Trojan.Siggen36.26625

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsCache' = '"%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe" --mnr-task'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\windowscache
%APPDATA%\microsoft\windows\start menu\programs\startup\windowscache.vbs
<SYSTEM32>\tasks\firefox
<SYSTEM32>\tasks\wudfhost

Вредоносные функции

Для затруднения выявления своего присутствия в системе

блокирует:

Средство контроля пользовательских учетных записей (UAC)

добавляет исключения антивируса с помощью следующих ключей реестра:

[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Полный путь к файлу>' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Processes] '<Полный путь к файлу>' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] '.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<Полный путь к файлу>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] 'SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Processes] '<Полный путь к файлу>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Extensions] '.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Caches\rt\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Текущая директория>\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\WinInetCache\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\Explorer\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Update\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\Windows\Themes\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%APPDATA%\Microsoft\COMWindows\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<Полный путь к файлу>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftUpdateHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheAssistant.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheHealth.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\miner.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\xmrig.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SRBMiner-MULTI.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\checker.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\watchdog.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] 'SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '%LOCALAPPDATA%\Microsoft\Windows\Caches\SettingsSync.exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes] '<Полный путь к файлу>' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions] '.exe' = '00000000'

Патчит код

в динамической библиотеке

Процесс microsoftcacheworker.exe, модуль win32u.dll

в динамической библиотеке NTDLL

Процесс microsoftcacheworker.exe, модуль ntdll.dll

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\microsoft\windows\caches\last_user.json
%LOCALAPPDATA%\microsoft\windows\caches\last_donate.json
%LOCALAPPDATA%\microsoft\windows\caches\build.json
%LOCALAPPDATA%\microsoft\windows\caches\taskmgr_hook.dll
%TEMP%\wininetcache\g3.exe
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheassistant.exe
%TEMP%\mnr_windowscache.xml
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheworker.exe
%LOCALAPPDATA%\microsoft\windows\caches\winring0x64.sys
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcachehealth.exe
%LOCALAPPDATA%\microsoft help\firefox.exe
%ProgramFiles(x86)%\opera\wudfhost.exe
%LOCALAPPDATA%\microsoft\windows\caches\runtime_donate_phase.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_stage.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_status.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_duty.json
%LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png

Присваивает атрибут 'скрытый' для следующих файлов

%LOCALAPPDATA%\microsoft\windows\caches\last_user.json
%LOCALAPPDATA%\microsoft\windows\caches\last_donate.json
%LOCALAPPDATA%\microsoft\windows\caches\build.json
%LOCALAPPDATA%\microsoft\windows\caches\taskmgr_hook.dll
%TEMP%\wininetcache\g3.exe
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheassistant.exe
%APPDATA%\microsoft\windows\start menu\programs\startup\windowscache.vbs
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheworker.exe
%LOCALAPPDATA%\microsoft\windows\caches\winring0x64.sys
%LOCALAPPDATA%\microsoft\windows\caches\microsoftcachehealth.exe
%LOCALAPPDATA%\microsoft help\firefox.exe
%ProgramFiles(x86)%\opera\wudfhost.exe
%LOCALAPPDATA%\microsoft\windows\caches\runtime_donate_phase.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_stage.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_status.json
%LOCALAPPDATA%\microsoft\windows\caches\gpu_duty.json

Удаляет файлы, которые сам же создал

%TEMP%\mnr_windowscache.xml

Подменяет следующие файлы

%TEMP%\mnr_windowscache.xml

Сетевая активность

Подключается к

'pa###bin.com':443
'localhost':42371
'gi##ab.com':443

TCP

Другие

'pa###bin.com':443
'gi##ab.com':443

UDP

DNS ASK dn#.google
DNS ASK pa###bin.com
DNS ASK gi##ab.com
'dn#.google':443
'19#.#26.98.121':443

Другое

Создает и запускает на исполнение

'%TEMP%\wininetcache\g3.exe'
'%LOCALAPPDATA%\microsoft\windows\caches\microsoftcachehealth.exe'
'%ProgramFiles(x86)%\opera\wudfhost.exe'
'%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheworker.exe' --algorithm-gpu pearlhash --disable-cpu --disable-worker-watchdog --disable-gpu-intel --gpu-disable-oc --log-file gpu_srb.log --log-file-mode 0 --pool pearl-eu2.luckypool.io:3360,de.pearl.herom...

Запускает на исполнение

'<SYSTEM32>\schtasks.exe' /Create /F /TN WindowsCache /XML "%TEMP%\mnr_WindowsCache.xml" (со скрытым окном)
'<SYSTEM32>\schtasks.exe' /Delete /F /TN WindowsCacheBoot (со скрытым окном)
'<SYSTEM32>\netsh.exe' advfirewall firewall delete rule program="%LOCALAPPDATA%\Microsoft\Windows\Caches\MicrosoftCacheWorker.exe" (со скрытым окном)
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' (со скрытым окном)
'<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s UmRdpService
'<SYSTEM32>\cmd.exe' /c set
'%LOCALAPPDATA%\microsoft\windows\caches\microsoftcachehealth.exe' (со скрытым окном)
'%LOCALAPPDATA%\microsoft\windows\caches\microsoftcacheworker.exe' --algorithm-gpu pearlhash --disable-cpu --disable-worker-watchdog --disable-gpu-intel --gpu-disable-oc --log-file gpu_srb.log --log-file-mode 0 --pool pearl-eu2.luckypool.io:3360,de.pearl.herom... (со скрытым окном)

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней