Trojan.Siggen36.26625

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsCache' = '"%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe" --mnr-task'

Creates or modifies the following files

<SYSTEM32>\tasks\windowscache
%APPDATA%\microsoft\windows\start menu\programs\startup\windowscache.vbs
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\wudfhost

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

adds antivirus exclusion with following registry keys:

[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Full path to file>' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '<Full path to file>' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] '.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Full path to file>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '<Full path to file>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Extensions] '.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Current directory>\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Full path to file>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '<Full path to file>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions] '.exe' = '00000000'

Patches code

in dll

microsoftcacheworker.exe process, win32u.dll module

in NTDLL dll

microsoftcacheworker.exe process, ntdll.dll module

Modifies file system

Creates the following files

%LOCALAPPDATA%\microsoft\windows\caches\last_user.json
%LOCALAPPDATA%\microsoft\windows\caches\last_donate.json
%LOCALAPPDATA%\microsoft\windows\caches\build.json
%LOCALAPPDATA%\microsoft\windows\caches\taskmgr_hook.dll
%TEMP%\wininetcache\g3.exe
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheassistant.exe
%TEMP%\mnr_windowscache.xml
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheworker.exe
%LOCALAPPDATA%\microsoft\windows\caches\winring0x64.sys
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcachehealth.exe
%LOCALAPPDATA%\microsoft help\firefox.exe
%ProgramFiles(x86)%\opera\wudfhost.exe
%LOCALAPPDATA%\microsoft\windows\caches\runtime_donate_phase.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_stage.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_status.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_duty.json
%LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png

Sets the 'hidden' attribute to the following files

%LOCALAPPDATA%\microsoft\windows\caches\last_user.json
%LOCALAPPDATA%\microsoft\windows\caches\last_donate.json
%LOCALAPPDATA%\microsoft\windows\caches\build.json
%LOCALAPPDATA%\microsoft\windows\caches\taskmgr_hook.dll
%TEMP%\wininetcache\g3.exe
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheassistant.exe
%APPDATA%\microsoft\windows\start menu\programs\startup\windowscache.vbs
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheworker.exe
%LOCALAPPDATA%\microsoft\windows\caches\winring0x64.sys
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcachehealth.exe
%LOCALAPPDATA%\microsoft help\firefox.exe
%ProgramFiles(x86)%\opera\wudfhost.exe
%LOCALAPPDATA%\microsoft\windows\caches\runtime_donate_phase.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_stage.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_status.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_duty.json

Deletes following files that it created itself

%TEMP%\mnr_windowscache.xml

Substitutes the following files

%TEMP%\mnr_windowscache.xml

Network activity

Connects to

'pa###bin.com':443
'localhost':42371
'gi##ab.com':443

TCP

Other

'pa###bin.com':443
'gi##ab.com':443

UDP

DNS ASK dn#.google
DNS ASK pa###bin.com
DNS ASK gi##ab.com
'dn#.google':443
'19#.#26.98.121':443

Miscellaneous

Creates and executes the following

'%TEMP%\wininetcache\g3.exe'
'%LOCALAPPDATA%\microsoft\windows\caches\microsoftcachehealth.exe'
'%ProgramFiles(x86)%\opera\wudfhost.exe'
'%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheworker.exe' --algorithm-gpu pearlhash --disable-cpu --disable-worker-watchdog --disable-gpu-intel --gpu-disable-oc --log-file gpu_srb.log --log-file-mode 0 --pool pearl-eu2.luckypool.io:3360,de.pearl.herom...

Executes the following

'<SYSTEM32>\schtasks.exe' /Create /F /TN WindowsCache /XML "%TEMP%\mnr_WindowsCache.xml"
'<SYSTEM32>\schtasks.exe' /Delete /F /TN WindowsCacheBoot
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule program="%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe"
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe'
'<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s UmRdpService
'<SYSTEM32>\cmd.exe' /c set
'<SYSTEM32>\schtasks.exe' /Create /F /TN WindowsCache /XML "%TEMP%\mnr_WindowsCache.xml"' (with hidden window)
'<SYSTEM32>\schtasks.exe' /Delete /F /TN WindowsCacheBoot' (with hidden window)
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule program="%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe"' (with hidden window)
'%LOCALAPPDATA%\microsoft\windows\caches\microsoftcachehealth.exe' ' (with hidden window)
'%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheworker.exe' --algorithm-gpu pearlhash --disable-cpu --disable-worker-watchdog --disable-gpu-intel --gpu-disable-oc --log-file gpu_srb.log --log-file-mode 0 --pool pearl-eu2.luckypool.io:3360,de.pearl.herom...' (with hidden window)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' ' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial