Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] '!CleanMRPup' = '%WINDIR%\CleanUpMRP.cmd'
Вредоносные функции
Запускает большое число процессов
Изменения в файловой системе
Создает следующие файлы
- %ALLUSERSPROFILE%\tempm\7za.exe
- %ALLUSERSPROFILE%\tempm\extract.exe
- %ALLUSERSPROFILE%\tempm\install.7z
- %ALLUSERSPROFILE%\tempm\decompile.cmd
- %WINDIR%\temp\extract.cmd
- %WINDIR%\setup\mrp3\mrpversion.tag
- nul
- %TEMP%\sppwmi.vbs
- %WINDIR%\cleanupmrp.cmd
- %WINDIR%\temp\isw11.vbs
- %TEMP%\mrpcpunum.vbs
- %HOMEPATH%\desktop\mrp_error.log
- %TEMP%\mrpconvertnumber.vbs
- %TEMP%\chkact.vbs
Удаляет следующие файлы
- %WINDIR%\temp\isw11.vbs
- %TEMP%\mrpcpunum.vbs
- %ALLUSERSPROFILE%\tempm\install.7z
- %ALLUSERSPROFILE%\tempm\7za.exe
- %WINDIR%\setup\mrp3\mrpversion.tag
- %TEMP%\sppwmi.vbs
- %TEMP%\mrpconvertnumber.vbs
- %TEMP%\chkact.vbs
- %WINDIR%\cleanupmrp.cmd
- %ALLUSERSPROFILE%\tempm\decompile.cmd
- %ALLUSERSPROFILE%\tempm\extract.exe
- %WINDIR%\temp\extract.cmd
Подменяет следующие файлы
- %TEMP%\mrpconvertnumber.vbs
Другое
Создает и запускает на исполнение
- '%ALLUSERSPROFILE%\tempm\extract.exe'
- '<SYSTEM32>\cscript.exe' //NoLogo "%TEMP%\MRPConvertNumber.vbs" "2162232"
- '<SYSTEM32>\cscript.exe' //nologo "%TEMP%\ChkAct.vbs"
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\TempM\Decompile.cmd" > NUL"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Temp\extract.cmd" > NUL"' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\TempM\Decompile.cmd" > NUL"
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "W10TB" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "W10TBCol" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "HiLiteCol" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "DrvType" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "OSEd" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "RPBand" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "Rem1Drv" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "ShowExts" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoShortCutS" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "AppsUseDarkTheme" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "SystemUsesDarkTheme" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "OLEDTaskbar" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "LaunchToPC" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "PIDTValue" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "AdvertsBlock" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "VMType" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoBGAppsRun" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoMD" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "MRPChkX" /f
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v "TimeZoneKeyName" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v "TimeZoneKeyName"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v "ActiveTimeBias" | findstr /i "ActiveTimeBias" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v "ActiveTimeBias"
- '<SYSTEM32>\findstr.exe' /i "ActiveTimeBias"
- '%WINDIR%\syswow64\cmd.exe' /c echo 480 2>nul
- '%WINDIR%\syswow64\cmd.exe' /c Powershell -NoProfile "[Threading.Thread]::CurrentThread.CurrentUICulture = 'en-US'; ([TimeZoneInfo]::Local).IsDaylightSavingTime([DateTime]::Now)" 2>nul
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile "[Threading.Thread]::CurrentThread.CurrentUICulture = 'en-US'; ([TimeZoneInfo]::Local).IsDaylightSavingTime([DateTime]::Now)"
- '<SYSTEM32>\attrib.exe' "%ALLUSERSPROFILE%" +h +s
- '<SYSTEM32>\reg.exe' DELETE "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "%WINDIR%\Setup" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "%WINDIR%\Setup\Scripts" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "SystemModel" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "OEMsOK" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "Dbug" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "MRPChk" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "MRPAM" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "GroupByNone" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "!CleanMRPup" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "AllowPhone" /f
- '<SYSTEM32>\findstr.exe' /i "DataVars"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\Software\MRP3\DataVars" /f
- '%WINDIR%\syswow64\cmd.exe' /c "WMIC /locale:ms_409 PATH WIN32_OperatingSystem get TotalVisibleMemorySize /format:list" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 PATH WIN32_OperatingSystem get TotalVisibleMemorySize /format:list
- '%WINDIR%\syswow64\cmd.exe' /c "WMIC /locale:ms_409 PATH WIN32_OperatingSystem get FreePhysicalMemory /format:list" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 PATH WIN32_OperatingSystem get FreePhysicalMemory /format:list
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\CScript.exe //NoLogo "%TEMP%\MRPConvertNumber.vbs" "2162232" 2>nul
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\CScript.exe //NoLogo "%TEMP%\MRPConvertNumber.vbs" "1249584" 2>nul
- '<SYSTEM32>\cscript.exe' //NoLogo "%TEMP%\MRPConvertNumber.vbs" "1249584"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\CScript.exe //NoLogo "%TEMP%\MRPConvertNumber.vbs" "912648" 2>nul
- '<SYSTEM32>\cscript.exe' //NoLogo "%TEMP%\MRPConvertNumber.vbs" "912648"
- '%WINDIR%\syswow64\cmd.exe' /c "WMIC /locale:ms_409 path SoftwareLicensingProduct where (Name LIKE '%Windows%' and PartialProductKey is not null) get LicenseStatus /format:list" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 path SoftwareLicensingProduct where (Name LIKE '%Windows%' and PartialProductKey is not null) get LicenseStatus /format:list
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\CScript.exe //nologo "%TEMP%\ChkAct.vbs" 2>Nul
- '<SYSTEM32>\reg.exe' DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "CleanMRPup" /f
- '<SYSTEM32>\reg.exe' query "HKLM\Software\MRP3" /s /k /f "DataVars"
- '%WINDIR%\syswow64\cmd.exe' /c wmic os get localdatetime /value
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\Software\MRP3" /s /k /f "DataVars" | FindStr /i "DataVars"
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "DisableSpotLight" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "GameXMode" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoXCortana" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "ThinBorders" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoAutoMaint" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoDefender" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "DFSettings" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoPSWinX" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NewProgs" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoPhotosUse" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "TransferOpts" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "RemInboxApps" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "HLNewProgs" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "InsiderBuild" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "ShowClockSeconds" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "DaylightSavingMode" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "CPanelView" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "EdgeSC" /f
- '<SYSTEM32>\wbem\wmic.exe' OS GET LocalDateTime /value
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v "InstallSuccess" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "BuildBranch" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "BuildBranch"
- '%WINDIR%\syswow64\cmd.exe' /c WMIC /locale:ms_409 os get osarchitecture /value 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 os get osarchitecture /value
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" ECHO "64-bit " "
- '<SYSTEM32>\findstr.exe' /i "64"
- '<SYSTEM32>\findstr.exe' /i "32"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v "Release" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v "Release"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v "Version" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v "Version"
- '%WINDIR%\syswow64\cmd.exe' /c dir /B /A:D "%WINDIR%\Microsoft.NET\Framework" | FindStr /i "v1" 2>nul
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" dir /B /A:D "%WINDIR%\Microsoft.NET\Framework" "
- '<SYSTEM32>\findstr.exe' /i "v1"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild" 2>nul
- '%WINDIR%\syswow64\cmd.exe' /c dir /B /A:D "%WINDIR%\Microsoft.NET\Framework" | FindStr /i "v2" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "BuildLabEx"
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v "Enabled"
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Temp\extract.cmd" > NUL"
- '<SYSTEM32>\mode.com' con cols=55 lines=5
- '<SYSTEM32>\attrib.exe' "%WINDIR%\Setup\MRP3" +h +s
- '<SYSTEM32>\reg.exe' add "HKLM\Software\MRP3" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\MRP3\DataVars" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\MRP3\DataVars" /v "MRP_ReLocationFlag" /t REG_SZ /d "Yes" /f
- '%WINDIR%\syswow64\cmd.exe' /c ver
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "AsyncRunOnce" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "AsyncRunOnce"
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "!CleanMRPup" /t REG_SZ /d "%WINDIR%\CleanUpMRP.cmd" /f
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v "ImageState" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v "ImageState"
- '%WINDIR%\syswow64\cmd.exe' /c "WMIC /locale:ms_409 CPU GET Architecture /value" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 CPU GET Architecture /value
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v "Enabled" 2>nul
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "BuildLabEx" 2>nul
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine" /v "PSCompatibleVersion" 2>nul | FINDstr /I "PSCompatibleVersion" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "InstallationType"
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v "InstallSuccess"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\1" /v "Install"
- '<SYSTEM32>\findstr.exe' /I "Install"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\3" /v "Install" 2>nul | FINDstr /I "Install" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\3" /v "Install"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\ScriptedDiagnostics" /v "ExecutionPolicy" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\ScriptedDiagnostics" /v "ExecutionPolicy"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\CScript.exe //nologo "Isw11.vbs" 2>Nul
- '<SYSTEM32>\cscript.exe' //nologo "Isw11.vbs"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "EditionID" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "EditionID"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "InstallationType" 2>nul
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\1" /v "Install" 2>nul | FINDstr /I "Install" 2>nul
- '%WINDIR%\syswow64\cmd.exe' /c WMIC OS GET LocalDateTime /value 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine" /v "PSCompatibleVersion"
- '<SYSTEM32>\findstr.exe' /I "PSCompatibleVersion"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v "Version" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v "Version"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.5" /v "Install" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.5" /v "Install"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.5" /v "Version" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.5" /v "Version"
- '%WINDIR%\syswow64\cmd.exe' /c dir /B /A:D "%WINDIR%\Microsoft.NET\Framework" | FindStr /i "v4" 2>nul
- '<SYSTEM32>\findstr.exe' /i "v4"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v "PowerShellVersion" 2>nul | FINDstr /I "PowerShellVersion" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v "PowerShellVersion"
- '<SYSTEM32>\findstr.exe' /I "PowerShellVersion"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine" /v "PowerShellVersion" 2>nul | FINDstr /I "PowerShellVersion" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine" /v "PowerShellVersion"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v "PSCompatibleVersion" 2>nul | FINDstr /I "PSCompatibleVersion" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v "PSCompatibleVersion"
- '<SYSTEM32>\findstr.exe' /i "v2"
- '<SYSTEM32>\attrib.exe' "%ALLUSERSPROFILE%\TempM" +h
