45uo7sg.3p6sa3.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\ikowgz6i8o.hzdmrb.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\1bw787yssr.pv4in6.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\rsp9qpq2fq.c3f0d2.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\g59hoxire5.xxtdlz.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\re22sq2nht.ablzaj.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\54j0i4z9bu.lgwlb9.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\ity6go87za.bw5nt8.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\64sntuxjua.f49sqd.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\4r88mbkhln.fa1njq.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\zuju2pnfio.lt1q8p.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\zm96k7pcab.vyqfxb.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\uv9s88kt5o.l0wsnx.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\cp56wmgymi.81cl4p.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\p8z1y6ltgy.twnj0p.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\5i3ptokh29.plef3w.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\7lgf3lpp88.o0pmly.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\3br5qzrv7q.leskga.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\biusejploz.kc6vei.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\w1wepk9b2q.6ik8m6.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\ie9a21dlxw.v0kkrh.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\inboxtemplates\i7b3ha5p9w.vwspz3.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\scripts\t8j80sfxem.t4s6gy.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\templates\mo6aclqvzs.9gin4i.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\templates\l37hie5y7v.47u5hn.blacksuit
%ALLUSERSPROFILE%\microsoft\uev\templates\f6yf01m4ra.ljryms.blacksuit
%ALLUSERSPROFILE%\microsoft\user account pictures\5o9523wion.ih3n2v.blacksuit
%ALLUSERSPROFILE%\microsoft\user account pictures\0cwb185frj.4qgbju.blacksuit
%ALLUSERSPROFILE%\microsoft\user account pictures\yuzmchul1g.hraqma.blacksuit
%ALLUSERSPROFILE%\microsoft\user account pictures\zo3pux27lu.ciuzfm.blacksuit
%ALLUSERSPROFILE%\microsoft\user account pictures\7kedujmn2k.jmsg5q.blacksuit
%ALLUSERSPROFILE%\microsoft\user account pictures\qsoo6wzapo.0ywy9c.blacksuit
%ALLUSERSPROFILE%\microsoft\user account pictures\z94gv0s758.13o4bb.blacksuit
%ALLUSERSPROFILE%\microsoft\user account pictures\nhvixak21b.ooew0u.blacksuit
%ALLUSERSPROFILE%\microsoft\user account pictures\ooqu09z13i.1mz7qn.blacksuit
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\5p2wb3odq8.pgjyo0.blacksuit
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\80p4mhdv85.wnc8eo.blacksuit
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\9v0myhqvnc.nlp075.blacksuit
%ALLUSERSPROFILE%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\b01hcy6lau.8dfbsu.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\3vl2jt240k.m6qiqg.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\caches\6s1j1tkx4s.77yftz.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\caches\i2tpmjpy6e.ftz14r.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\caches\281l2dgpu9.lpnc2w.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\caches\0k3s8w2zsl.7qpcxn.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\caches\itqc8mwmmq.ha9bkd.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\caches\aki0e497eu.h09y8o.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\caches\7i9k3icdm4.0fo8f8.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\a7llvzll45.5dpkdv.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\1tdol9rac0.c923ei.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\yrux2lxmb1.wyniz4.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\72zqszcch8.vrygin.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\l20jso4bcr.0rl3ii.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\lctsexcw1x.14oh9l.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\aij8qynwbe.x2yvwx.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\nw1oz3gjfz.cghi89.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\gyslugxvjw.45hx2z.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\h1ulq8ktm4.umuc4o.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\n6nd4i5r8s.ro164t.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\15ppht6sjt.mgxn8y.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\d6jpyzzoeg.8rqmxe.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\xamn70spqd.fae6sk.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\8h519v9ytd.alx08t.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\znqn0dx6n1.ry4qbm.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\czn88nktp9.o1oj05.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\nzt0bxlm2c.hplhii.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\5rxldpt6bn.pnee3e.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\7zncxs3ptg.bx921f.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\qmemyobhq7.pouxhm.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\n7ry3yo842.2i18eu.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\q1eb30d8q9.7d4f05.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\17dkv8dl4y.fgnhj9.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\qmjmm4ei2v.nz90r7.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\lb6sygjf04.9k6s4z.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\eu86d8zvln.9mokm8.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\nb36dvdmj3.pv34ya.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\hn5uk9qrej.vrmvjv.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\5ezwnoba25.849vqp.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\xeqwq2yr57.r6ofud.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\6rsyaq5jwd.o48whr.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\by73p9r540.fl5zlh.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\a601wshf6w.c2w6jz.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\p0tn78wz8i.68okfz.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\5e5j6ral5b.u309de.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\73c55m5r0o.rxlm3q.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\bgfyh07lic.x73jlf.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\archive\apps\qxmozfyb7y.54vx4h.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\clipsvc\yzkp85svxn.6rmhbm.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatacache\ijotubt7yc.grcho2.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\0aiggkk06u.gt8f3v.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\devicemetadatastore\en-us\bvnxruw603.g6wb44.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\lfsvc\geofence\q09gws6shh.ue3e7o.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\qnwbvpe34k.yuiynp.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\qqy1gl9s8p.rthybd.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessibility\yrrvh3sfdg.ym8vli.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessibility\yc5jqye5wb.02st17.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\gvcr7sf120.govt4b.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\vjdg0pou39.nwb9vf.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tlgwb63qxk.4b2qmu.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\3xu6h6js8v.hvriz1.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\tc05ri81wl.5zsf05.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\wyfs4gdf7k.biq9t6.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\1nf758s5vw.3kkqrx.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\krerjnrt7l.65420i.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\xcpjnd9efj.erkc17.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\system tools\af2xc8bq8p.hsbd62.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\1m0dm4x47x.c92t8s.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\0ihydk2usa.t8yzds.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\accessories\1qw9atvk94.0xmk22.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\6tpz6jhhv6.0pakbp.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\xy3qw2kk01.j6xp94.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\jym1om90of.vgziyq.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\98ckmpfyzy.lscgfg.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\zmr723kiuu.2yoydv.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\7u34shm88j.mcibhj.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\zqr3w066ct.0ap42q.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\ssxkvhj90r.606y8i.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\axt9fiufjj.533c3a.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\55w6c9hhej.znikja.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\m5ildpu1b9.1iu09l.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\x7sh63v2ry.ta1jns.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\kixph0nbis.4fnj0b.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\ew1dzbqnpd.20e3iv.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\oydij196kr.wthp5g.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\iwybcr5ph4.w93j6o.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\q9flkcgapl.s9l3g7.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\rnpdncd3qi.cni8oq.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\2ssqxq3ubm.mu2wfl.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\weni9ltgk5.zq3jg4.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\ctew57c7ou.ffex4a.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\administrative tools\pnx13e7hf5.4a7op2.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\5576ub6j2q.325t84.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\74xucajfwo.fe3915.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ze8pjthvw5.9yynky.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\cak85by0ix.fn04p4.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\do7dng0eiq.qv6h9f.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\iu1grl0m1o.xkzzy4.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\6gzdxjzjwz.7vsr5e.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\5q9ka6lmyt.m64inn.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\java\c5p65wch4d.afn76p.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\maintenance\tm4k7r64ah.4bm69f.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\8rvuxq22mz.ncovr1.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office 2016 tools\ksn717eiee.1x5gxg.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office 2016 tools\dihc6i19j5.rylfr8.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office 2016 tools\37uh54tpu8.lj0dkg.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office 2016 tools\2frelo69ne.7g7crp.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office 2016 tools\rf4o0r1ktk.t652iq.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office 2016 tools\wuyfp7r9mz.ir9ih0.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office 2016 tools\jh1t8a31nz.wvdsmj.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft office 2016 tools\uaa8jnc0lg.dndfb2.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\1qnehae8b4.shtofc.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\s7792rmqv3.bjs1jf.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\e6cwqvk2gk.ylfcvq.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\y1hae3v5p3.cbvt6f.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\xwhuyz81i9.7uarsv.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\x9tmu4eaxt.iju9j6.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\z358e56rsu.dlcl1r.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\5shd726w9n.ae39m9.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\j1wnnb0psz.29wef1.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\am7z30j1uu.ymtzvj.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\steam\qwcmhivat9.gadd2l.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\system tools\p0wub7b9z7.0orpmu.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\system tools\ccubngmolk.yw8iz9.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows powershell\kedrljr9fy.frrkgl.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows powershell\016kkw6f8o.3aovdu.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\windows powershell\xwew4zyn4z.vrchma.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\bts3zb1t0g.q4dpil.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\uvl7k5t9cc.brvg76.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\tosd8fu86m.fp6od2.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\winrar\dwsip0bn8u.cwdal2.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\9l8dz6lk4l.96zedc.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\apphang_microsoft.window_e872541cf1f6e63a723e32bdb8fbcb53a75b48_b55b5c1a_04a64cfb-1de7-4019-8161-289237ed8a3d\njqs431vzw.x2v52l.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\apphang_ncbservice_dc4d5f766f89a4e6ccecbabd65c8e8c76a3fa_00000000_0aab2a27-f17a-4bfc-ac2a-e0ec45356ce8\wlhls6mow9.62heob.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\critical_10.0.19041.1022_e72a641c7e35f12cedf4255073e9f58d8bb037f2_00000000_e17b9f1b-934a-4542-8df1-1ab02c30b4b9\3cg1p8h5zr.8nz1tr.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\noncritical_microsoftedgeupd_788c88554cc0cde1636ae432a7a0d77f792cc3b4_00000000_591398e1-9f01-4c94-b2cb-3e338e0f1b37\2qm5osp88t.m1cr4s.blacksu...
%ALLUSERSPROFILE%\microsoft\windows\wer\temp\k9f86i2vfa.seqfov.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\wer\temp\23h8org4j9.h91nt5.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\wer\temp\u6fqr58y3s.gxxs62.blacksuit
%ALLUSERSPROFILE%\microsoft\windows\wfp\hya0xsq05t.fnib6t.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\default\0yxfxiqf12.sw12ie.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\default\bhtkek3el8.qm8fu8.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\default\bfnhz3suna.wt7kzm.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\default\zd1tbitgwa.kzb57m.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\definition updates\default\zcecl3rcyw.rcn1k9.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\backupstore\arwqyg33ly.ei9fpu.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\results\resource\h8dzlcerqi.dwt0s4.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\results\resource\dtq91s5j7m.3gy7rj.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\service\awyujq824l.eckq0l.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\store\2vtpitgb2o.fxv5zh.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\history\store\cf6q1l24kq.08pshd.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\bxahhetbp3.3tvfau.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\r8lxx2aqxt.pg08mh.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\8z2vu2sw4w.x63q0i.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\23x092xmvi.qrzt5l.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\y1u82vyzt7.emz3i0.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\u45fpzfkoi.g89dsr.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\rzo1zfpwh3.5cv46i.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\ghr8w9gu22.ccy64f.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\res5vqvymg.b7t1v2.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\2llh7g7vi1.chvwri.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\zujy1w8pgt.an0db9.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\21eo0bw07r.n2h83y.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\scans\eccu85pto6.1po1rz.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\mfhfnzt8vz.mwjv64.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\nftighk4o3.3hds67.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\hktmx5d3qe.8u0hmi.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\llrhft7zzc.ojqljj.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\pgw2jmoxmf.xwggpc.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\nihpsoo16y.jo18dp.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\ddexzbfgk7.x12bpd.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\urzxoe1t5e.4jsry2.blacksuit
%ALLUSERSPROFILE%\microsoft\windows defender.bak\support\t3p1h8p3w7.mwfngd.blacksuit
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\5a6ov26dpf.3ymxwq.blacksuit
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\xns2onm06f.cbhyin.blacksuit
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\hcsfkn7534.pj1wk2.blacksuit
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\common coverpages\en-us\q7x68b7fys.a1an8k.blacksuit
%ALLUSERSPROFILE%\microsoft\windows nt\msfax\virtualinbox\en-us\9w0ka7oh4p.84kaxj.blacksuit
%ALLUSERSPROFILE%\microsoft\windows nt\msscan\q65do0dezn.km3zcf.blacksuit
%ALLUSERSPROFILE%\microsoft\windows security health\logs\kpnhmikdmf.zitf31.blacksuit
%ALLUSERSPROFILE%\microsoft\windows security health\logs\hjman67tmg.svlm0h.blacksuit
%ALLUSERSPROFILE%\microsoft\windows security health\logs\wzdmrfdbef.n34fgj.blacksuit
%ALLUSERSPROFILE%\microsoft\windows security health\logs\cgrulfrx1v.c8ms0p.blacksuit
%ALLUSERSPROFILE%\microsoft help\290t9c5qaz.bs3vlb.blacksuit
%ALLUSERSPROFILE%\microsoft help\s8r30djy7h.bgktab.blacksuit
%ALLUSERSPROFILE%\microsoft help\wv5l9zuuym.zqmz0f.blacksuit
%ALLUSERSPROFILE%\microsoft help\5l0nqr2xfu.iyrfgr.blacksuit
%ALLUSERSPROFILE%\microsoft help\x97isqb3r0.8xjtro.blacksuit
%ALLUSERSPROFILE%\microsoft help\1u9x01lesz.y6boti.blacksuit
%ALLUSERSPROFILE%\microsoft help\4rqhj6cxrk.zztwb0.blacksuit
%ALLUSERSPROFILE%\microsoft help\supuygs12m.qgynwr.blacksuit
%ALLUSERSPROFILE%\microsoft help\2mxyljqm3s.vxnbi5.blacksuit
%ALLUSERSPROFILE%\microsoft help\539bqgur8l.m0g88o.blacksuit
%ALLUSERSPROFILE%\microsoft help\45jt06qpi9.oam9lc.blacksuit
%ALLUSERSPROFILE%\microsoft help\vb46qbmhm4.9gqgib.blacksuit
%ALLUSERSPROFILE%\microsoft help\gu8c0q8oaj.w0hohp.blacksuit
%ALLUSERSPROFILE%\microsoft help\8t39wgnug9.c68hns.blacksuit
%ALLUSERSPROFILE%\microsoft help\3m1eacms9c.h5lwnv.blacksuit
%ALLUSERSPROFILE%\microsoft help\o2w6pusw1q.sa63so.blacksuit
%ALLUSERSPROFILE%\microsoft help\pdy71pnzxh.5cvalj.blacksuit
%ALLUSERSPROFILE%\microsoft help\idb8w1tj0u.qbtzc2.blacksuit
%ALLUSERSPROFILE%\microsoft help\yqn70xw2tf.b9hrwj.blacksuit
%ALLUSERSPROFILE%\microsoft help\4lh0flamxg.5e8ghd.blacksuit
%ALLUSERSPROFILE%\mozilla\6ot2v6epgo.wyi6mk.blacksuit
%ALLUSERSPROFILE%\mozilla\qxwq3is090.iur9qa.blacksuit
%ALLUSERSPROFILE%\mozilla\vp9docgtkn.helz05.blacksuit
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\dt1imd4rsz.5mfxr5.blacksuit
%ALLUSERSPROFILE%\mozilla\updates\d78bf5dd33499ec2\zcyp2nzl9u.4eb2tt.blacksuit
%ALLUSERSPROFILE%\oracle\java\installcache_x64\c0vzvldp01.ov8r6h.blacksuit
%ALLUSERSPROFILE%\oracle\java\javapath\wrvxa2ca8x.9k86nl.blacksuit
%ALLUSERSPROFILE%\oracle\java\javapath\gw8p2n0l7b.irnly5.blacksuit
%ALLUSERSPROFILE%\oracle\java\javapath\wh7luivyj0.i96fx5.blacksuit
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\38txqua9fa.vl1axe.blacksuit
%ALLUSERSPROFILE%\package cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\6spdqczldy.jl0loo.blacksuit
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\tje6iu6xiw.t5vmpe.blacksuit
%ALLUSERSPROFILE%\package cache\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\packages\vcruntimeminimum_x86\rtnw52pndf.nubbcy.blacksuit
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\fzsll0v06o.45nw0b.blacksuit
%ALLUSERSPROFILE%\package cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\n3zlu70i0e.4jsnv4.blacksuit
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\rcds7fa7c4.7khxd1.blacksuit
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\e0n4jbovpx.g1vsw9.blacksuit
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\rysvq8k2lh.f8ntsg.blacksuit
%ALLUSERSPROFILE%\package cache\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\packages\vcruntimeadditional_amd64\mstmtw8vdv.4s4dgu.blacksuit
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\hwecr1zdp5.qpmg2c.blacksuit
%ALLUSERSPROFILE%\package cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\s76p3kng53.5xnp08.blacksuit
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\uw3vdkfcoo.i35qx5.blacksuit
%ALLUSERSPROFILE%\package cache\{42667d2e-b054-46c1-9d46-2ee1332c14c1}v14.29.30133\packages\vcruntimeadditional_x86\2riz3yim3a.tfx3fu.blacksuit
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\ljgr26qkdm.92xb0d.blacksuit
%ALLUSERSPROFILE%\package cache\{6cd9e9ed-906d-4196-8dc3-f987d2f6615f}v14.29.30133\packages\vcruntimeminimum_amd64\v0jhpt8to7.urptt4.blacksuit
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\z8xhs0b9le.f996m8.blacksuit
%ALLUSERSPROFILE%\package cache\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\packages\vcruntimeadditional_amd64\kejwcurb1d.i8q1td.blacksuit
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\f6w6j3zhp5.8y8xaz.blacksuit
%ALLUSERSPROFILE%\package cache\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\packages\vcruntimeminimum_amd64\ymv044c819.pj9bp7.blacksuit
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\yvuwg6ychf.56u7rn.blacksuit
%ALLUSERSPROFILE%\package cache\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\packages\vcruntimeadditional_x86\793je59i70.78m5l8.blacksuit
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\u1hokd0mq6.ktwkc4.blacksuit
%ALLUSERSPROFILE%\package cache\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\packages\vcruntimeminimum_x86\39bn9h6xoh.5qzwyk.blacksuit
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\symuwq4i9j.3u5f05.blacksuit
%ALLUSERSPROFILE%\package cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\9znwcukgd2.g20z0m.blacksuit
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\khtw7orgym.pyqpq4.blacksuit
%ALLUSERSPROFILE%\package cache\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\packages\vcruntimeminimum_amd64\mpzv4qlesi.t8jvrs.blacksuit
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\nzdaymwrin.5kg9th.blacksuit
%ALLUSERSPROFILE%\package cache\{e699e009-1c3c-4e50-9b57-2b39f0954c7f}v14.29.30133\packages\vcruntimeadditional_amd64\2xh0bf72s0.glsymj.blacksuit
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\vi2r4s867t.5p6clk.blacksuit
%ALLUSERSPROFILE%\package cache\{ec9807de-b577-47b1-a024-0251805acf24}v14.29.30133\packages\vcruntimeminimum_x86\o9z9253ytm.dw4sr1.blacksuit
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\2d3wkpc84t.aex5tb.blacksuit
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\tntyh8s6nb.w52li2.blacksuit
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\8xg376bhhk.klarsf.blacksuit
%ALLUSERSPROFILE%\package cache\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\packages\vcruntimeadditional_x86\bun0qvmw07.gi07h6.blacksuit
%ALLUSERSPROFILE%\regid.1991-06.com.microsoft\ieaevzwdck.3umy4s.blacksuit
%ALLUSERSPROFILE%\regid.1991-06.com.microsoft\4kt9tdksis.bh7xp4.blacksuit
C:\recovery\windowsre\nptcesekwx.17gkyu.blacksuit

Sets the 'hidden' attribute to the following files

C:\blacksuitboot\svc.exe

Deletes the following system files

C:\recovery\windowsre\reagent.xml
C:\recovery\windowsre\winre.wim

Deletes following files that it created itself

%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\svc.exe

Miscellaneous

Executes the following

'<SYSTEM32>\attrib.exe' +h +s C:\BlackSuitBoot\svc.exe
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v WindowsDefenderSvc /t REG_SZ /d C:\BlackSuitBoot\svc.exe /f
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d <SYSTEM32>\userinit.exe,C:\BlackSuitBoot\svc.exe /f
'<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d explorer.exe,C:\BlackSuitBoot\svc.exe /f
'<SYSTEM32>\sc.exe' create BlackSuit binPath= \"C:\BlackSuitBoot\svc.exe\" start= auto obj= LocalSystem
'<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BlackSuit /t REG_SZ /d Service /f
'<SYSTEM32>\reg.exe' add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BlackSuit /t REG_SZ /d Service /f
'<SYSTEM32>\schtasks.exe' /create /tn WindowsDefenderSvc /tr C:\BlackSuitBoot\svc.exe /sc onlogon /rl highest /f
'<SYSTEM32>\wbem\wmic.exe' bios get serialnumber

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial