Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce] '!CleanMRPup' = '%WINDIR%\CleanUpMRP.cmd'
Malicious functions
Launches a large number of processes
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\tempm\7za.exe
- %ALLUSERSPROFILE%\tempm\extract.exe
- %ALLUSERSPROFILE%\tempm\install.7z
- %ALLUSERSPROFILE%\tempm\decompile.cmd
- %WINDIR%\syswow64\extract.cmd
- %WINDIR%\setup\mrp3\mrpversion.tag
- nul
- %WINDIR%\cleanupmrp.cmd
- %HOMEPATH%\desktop\mrp_error.log
- %TEMP%\mrpconvertnumber.vbs
- %TEMP%\mrp-error-message.vbs
Deletes the following files
- %ALLUSERSPROFILE%\tempm\install.7z
- %ALLUSERSPROFILE%\tempm\7za.exe
- %WINDIR%\setup\mrp3\mrpversion.tag
- %TEMP%\mrpconvertnumber.vbs
Substitutes the following files
- %TEMP%\mrpconvertnumber.vbs
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\tempm\extract.exe'
- '<SYSTEM32>\cscript.exe' //NoLogo "%TEMP%\MRPConvertNumber.vbs" "2162232"
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\MRP-Error-Message.vbs" //nologo
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\TempM\Decompile.cmd" > NUL"
- '%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\extract.cmd" > NUL"
- '%WINDIR%\syswow64\mode.com' con cols=55 lines=5
- '%WINDIR%\syswow64\attrib.exe' "%WINDIR%\Setup\MRP3" +h +s
- '<SYSTEM32>\reg.exe' add "HKLM\Software\MRP3" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\MRP3\DataVars" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\MRP3\DataVars" /v "MRP_ReLocationFlag" /t REG_SZ /d "Yes" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "!CleanMRPup" /t REG_SZ /d "%WINDIR%\CleanUpMRP.cmd" /f
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v "ImageState" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v "ImageState"
- '%WINDIR%\syswow64\cmd.exe' /c "WMIC /locale:ms_409 CPU GET Architecture /value" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 CPU GET Architecture /value
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v "Enabled" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v "Enabled"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "BuildLabEx" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "BuildLabEx"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild"
- '%WINDIR%\syswow64\cmd.exe' /c ver
- '<SYSTEM32>\bcdedit.exe' /enum {current}
- '%WINDIR%\syswow64\findstr.exe' /I /R /C:"^flightsigning *Yes$"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\WindowsSelfHost\Applicability" /v "IsBuildFlightingEnabled" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\WindowsSelfHost\Applicability" /v "IsBuildFlightingEnabled"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\WindowsSelfHost\Applicability" /v "UseSettingsExperience" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\WindowsSelfHost\Applicability" /v "UseSettingsExperience"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "DisplayVersion" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "DisplayVersion"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo "Windows 7 Enterprise" "
- '%WINDIR%\syswow64\findstr.exe' /I "\<Preview\>"
- '%WINDIR%\syswow64\findstr.exe' /I "\<Insider\>"
- '%WINDIR%\syswow64\cmd.exe' /c WMIC /locale:ms_409 os get caption /value 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 os get caption /value
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo "Microsoft Windows 7 Enterprise " "
- '%WINDIR%\syswow64\findstr.exe' /I "\<WINDOWS\>"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "BuildBranch" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "BuildBranch"
- '%WINDIR%\syswow64\cmd.exe' /c WMIC /locale:ms_409 os get osarchitecture /value 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 os get osarchitecture /value
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" ECHO "64-bit" "
- '%WINDIR%\syswow64\findstr.exe' /i "64"
- '%WINDIR%\syswow64\findstr.exe' /i "32"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v "Release" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v "Release"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v "Version" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v "Version"
- '%WINDIR%\syswow64\cmd.exe' /c dir /B /A:D "%WINDIR%\Microsoft.NET\Framework" | FindStr /i "v1" 2>nul
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" dir /B /A:D "%WINDIR%\Microsoft.NET\Framework" "
- '%WINDIR%\syswow64\findstr.exe' /i "v1"
- '%WINDIR%\syswow64\cmd.exe' /c dir /B /A:D "%WINDIR%\Microsoft.NET\Framework" | FindStr /i "v2" 2>nul
- '%WINDIR%\syswow64\findstr.exe' /i "v2"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v "InstallSuccess" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v "InstallSuccess"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v "Version" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v "Version"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.5" /v "Install" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.5" /v "Install"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.5" /v "Version" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\Software\Microsoft\NET Framework Setup\NDP\v3.5" /v "Version"
- '%WINDIR%\syswow64\cmd.exe' /c dir /B /A:D "%WINDIR%\Microsoft.NET\Framework" | FindStr /i "v4" 2>nul
- '%WINDIR%\syswow64\findstr.exe' /i "v4"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v "PowerShellVersion" 2>nul | FINDstr /I "PowerShellVersion" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v "PowerShellVersion"
- '%WINDIR%\syswow64\findstr.exe' /I "PowerShellVersion"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine" /v "PowerShellVersion" 2>nul | FINDstr /I "PowerShellVersion" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine" /v "PowerShellVersion"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v "PSCompatibleVersion" 2>nul | FINDstr /I "PSCompatibleVersion" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine" /v "PSCompatibleVersion"
- '%WINDIR%\syswow64\findstr.exe' /I "PSCompatibleVersion"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine" /v "PSCompatibleVersion" 2>nul | FINDstr /I "PSCompatibleVersion" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine" /v "PSCompatibleVersion"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\1" /v "Install" 2>nul | FINDstr /I "Install" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\1" /v "Install"
- '%WINDIR%\syswow64\findstr.exe' /I "Install"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\PowerShell\3" /v "Install" 2>nul | FINDstr /I "Install" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\PowerShell\3" /v "Install"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\ScriptedDiagnostics" /v "ExecutionPolicy" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\ScriptedDiagnostics" /v "ExecutionPolicy"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "EditionID" 2>nul
- '<SYSTEM32>\reg.exe' QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "EditionID"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "InstallationType" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "InstallationType"
- '%WINDIR%\syswow64\cmd.exe' /c WMIC OS GET LocalDateTime /value 2>nul
- '<SYSTEM32>\wbem\wmic.exe' OS GET LocalDateTime /value
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v "TimeZoneKeyName" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v "TimeZoneKeyName"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v "ActiveTimeBias" | findstr /i "ActiveTimeBias" 2>nul
- '<SYSTEM32>\reg.exe' query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v "ActiveTimeBias"
- '%WINDIR%\syswow64\findstr.exe' /i "ActiveTimeBias"
- '%WINDIR%\syswow64\cmd.exe' /c echo 420 2>nul
- '%WINDIR%\syswow64\cmd.exe' /c Powershell -NoProfile (Get-Date).IsDaylightSavingTime() 2>nul
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile (Get-Date).IsDaylightSavingTime()
- '%WINDIR%\syswow64\attrib.exe' "%ALLUSERSPROFILE%" +h +s
- '<SYSTEM32>\reg.exe' DELETE "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "%WINDIR%\Setup" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "%WINDIR%\Setup\Scripts" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "SystemModel" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "OEMsOK" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "Dbug" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "MRPChk" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "MRPChkX" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "MRPAM" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoMD" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "VMType" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "W10TB" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "W10TBCol" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "HiLiteCol" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "DrvType" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "OSEd" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "RPBand" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "Rem1Drv" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "ShowExts" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoShortCutS" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "AppsUseDarkTheme" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "SystemUsesDarkTheme" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "OLEDTaskbar" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "LaunchToPC" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "PIDTValue" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "AdvertsBlock" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoBGAppsRun" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "CPanelView" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "EdgeSC" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "AllowPhone" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "GameXMode" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoXCortana" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "ThinBorders" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoAutoMaint" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoDefender" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "DFSettings" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoPSWinX" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NewProgs" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "NoPhotosUse" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "TransferOpts" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "RemInboxApps" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "HLNewProgs" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "InsiderBuild" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "ShowClockSeconds" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "DaylightSavingMode" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "DisableSpotLight" /f
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v "GroupByNone" /f
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\reg.exe query "HKLM\Software\MRP3" /s /k /f "DataVars" | FindStr /i "DataVars"
- '<SYSTEM32>\reg.exe' query "HKLM\Software\MRP3" /s /k /f "DataVars"
- '%WINDIR%\syswow64\findstr.exe' /i "DataVars"
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\Software\MRP3\DataVars" /f
- '%WINDIR%\syswow64\cmd.exe' /c "WMIC /locale:ms_409 PATH WIN32_OperatingSystem get TotalVisibleMemorySize /format:list" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 PATH WIN32_OperatingSystem get TotalVisibleMemorySize /format:list
- '%WINDIR%\syswow64\cmd.exe' /c "WMIC /locale:ms_409 PATH WIN32_OperatingSystem get FreePhysicalMemory /format:list" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 PATH WIN32_OperatingSystem get FreePhysicalMemory /format:list
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\CScript.exe //NoLogo "%TEMP%\MRPConvertNumber.vbs" "2162232" 2>nul
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\CScript.exe //NoLogo "%TEMP%\MRPConvertNumber.vbs" "1191968" 2>nul
- '<SYSTEM32>\cscript.exe' //NoLogo "%TEMP%\MRPConvertNumber.vbs" "1191968"
- '%WINDIR%\syswow64\cmd.exe' /c %WINDIR%\Sysnative\CScript.exe //NoLogo "%TEMP%\MRPConvertNumber.vbs" "970264" 2>nul
- '<SYSTEM32>\cscript.exe' //NoLogo "%TEMP%\MRPConvertNumber.vbs" "970264"
- '%WINDIR%\syswow64\cmd.exe' /c "WMIC /locale:ms_409 path SoftwareLicensingProduct where (Name LIKE '%Windows%' and PartialProductKey is not null) get LicenseStatus /format:list" 2>nul
- '<SYSTEM32>\wbem\wmic.exe' /locale:ms_409 path SoftwareLicensingProduct where (Name LIKE '%Windows%' and PartialProductKey is not null) get LicenseStatus /format:list
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\TempM\Decompile.cmd" > NUL"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\extract.cmd" > NUL"' (with hidden window)
