Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {078fed71-52f2-4a49-a0ab-6453e2ca72ba}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {078fed71-52f2-4a49-a0ab-6453e2ca72ba}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {074e329a-2728-4255-8f51-cb2eaa0f1027}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {074e329a-2728-4255-8f51-cb2eaa0f1027}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {078fed71-52f2-4a49-a0ab-6453e2ca72ba}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {078fed71-52f2-4a49-a0ab-6453e2ca72ba}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {078fed71-52f2-4a49-a0ab-6453e2ca72ba}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {078fed71-52f2-4a49-a0ab-6453e2ca72ba}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {074e329a-2728-4255-8f51-cb2eaa0f1027}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {0722a2ac-4cf8-4310-afee-f87aa9be10aa}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {0722a2ac-4cf8-4310-afee-f87aa9be10aa}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {0722a2ac-4cf8-4310-afee-f87aa9be10aa}
- '<SYSTEM32>\reg.exe' /pid=3452
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {074e329a-2728-4255-8f51-cb2eaa0f1027}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {074e329a-2728-4255-8f51-cb2eaa0f1027}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {074e329a-2728-4255-8f51-cb2eaa0f1027}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {074e329a-2728-4255-8f51-cb2eaa0f1027}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {078fed71-52f2-4a49-a0ab-6453e2ca72ba}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {07b7f771-1b8e-4b7b-823e-ffac1732aa9f}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {07b7f771-1b8e-4b7b-823e-ffac1732aa9f}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {07b7f771-1b8e-4b7b-823e-ffac1732aa9f}
- '<SYSTEM32>\taskkill.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {07b7f771-1b8e-4b7b-823e-ffac1732aa9f}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {082c74b9-c1a7-42b0-a2a3-e520e1ea81d1}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {082c74b9-c1a7-42b0-a2a3-e520e1ea81d1}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {07b7f771-1b8e-4b7b-823e-ffac1732aa9f}
- '<SYSTEM32>\taskkill.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {082c74b9-c1a7-42b0-a2a3-e520e1ea81d1}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {07b7f771-1b8e-4b7b-823e-ffac1732aa9f}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {07b18eac-a523-4961-b6bb-170de4475cca}
- '<SYSTEM32>\findstr.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {07b18eac-a523-4961-b6bb-170de4475cca}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {07b18eac-a523-4961-b6bb-170de4475cca}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {07b18eac-a523-4961-b6bb-170de4475cca}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {07b7f771-1b8e-4b7b-823e-ffac1732aa9f}
- '<SYSTEM32>\taskkill.exe' /pid=3508
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {07b18eac-a523-4961-b6bb-170de4475cca}
- '<SYSTEM32>\findstr.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {07b18eac-a523-4961-b6bb-170de4475cca}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {0722a2ac-4cf8-4310-afee-f87aa9be10aa}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {063812c7-dbeb-467f-a9c2-8270462f54f9}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {063812c7-dbeb-467f-a9c2-8270462f54f9}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {063812c7-dbeb-467f-a9c2-8270462f54f9}
- '<SYSTEM32>\taskkill.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {063812c7-dbeb-467f-a9c2-8270462f54f9}
- '<SYSTEM32>\taskkill.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {063812c7-dbeb-467f-a9c2-8270462f54f9}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {067c5591-c9fb-4dcc-835f-6cb5dc169d41}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {063812c7-dbeb-467f-a9c2-8270462f54f9}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {063812c7-dbeb-467f-a9c2-8270462f54f9}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {05d31295-1b4c-4812-8776-5cc1df279aaf}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {05d31295-1b4c-4812-8776-5cc1df279aaf}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {05d31295-1b4c-4812-8776-5cc1df279aaf}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {04c7b109-8162-a0d6-b186-dbe176064a3e}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {05d31295-1b4c-4812-8776-5cc1df279aaf}
- '<SYSTEM32>\findstr.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {05d31295-1b4c-4812-8776-5cc1df279aaf}
- '<SYSTEM32>\findstr.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {05d31295-1b4c-4812-8776-5cc1df279aaf}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {05d31295-1b4c-4812-8776-5cc1df279aaf}
- '<SYSTEM32>\findstr.exe' /pid=3480
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {067c5591-c9fb-4dcc-835f-6cb5dc169d41}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {06c050b6-ce38-4f3a-b865-5707182d6e3c}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {06c050b6-ce38-4f3a-b865-5707182d6e3c}
- '<SYSTEM32>\taskkill.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {06c050b6-ce38-4f3a-b865-5707182d6e3c}
- '<SYSTEM32>\findstr.exe' /pid=4032
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {0722a2ac-4cf8-4310-afee-f87aa9be10aa}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0722a2ac-4cf8-4310-afee-f87aa9be10aa}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {06c050b6-ce38-4f3a-b865-5707182d6e3c}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {0722a2ac-4cf8-4310-afee-f87aa9be10aa}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {06c050b6-ce38-4f3a-b865-5707182d6e3c}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {067c5591-c9fb-4dcc-835f-6cb5dc169d41}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {067c5591-c9fb-4dcc-835f-6cb5dc169d41}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {067c5591-c9fb-4dcc-835f-6cb5dc169d41}
- '<SYSTEM32>\taskkill.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {067c5591-c9fb-4dcc-835f-6cb5dc169d41}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {06c050b6-ce38-4f3a-b865-5707182d6e3c}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {06c050b6-ce38-4f3a-b865-5707182d6e3c}
- '<SYSTEM32>\taskkill.exe' /pid=3844
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {067c5591-c9fb-4dcc-835f-6cb5dc169d41}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {082c74b9-c1a7-42b0-a2a3-e520e1ea81d1}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0bc6e3fa-78ef-4886-842c-5a1258c4455a}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {0bc6e3fa-78ef-4886-842c-5a1258c4455a}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {0bc6e3fa-78ef-4886-842c-5a1258c4455a}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {0bc6e3fa-78ef-4886-842c-5a1258c4455a}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {0bc6e3fa-78ef-4886-842c-5a1258c4455a}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {0becc7b3-d208-4379-90a8-b5205535ba5b}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {0bc6e3fa-78ef-4886-842c-5a1258c4455a}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {0bc6e3fa-78ef-4886-842c-5a1258c4455a}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {0abb1aed-804d-4cdf-b549-88c595fc2512}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {0abb1aed-804d-4cdf-b549-88c595fc2512}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {0abb1aed-804d-4cdf-b549-88c595fc2512}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {09c554c3-109b-483c-a06b-f14172f1a947}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {09c554c3-109b-483c-a06b-f14172f1a947}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {0abb1aed-804d-4cdf-b549-88c595fc2512}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {0abb1aed-804d-4cdf-b549-88c595fc2512}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0abb1aed-804d-4cdf-b549-88c595fc2512}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {0abb1aed-804d-4cdf-b549-88c595fc2512}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {0becc7b3-d208-4379-90a8-b5205535ba5b}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {0c2e030d-6ee7-44d3-9826-54e62745d95d}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {0c2e529c-a82c-4ac6-8807-0b51f7ad7bb2}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {0c2e030d-6ee7-44d3-9826-54e62745d95d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {0c2e030d-6ee7-44d3-9826-54e62745d95d}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {0c2e529c-a82c-4ac6-8807-0b51f7ad7bb2}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {0c2e529c-a82c-4ac6-8807-0b51f7ad7bb2}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {0c2e529c-a82c-4ac6-8807-0b51f7ad7bb2}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0c2e529c-a82c-4ac6-8807-0b51f7ad7bb2}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {0c2e030d-6ee7-44d3-9826-54e62745d95d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {0becc7b3-d208-4379-90a8-b5205535ba5b}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {0becc7b3-d208-4379-90a8-b5205535ba5b}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0becc7b3-d208-4379-90a8-b5205535ba5b}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {0becc7b3-d208-4379-90a8-b5205535ba5b}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {0c2e030d-6ee7-44d3-9826-54e62745d95d}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0c2e030d-6ee7-44d3-9826-54e62745d95d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {0becc7b3-d208-4379-90a8-b5205535ba5b}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {0c2e030d-6ee7-44d3-9826-54e62745d95d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {09c554c3-109b-483c-a06b-f14172f1a947}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {08ed9ab9-ce1c-4c28-9e43-0f561ab6f30d}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {08ed9ab9-ce1c-4c28-9e43-0f561ab6f30d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {08858af6-42ad-4914-95d2-ac3ab0dc8e28}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {08ed9ab9-ce1c-4c28-9e43-0f561ab6f30d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {08ed9ab9-ce1c-4c28-9e43-0f561ab6f30d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {08ed9ab9-ce1c-4c28-9e43-0f561ab6f30d}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {08ed9ab9-ce1c-4c28-9e43-0f561ab6f30d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {08ed9ab9-ce1c-4c28-9e43-0f561ab6f30d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {08858af6-42ad-4914-95d2-ac3ab0dc8e28}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {082c74b9-c1a7-42b0-a2a3-e520e1ea81d1}
- '<SYSTEM32>\taskkill.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {08858af6-42ad-4914-95d2-ac3ab0dc8e28}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {082c74b9-c1a7-42b0-a2a3-e520e1ea81d1}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {082c74b9-c1a7-42b0-a2a3-e520e1ea81d1}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {08858af6-42ad-4914-95d2-ac3ab0dc8e28}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {08858af6-42ad-4914-95d2-ac3ab0dc8e28}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {08858af6-42ad-4914-95d2-ac3ab0dc8e28}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {08858af6-42ad-4914-95d2-ac3ab0dc8e28}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {0974ba1e-64ec-11de-b2a5-e43756d89593}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {098facc1-3507-4be3-9d26-52b6916c24b9}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {098facc1-3507-4be3-9d26-52b6916c24b9}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {098facc1-3507-4be3-9d26-52b6916c24b9}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {098facc1-3507-4be3-9d26-52b6916c24b9}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {09c554c3-109b-483c-a06b-f14172f1a947}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {09c554c3-109b-483c-a06b-f14172f1a947}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {09c554c3-109b-483c-a06b-f14172f1a947}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {09c554c3-109b-483c-a06b-f14172f1a947}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {098facc1-3507-4be3-9d26-52b6916c24b9}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {0974ba1e-64ec-11de-b2a5-e43756d89593}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {0974ba1e-64ec-11de-b2a5-e43756d89593}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {0974ba1e-64ec-11de-b2a5-e43756d89593}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0974ba1e-64ec-11de-b2a5-e43756d89593}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {098facc1-3507-4be3-9d26-52b6916c24b9}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {098facc1-3507-4be3-9d26-52b6916c24b9}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {0974ba1e-64ec-11de-b2a5-e43756d89593}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {0974ba1e-64ec-11de-b2a5-e43756d89593}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {04c7b109-8162-a0d6-b186-dbe176064a3e}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {00cbb66b-1d3b-46d3-9577-323a336acb50}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {00cbb66b-1d3b-46d3-9577-323a336acb50}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {00a6faf1-072e-44cf-8957-5838f569a31d}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {00cbb66b-1d3b-46d3-9577-323a336acb50}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {00cbb66b-1d3b-46d3-9577-323a336acb50}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {00cbb66b-1d3b-46d3-9577-323a336acb50}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {00cbb66b-1d3b-46d3-9577-323a336acb50}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {00cbb66b-1d3b-46d3-9577-323a336acb50}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {00a6faf1-072e-44cf-8957-5838f569a31d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {000f18f2-09eb-4a59-82b2-5ae4184c39c3}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {00a6faf1-072e-44cf-8957-5838f569a31d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {000f18f2-09eb-4a59-82b2-5ae4184c39c3}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {000f18f2-09eb-4a59-82b2-5ae4184c39c3}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {00a6faf1-072e-44cf-8957-5838f569a31d}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {00a6faf1-072e-44cf-8957-5838f569a31d}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {00a6faf1-072e-44cf-8957-5838f569a31d}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {00a6faf1-072e-44cf-8957-5838f569a31d}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {011f9246-da13-4555-9998-6e4805bd533f}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {01398b87-61af-4ffb-9ab5-1a1c5fb39a9c}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {01398b87-61af-4ffb-9ab5-1a1c5fb39a9c}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {01398b87-61af-4ffb-9ab5-1a1c5fb39a9c}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {01398b87-61af-4ffb-9ab5-1a1c5fb39a9c}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {01bc00c7-1125-4e41-bd93-3266121fe690}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {01bc00c7-1125-4e41-bd93-3266121fe690}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {01bc00c7-1125-4e41-bd93-3266121fe690}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {01bc00c7-1125-4e41-bd93-3266121fe690}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {01398b87-61af-4ffb-9ab5-1a1c5fb39a9c}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {011f9246-da13-4555-9998-6e4805bd533f}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {011f9246-da13-4555-9998-6e4805bd533f}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {011f9246-da13-4555-9998-6e4805bd533f}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {011f9246-da13-4555-9998-6e4805bd533f}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {01398b87-61af-4ffb-9ab5-1a1c5fb39a9c}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {01398b87-61af-4ffb-9ab5-1a1c5fb39a9c}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {011f9246-da13-4555-9998-6e4805bd533f}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {011f9246-da13-4555-9998-6e4805bd533f}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {000f18f2-09eb-4a59-82b2-5ae4184c39c3}
- '<SYSTEM32>\taskkill.exe' /f /im iexplore.exe
- '<SYSTEM32>\taskkill.exe' /f /im babylon.exe
- '<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20" /v "ProfileImagePath"
- '<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-2052111302-484763869-725345543-1003" /v "ProfileImagePath"
- '<SYSTEM32>\taskkill.exe' /f /im browsemngr.exe
- '<SYSTEM32>\taskkill.exe' /f /im browsermngr.exe
- '<SYSTEM32>\taskkill.exe' /f /im babylonhelper.exe
- '<SYSTEM32>\taskkill.exe' /f /im babylontc.exe
- '<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19" /v "ProfileImagePath"
- '<SYSTEM32>\reg.exe' QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
- '<SYSTEM32>\reg.exe' IMPORT C:\JRT\startpage_x86.reg
- '<SYSTEM32>\cmd.exe' /c ""C:\JRT\get.bat" "
- '<SYSTEM32>\mode.com' con cols=100 lines=60
- '<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18" /v "ProfileImagePath"
- '<SYSTEM32>\findstr.exe' /iec:"\\%USERNAME%"
- '<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList"
- '<SYSTEM32>\findstr.exe' /ibc:"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-"
- '<SYSTEM32>\taskkill.exe' /f /im clickoncesetup.exe
- '<SYSTEM32>\taskkill.exe' /f /im toolbarupdaterservice.exe
- '<SYSTEM32>\taskkill.exe' /f /im uninstall.exe
- '<SYSTEM32>\taskkill.exe' /f /im questscan.exe
- '<SYSTEM32>\taskkill.exe' /f /im sweetim.exe
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {000f18f2-09eb-4a59-82b2-5ae4184c39c3}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {000f18f2-09eb-4a59-82b2-5ae4184c39c3}
- '<SYSTEM32>\taskkill.exe' /f /im visicom_antiphishing.exe
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {000f18f2-09eb-4a59-82b2-5ae4184c39c3}
- '<SYSTEM32>\taskkill.exe' /f /im optproreminder.exe
- '<SYSTEM32>\taskkill.exe' /f /im dtupdate.exe
- '<SYSTEM32>\taskkill.exe' /f /im extensionupdaterservice.exe
- '<SYSTEM32>\taskkill.exe' /f /im datamngrui.exe
- '<SYSTEM32>\taskkill.exe' /f /im defaulttabsearch.exe
- '<SYSTEM32>\taskkill.exe' /f /im iminent.messengers.exe
- '<SYSTEM32>\taskkill.exe' /f /im iwintrusted.exe
- '<SYSTEM32>\taskkill.exe' /f /im funmoodssrv.exe
- '<SYSTEM32>\taskkill.exe' /f /im iminent.exe
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {01bc00c7-1125-4e41-bd93-3266121fe690}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {03cddd3d-68d7-4b12-9bd8-54de251c460b}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {03cddd3d-68d7-4b12-9bd8-54de251c460b}
- '<SYSTEM32>\taskkill.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {03cddd3d-68d7-4b12-9bd8-54de251c460b}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {03cddd3d-68d7-4b12-9bd8-54de251c460b}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {03cddd3d-68d7-4b12-9bd8-54de251c460b}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {047773d7-f320-4fd1-8e8a-39fc582e437c}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {03cddd3d-68d7-4b12-9bd8-54de251c460b}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {03cddd3d-68d7-4b12-9bd8-54de251c460b}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {031949b3-28b6-43a4-90e2-dde1cfe21390}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {031949b3-28b6-43a4-90e2-dde1cfe21390}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {031949b3-28b6-43a4-90e2-dde1cfe21390}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {031949b3-28b6-43a4-90e2-dde1cfe21390}
- '<SYSTEM32>\taskkill.exe' /pid=3868
- '<SYSTEM32>\taskkill.exe' /pid=3952
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {031949b3-28b6-43a4-90e2-dde1cfe21390}
- '<SYSTEM32>\taskkill.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {031949b3-28b6-43a4-90e2-dde1cfe21390}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {031949b3-28b6-43a4-90e2-dde1cfe21390}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {047773d7-f320-4fd1-8e8a-39fc582e437c}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {0494d0de-f8e0-41ad-92a3-14154ece70ac}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {04c7b109-8162-a0d6-b186-dbe176064a3e}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {0494d0de-f8e0-41ad-92a3-14154ece70ac}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {0494d0de-f8e0-41ad-92a3-14154ece70ac}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {04c7b109-8162-a0d6-b186-dbe176064a3e}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {04c7b109-8162-a0d6-b186-dbe176064a3e}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {04c7b109-8162-a0d6-b186-dbe176064a3e}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {04c7b109-8162-a0d6-b186-dbe176064a3e}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {0494d0de-f8e0-41ad-92a3-14154ece70ac}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {047773d7-f320-4fd1-8e8a-39fc582e437c}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {047773d7-f320-4fd1-8e8a-39fc582e437c}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {047773d7-f320-4fd1-8e8a-39fc582e437c}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {047773d7-f320-4fd1-8e8a-39fc582e437c}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {0494d0de-f8e0-41ad-92a3-14154ece70ac}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0494d0de-f8e0-41ad-92a3-14154ece70ac}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {047773d7-f320-4fd1-8e8a-39fc582e437c}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {0494d0de-f8e0-41ad-92a3-14154ece70ac}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {02ffc86e-283e-4faa-95d6-addca024f30a}
- '<SYSTEM32>\findstr.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {0231292d-63c1-4731-a82d-f126f11ee8b3}
- '<SYSTEM32>\reg.exe' /pid=3332
- '<SYSTEM32>\findstr.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {020b192b-60fc-4301-bfd4-9d86668d3ff8}
- '<SYSTEM32>\reg.exe' /pid=3300
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {0231292d-63c1-4731-a82d-f126f11ee8b3}
- '<SYSTEM32>\taskkill.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {0231292d-63c1-4731-a82d-f126f11ee8b3}
- '<SYSTEM32>\findstr.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {0231292d-63c1-4731-a82d-f126f11ee8b3}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0231292d-63c1-4731-a82d-f126f11ee8b3}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {020b192b-60fc-4301-bfd4-9d86668d3ff8}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {020b192b-60fc-4301-bfd4-9d86668d3ff8}
- '<SYSTEM32>\mode.com' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {020b192b-60fc-4301-bfd4-9d86668d3ff8}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {01bc00c7-1125-4e41-bd93-3266121fe690}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {01bc00c7-1125-4e41-bd93-3266121fe690}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {020b192b-60fc-4301-bfd4-9d86668d3ff8}
- '<SYSTEM32>\findstr.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {020b192b-60fc-4301-bfd4-9d86668d3ff8}
- '<SYSTEM32>\reg.exe' /pid=3180
- '<SYSTEM32>\reg.exe' /pid=3196
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {0231292d-63c1-4731-a82d-f126f11ee8b3}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {02ffc86e-283e-4faa-95d6-addca024f30a}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {02ffc86e-283e-4faa-95d6-addca024f30a}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {0290bf93-2a4d-4b1a-b43d-0789441b7f67}
- '<SYSTEM32>\taskkill.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {02ffc86e-283e-4faa-95d6-addca024f30a}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {02ffc86e-283e-4faa-95d6-addca024f30a}
- '<SYSTEM32>\taskkill.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {02ffc86e-283e-4faa-95d6-addca024f30a}
- '<SYSTEM32>\taskkill.exe' /pid=3756
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {02ffc86e-283e-4faa-95d6-addca024f30a}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-19\software\microsoft\internet explorer\urlsearchhooks" /v {0290bf93-2a4d-4b1a-b43d-0789441b7f67}
- '<SYSTEM32>\reg.exe' query "hkey_current_user\software\microsoft\internet explorer\toolbar" /v {0290bf93-2a4d-4b1a-b43d-0789441b7f67}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\toolbar" /v {0290bf93-2a4d-4b1a-b43d-0789441b7f67}
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-20\software\microsoft\internet explorer\urlsearchhooks" /v {0231292d-63c1-4731-a82d-f126f11ee8b3}
- '<SYSTEM32>\taskkill.exe' /pid=3532
- '<SYSTEM32>\reg.exe' query "hkey_users\s-1-5-18\software\microsoft\internet explorer\urlsearchhooks" /v {0290bf93-2a4d-4b1a-b43d-0789441b7f67}
- '<SYSTEM32>\taskkill.exe' /pid=3644
- '<SYSTEM32>\taskkill.exe' query "hkey_current_user\software\microsoft\internet explorer\urlsearchhooks" /v {0290bf93-2a4d-4b1a-b43d-0789441b7f67}
- '<SYSTEM32>\reg.exe' query "hkey_local_machine\software\microsoft\internet explorer\urlsearchhooks" /v {0290bf93-2a4d-4b1a-b43d-0789441b7f67}
Injects code into
the following system processes:
- <SYSTEM32>\findstr.exe
- <SYSTEM32>\taskkill.exe
- <SYSTEM32>\reg.exe
- <SYSTEM32>\mode.com
- <SYSTEM32>\cmd.exe
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- C:\JRT\misc.bat
- C:\JRT\regkey_x64.dat
- C:\JRT\regkey_x86.dat
- C:\JRT\get.bat
- C:\JRT\FFregkey_x86.dat
- C:\JRT\FFXML.dat
- C:\JRT\firefox.bat
- C:\JRT\startpage_x86.reg
- C:\JRT\temp\OS.txt
- C:\JRT\temp\architecture.txt
- C:\JRT\startpage_x64.reg
- C:\JRT\regvalue_x64.dat
- C:\JRT\regvalue_x86.dat
- C:\JRT\services.dat
- C:\JRT\FFregkey_x64.dat
- C:\JRT\askregvalue_x64.dat
- C:\JRT\askregvalue_x86.dat
- C:\JRT\askservices.dat
- C:\JRT\askregkey_x86.dat
- C:\JRT\ask.bat
- C:\JRT\askCLSID.dat
- C:\JRT\askregkey_x64.dat
- C:\JRT\FFextensions.dat
- C:\JRT\FFplugins.dat
- C:\JRT\FFprefs.dat
- C:\JRT\ev_clear.bat
- C:\JRT\CLSID.dat
- C:\JRT\clsid_keys.bat
- C:\JRT\clsid_values.bat
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
