Trojan.KillFiles2.2614

Technical Information

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im FiveM.exe
'<SYSTEM32>\taskkill.exe' /f /im FiveM_Process.exe
'<SYSTEM32>\taskkill.exe' /f /im Steam.exe

Launches a large number of processes

Modifies file system

Creates the following files

nul
<Current directory>\null

Deletes the following files

%WINDIR%\Prefetch\42.0.2311.135_CHROME_INSTALLE-7FD75326.pf
%WINDIR%\Prefetch\THUNDERBIRD.EXE-5119524C.pf
%WINDIR%\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf
%WINDIR%\Prefetch\TSETUP.1.4.3.EXE-EF3D6F27.pf
%WINDIR%\Prefetch\TSETUP.1.4.3.TMP-56512EE9.pf
%WINDIR%\Prefetch\UNINSTALL.EXE-A11D6B07.pf
%WINDIR%\Prefetch\UNPACK200.EXE-BB96DA5F.pf
%WINDIR%\Prefetch\UNREGMP2.EXE-2294B148.pf
%WINDIR%\Prefetch\VCREDIST_X64.EXE-24AEA5D8.pf
%WINDIR%\Prefetch\VCREDIST_X64.EXE-8227A7EF.pf
%WINDIR%\Prefetch\VCREDIST_X64.EXE-A53F124B.pf
%WINDIR%\Prefetch\VCREDIST_X64.EXE-D4929C6B.pf
%WINDIR%\Prefetch\VCREDIST_X86.EXE-163EFD5C.pf
%WINDIR%\Prefetch\VCREDIST_X86.EXE-73B7FF73.pf
%WINDIR%\Prefetch\VCREDIST_X86.EXE-96CF69CF.pf
%WINDIR%\Prefetch\VCREDIST_X86.EXE-C622F3EF.pf
%WINDIR%\Prefetch\THUNDERBIRD SETUP 78.9.1 (X64-07C878F8.pf
%WINDIR%\Prefetch\SETUP.EXE-663C249B.pf
%WINDIR%\Prefetch\TASKHOST.EXE-7238F31D.pf
%WINDIR%\Prefetch\SVCHOST.EXE-CF79EE4C.pf
%WINDIR%\Prefetch\SETUP.EXE-BED2EC70.pf
%WINDIR%\Prefetch\SETUP.EXE-D38BBFDE.pf
%WINDIR%\Prefetch\SETX.EXE-A7E52BF4.pf
%WINDIR%\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf
%WINDIR%\Prefetch\SIDEBAR.EXE-FA75EA61.pf
%WINDIR%\Prefetch\SMSS.EXE-E9C28FC6.pf
%WINDIR%\Prefetch\SPOOLSV.EXE-D1F6B8B6.pf
%WINDIR%\Prefetch\SPPSVC.EXE-B0F8131B.pf
%WINDIR%\Prefetch\STEAMSERVICE.EXE-57E215D3.pf
%WINDIR%\Prefetch\STEAMSETUP_2.10.91.91.EXE-91D3EED3.pf
%WINDIR%\Prefetch\SVCHOST.EXE-007FEA55.pf
%WINDIR%\Prefetch\SVCHOST.EXE-05F624AB.pf
%WINDIR%\Prefetch\SVCHOST.EXE-63699C7D.pf
%WINDIR%\Prefetch\SVCHOST.EXE-7CFEDEA3.pf
%WINDIR%\Prefetch\SVCHOST.EXE-95B0C790.pf
%WINDIR%\Prefetch\SVCHOST.EXE-FEDB32D0.pf
%WINDIR%\Prefetch\SETUP.EXE-7C026C7F.pf
%WINDIR%\Prefetch\VC_REDIST.X64.EXE-26342EFB.pf
%WINDIR%\Prefetch\VC_REDIST.X64.EXE-625F2779.pf
%WINDIR%\Prefetch\WMIADAP.EXE-F8DFDFA2.pf
%WINDIR%\Prefetch\WMIPRVSE.EXE-1628051C.pf
%WINDIR%\Prefetch\WUAUCLT.EXE-70318591.pf
%WINDIR%\Prefetch\WUSA.EXE-F04B35C8.pf
%WINDIR%\Prefetch\XCOPY.EXE-41E6513F.pf
%WINDIR%\temp\dmiacf5.tmp
%WINDIR%\Prefetch\OSE.EXE-51C16F0E.pf
%WINDIR%\Temp\fwtsqmfile00.sqm
%WINDIR%\temp\ts_5a4a.tmp
%WINDIR%\temp\ts_5b54.tmp
%WINDIR%\temp\ts_624b.tmp
%WINDIR%\temp\ts_67ca.tmp
%WINDIR%\temp\ts_6ab9.tmp
%WINDIR%\temp\ts_6d1b.tmp
%WINDIR%\Prefetch\WINMAIL.EXE-F551299C.pf
%WINDIR%\Prefetch\WINRAR-X64-531.EXE-91D4B934.pf
%WINDIR%\Prefetch\VC_REDIST.X64.EXE-442857D9.pf
%WINDIR%\Prefetch\VC_REDIST.X64.EXE-2C3B2083.pf
%WINDIR%\Prefetch\WININIT.EXE-5322684A.pf
%WINDIR%\Prefetch\VC_REDIST.X64.EXE-B0C890FD.pf
%WINDIR%\Prefetch\VC_REDIST.X64.EXE-D3A3C549.pf
%WINDIR%\Prefetch\VC_REDIST.X86.EXE-1C5672A5.pf
%WINDIR%\Prefetch\VC_REDIST.X86.EXE-1DCB7807.pf
%WINDIR%\Prefetch\VC_REDIST.X86.EXE-35B8AF5D.pf
%WINDIR%\Prefetch\VC_REDIST.X86.EXE-380848FE.pf
%WINDIR%\Prefetch\VC_REDIST.X86.EXE-473D0913.pf
%WINDIR%\Prefetch\VC_REDIST.X86.EXE-4DA5E6B3.pf
%WINDIR%\Prefetch\VC_REDIST.X86.EXE-92EB15BB.pf
%WINDIR%\Prefetch\VSSVC.EXE-B8AFC319.pf
%WINDIR%\Prefetch\WERMGR.EXE-0F2AC88C.pf
%WINDIR%\Prefetch\WEVTUTIL.EXE-400D93E8.pf
%WINDIR%\Prefetch\WEVTUTIL.EXE-EF5861C4.pf
%WINDIR%\Prefetch\WINLOGON.EXE-B020DC41.pf
%WINDIR%\Prefetch\VC_REDIST.X64.EXE-5C158F2F.pf
%WINDIR%\Prefetch\WINMAIL.EXE-1092D371.pf
%WINDIR%\Prefetch\SETUP.EXE-421F8E21.pf
%WINDIR%\Prefetch\SETUP.EXE-2EF91A4E.pf
%WINDIR%\Prefetch\SETUP.EXE-2D9F1C3B.pf
%WINDIR%\Prefetch\DLLHOST.EXE-B2EB1806.pf
%WINDIR%\Prefetch\DRVINST.EXE-4CB4314A.pf
%WINDIR%\Prefetch\FIREFOX SETUP 78.0.2.EXE-691327D9.pf
%WINDIR%\Prefetch\FIREFOX.EXE-18ACFCFF.pf
%WINDIR%\Prefetch\IE4UINIT.EXE-3A7E0C67.pf
%WINDIR%\Prefetch\IE4UINIT.EXE-8B333E8B.pf
%WINDIR%\Prefetch\INSTALL.EXE-7D6E11A9.pf
%WINDIR%\Prefetch\INSTALLER.EXE-5857FAFB.pf
%WINDIR%\Prefetch\INSTALLER.EXE-6C3AB888.pf
%WINDIR%\Prefetch\JAUREG.EXE-2358F266.pf
%WINDIR%\Prefetch\JAVAW.EXE-DCCF0AB8.pf
%WINDIR%\Prefetch\JAVAWS.EXE-ED58C697.pf
%WINDIR%\Prefetch\JP2LAUNCHER.EXE-7DCCD1B9.pf
%WINDIR%\Prefetch\JRE-8U45-WINDOWS-X64.EXE-61CC34B3.pf
%WINDIR%\Prefetch\DLLHOST.EXE-5E46FA0D.pf
%WINDIR%\Prefetch\LSASS.EXE-419F2D06.pf
%WINDIR%\Prefetch\DEFAULT-BROWSER-AGENT.EXE-91AA6C8A.pf
%WINDIR%\Prefetch\CONHOST.EXE-1F3E9D7E.pf
%WINDIR%\Prefetch\ACRORDRDC1501020056_EN_US.EXE-3B58C109.pf
%WINDIR%\Prefetch\AgAppLaunch.db
%WINDIR%\Prefetch\AgGlFaultHistory.db
%WINDIR%\Prefetch\AgGlFgAppHistory.db
%WINDIR%\Prefetch\AgGlGlobalHistory.db
%WINDIR%\Prefetch\AgGlUAD_P_S-1-5-21-1238866942-1249195528-555854008-1000.db
%WINDIR%\Prefetch\AgGlUAD_S-1-5-21-1238866942-1249195528-555854008-1000.db
%WINDIR%\prefetch\agrobust.db
%WINDIR%\Prefetch\AUDIODG.EXE-BDFD3029.pf
%WINDIR%\Prefetch\BFSVC.EXE-9C7A4DEE.pf
%WINDIR%\Prefetch\BSPATCH.EXE-DD9E5E46.pf
%WINDIR%\Prefetch\CHROME.EXE-5617A1BF.pf
%WINDIR%\Prefetch\CLRGC.EXE-5D5B90F5.pf
%WINDIR%\Prefetch\CMD.EXE-4A81B364.pf
%WINDIR%\Prefetch\CMD.EXE-AC113AA8.pf
%WINDIR%\Prefetch\CSRSS.EXE-3FE41F7E.pf
%WINDIR%\Prefetch\LSM.EXE-E22FF25C.pf
%WINDIR%\Prefetch\DLLHOST.EXE-766398D2.pf
%WINDIR%\Prefetch\MCTADMIN.EXE-C9CFA3B9.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-36DAC103.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-685A8F09.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-7438E4D5.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-860C49A4.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-9CC17D45.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-A148E651.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-C211633D.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-E6258EDF.pf
%WINDIR%\Prefetch\SEARCHFILTERHOST.EXE-77482212.pf
%WINDIR%\Prefetch\SEARCHINDEXER.EXE-4A6353B9.pf
%WINDIR%\Prefetch\SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf
%WINDIR%\Prefetch\SERVICES.EXE-511D36F4.pf
%WINDIR%\Prefetch\SETUP.EXE-04541C92.pf
%WINDIR%\Prefetch\SETUP.EXE-2078B256.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-038E6267.pf
%WINDIR%\Prefetch\REGSVR32.EXE-8461DBEE.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-46A5F75F.pf
%WINDIR%\Prefetch\REGSVR32.EXE-D5170E12.pf
%WINDIR%\Prefetch\REG.EXE-E7E8BD26.pf
%WINDIR%\Prefetch\MSCORSVW.EXE-245ED79E.pf
%WINDIR%\Prefetch\MSIEXEC.EXE-A2D55CB6.pf
%WINDIR%\Prefetch\MSIEXEC.EXE-E09A077A.pf
%WINDIR%\Prefetch\NDP48-X86-X64-ALLOS-ENU.EXE-54656820.pf
%WINDIR%\Prefetch\NETSH.EXE-F1B6DA12.pf
%WINDIR%\Prefetch\NTOSBOOT-B00DFAAD.pf
%WINDIR%\Prefetch\OPERA_29.0.1795.47_SETUP.EXE-839F60FD.pf
%WINDIR%\temp\ts_947a.tmp
%WINDIR%\temp\ts_548c.tmp
%WINDIR%\Prefetch\OPERA_29.0.1795.47_SETUP.EXE-9C628850.pf
%WINDIR%\Prefetch\PfSvPerfStats.bin
%WINDIR%\Prefetch\RDRSERVICESUPDATER.EXE-3D26E665.pf
%WINDIR%\Prefetch\ReadyBoot\Trace1.fx
%WINDIR%\Prefetch\ReadyBoot\Trace2.fx
%WINDIR%\Prefetch\ReadyBoot\Trace3.fx
%WINDIR%\Prefetch\ReadyBoot\Trace4.fx
%WINDIR%\Prefetch\MSCORSVW.EXE-90526FAC.pf
%WINDIR%\Prefetch\OSE00000.EXE-2A4EFDBF.pf
%WINDIR%\temp\ts_996d.tmp

Network activity

UDP

DNS ASK DE####P-24327.24330
'localhost':61169
'localhost':52911
'localhost':56296

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'<SYSTEM32>\cmd.exe' /C rmdir /s /q "C:\Users\%username%\AppData\Local\DigitalEntitlements' (with hidden window)
'<SYSTEM32>\cmd.exe' /C REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /f /v MachineGuid /t REG_SZ /d ValeurTestpm3ueszr2mxf' (with hidden window)
'<SYSTEM32>\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001" /f /v HwProfileGuid /t REG_SZ /d {1b7803eb-da69-11ea-a112-ipm86hlstykk}' (with hidden window)
'<SYSTEM32>\cmd.exe' /C rmdir /s /q C:\Users\%username%\AppData\Local\FiveM\cache\game\ros_profiles' (with hidden window)
'<SYSTEM32>\cmd.exe' /C rmdir /s /q C:\Users\%username%\AppData\Local\FiveM\FiveM.app\cache\game\ros_profiles' (with hidden window)
'<SYSTEM32>\cmd.exe' /C rmdir /s /q "C:\Users\%username%\AppData\Local\FiveM\cache\priv' (with hidden window)
'<SYSTEM32>\cmd.exe' /C del "C:\Users\%username%\AppData\Local\FiveM\asi-five.dll' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c sc stop HTTPDebuggerPro >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWAREMicrosoft\Windows" "NT\CurrentVersion\Notifications\Data /v 418A073AA3BC3475 /t REG_BINARY /d 243211135028316206493093631350603126903357022329187430958 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWAREMicrosoft\Windows" "NT\CurrentVersion\Notifications\Data /v 418A073AA3BC3475 /t REG_BINARY /d %random%%random%%random%%random%%random%%random%%random%%random%%random%%ra...
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v REGisteredOrganization /t REG_SZ /d 24314 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v REGisteredOrganization /t REG_SZ /d %random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v REGisteredOwner /t REG_SZ /d 24314 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v REGisteredOwner /t REG_SZ /d %random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d 24311 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d %random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Direct3D /v WHQLClass /t REG_BINARY /d 24308112522395227002244515643263495845306014153246530782 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKCU\Software\Microsoft\Direct3D /v WHQLClass /t REG_BINARY /d %random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\NVIDIA" "Corporation\Global\CoProcManager /v ChipsetMatchID /t REG_SZ /d Kaykl-24304-23144-453131405 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\NVIDIA" "Corporation\Global\CoProcManager /v ChipsetMatchID /t REG_SZ /d Kaykl-%random%-%random%-%random%%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\NVIDIA" "Corporation\Global /v PersistenceIdentifier /t REG_SZ /d Kaykl-24304-23144-453131405 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\NVIDIA" "Corporation\Global /v PersistenceIdentifier /t REG_SZ /d Kaykl-%random%-%random%-%random%%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001" /f /v HwProfileGuid /t REG_SZ /d {1b7803eb-da69-11ea-a112-ipm86hlstykk}
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\NVIDIA" "Corporation\Global /v ClientUUID /t REG_SZ /d Kaykl-24301-12396-194357341 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\NVIDIA" "Corporation\Global /v ClientUUID /t REG_SZ /d Kaykl-%random%-%random%-%random%%random% /f >nul 2>&1
'<SYSTEM32>\cmd.exe' /C REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware Profiles\0001" /f /v HwProfileGuid /t REG_SZ /d {1b7803eb-da69-11ea-a112-ipm86hlstykk}
'<SYSTEM32>\reg.exe' ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /f /v MachineGuid /t REG_SZ /d ValeurTestpm3ueszr2mxf
'<SYSTEM32>\cmd.exe' /C REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /f /v MachineGuid /t REG_SZ /d ValeurTestpm3ueszr2mxf
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-EventTracing/Admin /v OwningPublisher /t REG_SZ /d {24285-24190-2841818097} /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-EventTracing/Admin /v OwningPublisher /t REG_SZ /d {%random%-%random%-%random%%random%} /f >nu...
'<SYSTEM32>\reg.exe' ADD HKLM\System\CurrentControlSet\Control\Notifications /v 418A073AA3BC8075 /t REG_BINARY /d 24281134411055326802546516997145029263203930570364930429 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\System\CurrentControlSet\Control\Notifications /v 418A073AA3BC8075 /t REG_BINARY /d %random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%random%%rand...
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\SevilleEventlogManager /v LastEventlogWrittenTime /t REG_QWORD /d 24278269325457 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\SevilleEventlogManager /v LastEventlogWrittenTime /t REG_QWORD /d %random%%random%%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\SoftwareProtectionPlatform /v ServiceSessionId /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d DESKTOP-%random% /f >nul 2>&1
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d DESKTOP-%random% /f >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Steam.exe >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d DESKTOP-24324 /f
'<SYSTEM32>\cmd.exe' /c rmdir /s /q %systemdrive%\Windows\temp >nul 2>&1
'<SYSTEM32>\cmd.exe' /c rmdir /s /q %systemdrive%\Windows\Temp
'<SYSTEM32>\cmd.exe' /c rmdir /s /q %WINDIR%\temp
'<SYSTEM32>\cmd.exe' /c rmdir /s /q %ALLUSERSPROFILE%\Microsoft\Windows\WER\Temp
'<SYSTEM32>\cmd.exe' /c rmdir /s /q %systemdrive%\Windows\Prefetch
'<SYSTEM32>\cmd.exe' /c taskkill /f /im FiveM_Process.exe >nul 2>&1
'<SYSTEM32>\cmd.exe' /c taskkill /f /im FiveM.exe >nul 2>&1
'<SYSTEM32>\netsh.exe' advfirewall reset
'<SYSTEM32>\cmd.exe' /c netsh advfirewall reset >nul 2>&1
'<SYSTEM32>\ipconfig.exe' /renew
'<SYSTEM32>\cmd.exe' /c ipconfig /renew >nul 2>&1
'<SYSTEM32>\ipconfig.exe' /release
'<SYSTEM32>\cmd.exe' /c ipconfig /release >nul 2>&1
'<SYSTEM32>\cmd.exe' /C del "C:\Users\%username%\AppData\Local\FiveM\asi-five.dll
'<SYSTEM32>\cmd.exe' /C rmdir /s /q "C:\Users\%username%\AppData\Local\FiveM\cache\priv
'<SYSTEM32>\cmd.exe' /C rmdir /s /q C:\Users\%username%\AppData\Local\FiveM\FiveM.app\cache\game\ros_profiles
'<SYSTEM32>\cmd.exe' /C rmdir /s /q C:\Users\%username%\AppData\Local\FiveM\cache\game\ros_profiles
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientIdValidation /t REG_BINARY /d 2433732324193329894169731821621593122672059224356113431178 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientIdValidation /t REG_BINARY /d %random%%random%%random%%random%%random%%random%%random%%random%%random%%random...
'<SYSTEM32>\reg.exe' ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardProduct /t REG_SZ /d kaykl-24334215761468 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardProduct /t REG_SZ /d kaykl-%random%%random%%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientId /t REG_SZ /d Kaykl24330-10828-16372-27303 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate /v SusClientId /t REG_SZ /d Kaykl%random%-%random%-%random%-%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v Domain /t REG_SZ /d 24330 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v Domain /t REG_SZ /d %random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v Hostname /t REG_SZ /d DESKTOP-24327 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v Hostname /t REG_SZ /d DESKTOP-%random% /f >nul 2>&1
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\SoftwareProtectionPlatform /v ServiceSessionId /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d DESKTOP-24321 /f
'<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\SoftwareProtectionPlatform /v actionlist /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareIds /t REG_SZ /d Kaykl-%random%-%random%-%random%%random% /f >nul 2>&1
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d Kaykl-%random%-%random%-%random%%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\mouhid\Parameters /v WppRecorder_TraceGuid /t REG_SZ /d {Kaykl-24232-16055-473526300} /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\ControlSet001\Services\mouhid\Parameters /v WppRecorder_TraceGuid /t REG_SZ /d {Kaykl-%random%-%random%-%random%%random%} /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\ControlSet001\Services\kbdclass\Parameters /v WppRecorder_TraceGuid /t REG_SZ /d {Kaykl-24232-16055-473526300} /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\ControlSet001\Services\kbdclass\Parameters /v WppRecorder_TraceGuid /t REG_SZ /d {Kaykl-%random%-%random%-%random%%random%} /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\HardwareConfig\Current /v BaseBoardProduct /t REG_SZ /d Kaykl-24229530719639 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\HardwareConfig\Current /v BaseBoardProduct /t REG_SZ /d Kaykl-%random%%random%%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' delete HKLM\System\CurrentControlSet\Control\TimeZoneInformation /f
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\System\CurrentControlSet\Control\TimeZoneInformation /f >nul 2>&1
'<SYSTEM32>\reg.exe' delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket /v LastEnum /f
'<SYSTEM32>\cmd.exe' /c reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket /v LastEnum /f >nul 2>&1
'<SYSTEM32>\reg.exe' delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 /f
'<SYSTEM32>\cmd.exe' /c reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 /f >nul 2>&1
'<SYSTEM32>\reg.exe' delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume /f
'<SYSTEM32>\cmd.exe' /c reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume /f >nul 2>&1
'<SYSTEM32>\reg.exe' delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume /f
'<SYSTEM32>\cmd.exe' /c reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume /f >nul 2>&1
'<SYSTEM32>\cmd.exe' /C rmdir /s /q "C:\Users\%username%\AppData\Local\DigitalEntitlements
'<SYSTEM32>\sc.exe' stop wireshark
'<SYSTEM32>\cmd.exe' /c sc stop wireshark >nul 2>&1
'<SYSTEM32>\sc.exe' stop KProcessHacker1
'<SYSTEM32>\cmd.exe' /c sc stop KProcessHacker1 >nul 2>&1
'<SYSTEM32>\sc.exe' stop KProcessHacker2
'<SYSTEM32>\cmd.exe' /c sc stop KProcessHacker2 >nul 2>&1
'<SYSTEM32>\sc.exe' stop KProcessHacker3
'<SYSTEM32>\cmd.exe' /c sc stop KProcessHacker3 >nul 2>&1
'<SYSTEM32>\sc.exe' stop HTTPDebuggerPro
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareId /t REG_SZ /d Kaykl-24236-26804-2259917595 /f
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v ComputerHardwareIds /t REG_SZ /d Kaykl-24239-4784-76958890 /f
'<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\SoftwareProtectionPlatform /v BackupProductKeyDefault /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemProductName /t REG_SZ /d Kaykl%random% /f >nul 2>&1
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\SoftwareProtectionPlatform /v BackupProductKeyDefault /f >nul 2>&1
'<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\SettingsRequests /f
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\SettingsRequests /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v UserModeDriverGUID /t REG_SZ /d Paste-24268-3216-463328852 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v UserModeDriverGUID /t REG_SZ /d Paste-%random%-%random%-%random%%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v _DriverProviderInfo /t REG_SZ /d Paste-24265-25235-195374789 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v _DriverProviderInfo /t REG_SZ /d Paste-%random%-%random%-%random%%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' delete HKCU\Software\Classes\Interface /v ClsidStore /f
'<SYSTEM32>\cmd.exe' /c reg delete HKCU\Software\Classes\Interface /v ClsidStore /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildLabEx /t REG_SZ /d 24259 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildLabEx /t REG_SZ /d %random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallTime /t REG_SZ /d 24259 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallTime /t REG_SZ /d %random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d 24255 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v InstallDate /t REG_SZ /d %random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d Kaykl24252-15010-13616-6840 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v ProductId /t REG_SZ /d Kaykl%random%-%random%-%random%-%random% /f >nul 2>&1
'<SYSTEM32>\cmd.exe' /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings >nul 2>&1
'<SYSTEM32>\cmd.exe' /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache >nul 2>&1
'<SYSTEM32>\cmd.exe' /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v DigitalProductId4 /t REG_BINARY /d 242494261285201554462310498309325768763 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v DigitalProductId4 /t REG_BINARY /d %random%%random%%random%%random%%random%%random%%random%%random%%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v DigitalProductId /t REG_BINARY /d 24246262811065624249230766571327492869517019 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v DigitalProductId /t REG_BINARY /d %random%%random%%random%%random%%random%%random%%random%%random%%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d Kaykl24242 /f
'<SYSTEM32>\cmd.exe' /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d Kaykl%random% /f >nul 2>&1
'<SYSTEM32>\reg.exe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemProductName /t REG_SZ /d Kaykl24239 /f
'<SYSTEM32>\cmd.exe' /c reg delete HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\SoftwareProtectionPlatform /v actionlist /f >nul 2>&1
'<SYSTEM32>\cmd.exe' /c del C:\Users\%username%\AppData\Local\Microsoft\Feeds Cache > null

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial