Technical Information
- [<HKLM>\System\CurrentControlSet\Services\sppsvc] 'Start' = '00000002'
- <SYSTEM32>\ntoskrnl.exe with <SYSTEM32>\ntoskrnl.exe.lmceq
- %WINDIR%\SysWOW64\systemcpl.dll with %WINDIR%\syswow64\systemcpl.dll.lmceq
- %WINDIR%\SysWOW64\sppwmi.dll with %WINDIR%\syswow64\sppwmi.dll.lmceq
- %WINDIR%\SysWOW64\sppcommdlg.dll with %WINDIR%\syswow64\sppcommdlg.dll.lmceq
- %WINDIR%\SysWOW64\sppcomapi.dll with %WINDIR%\syswow64\sppcomapi.dll.lmceq
- %WINDIR%\SysWOW64\slwga.dll with %WINDIR%\syswow64\slwga.dll.lmceq
- %WINDIR%\SysWOW64\ntoskrnl.exe with %WINDIR%\syswow64\ntoskrnl.exe.lmceq
- %WINDIR%\SysWOW64\ntkrnlpa.exe with %WINDIR%\syswow64\ntkrnlpa.exe.lmceq
- <SYSTEM32>\winver.exe with <SYSTEM32>\winver.exe.lmceq
- <SYSTEM32>\winlogon.exe with <SYSTEM32>\winlogon.exe.lmceq
- <SYSTEM32>\user32.dll with <SYSTEM32>\user32.dll.lmceq
- <SYSTEM32>\systemcpl.dll with <SYSTEM32>\systemcpl.dll.lmceq
- <SYSTEM32>\sppwmi.dll with <SYSTEM32>\sppwmi.dll.lmceq
- <SYSTEM32>\sppuinotify.dll with <SYSTEM32>\sppuinotify.dll.lmceq
- <SYSTEM32>\sppcommdlg.dll with <SYSTEM32>\sppcommdlg.dll.lmceq
- <SYSTEM32>\sppcomapi.dll with <SYSTEM32>\sppcomapi.dll.lmceq
- <SYSTEM32>\slwga.dll with <SYSTEM32>\slwga.dll.lmceq
- <SYSTEM32>\slui.exe with <SYSTEM32>\slui.exe.lmceq
- %WINDIR%\SysWOW64\user32.dll with %WINDIR%\syswow64\user32.dll.lmceq
- %WINDIR%\SysWOW64\winver.exe with %WINDIR%\syswow64\winver.exe.lmceq
- '<SYSTEM32>\taskkill.exe' /im hale.exe /f
- '<SYSTEM32>\net.exe' stop sppsvc
- '<SYSTEM32>\net.exe' stop sppuinotify
- C:\undo.bat
- nul
- <DRIVERS>\etc\hosts
- C:\undo.bat
- from %WINDIR%\syswow64\slmgr.vbs to %WINDIR%\syswow64\slmgr.vbs.lmceq
- from <SYSTEM32>\winver.exe to <SYSTEM32>\winver.exe.lmceq
- from <SYSTEM32>\winlogon.exe to <SYSTEM32>\winlogon.exe.lmceq
- from <SYSTEM32>\systemcpl.dll to <SYSTEM32>\systemcpl.dll.lmceq
- from <SYSTEM32>\sppwmi.dll to <SYSTEM32>\sppwmi.dll.lmceq
- from <SYSTEM32>\sppuinotify.dll to <SYSTEM32>\sppuinotify.dll.lmceq
- from <SYSTEM32>\sppcommdlg.dll to <SYSTEM32>\sppcommdlg.dll.lmceq
- from <SYSTEM32>\sppcomapi.dll to <SYSTEM32>\sppcomapi.dll.lmceq
- from <SYSTEM32>\slwga.dll to <SYSTEM32>\slwga.dll.lmceq
- from <SYSTEM32>\user32.dll to <SYSTEM32>\user32.dll.lmceq
- from <SYSTEM32>\slmgr.vbs to <SYSTEM32>\slmgr.vbs.lmceq
- from %WINDIR%\syswow64\ntoskrnl.exe to %WINDIR%\syswow64\ntoskrnl.exe.lmceq
- from %WINDIR%\syswow64\ntkrnlpa.exe to %WINDIR%\syswow64\ntkrnlpa.exe.lmceq
- from %WINDIR%\syswow64\winver.exe to %WINDIR%\syswow64\winver.exe.lmceq
- from %WINDIR%\syswow64\systemcpl.dll to %WINDIR%\syswow64\systemcpl.dll.lmceq
- from %WINDIR%\syswow64\sppwmi.dll to %WINDIR%\syswow64\sppwmi.dll.lmceq
- from %WINDIR%\syswow64\sppcommdlg.dll to %WINDIR%\syswow64\sppcommdlg.dll.lmceq
- from %WINDIR%\syswow64\sppcomapi.dll to %WINDIR%\syswow64\sppcomapi.dll.lmceq
- from %WINDIR%\syswow64\slwga.dll to %WINDIR%\syswow64\slwga.dll.lmceq
- from %WINDIR%\syswow64\user32.dll to %WINDIR%\syswow64\user32.dll.lmceq
- from <SYSTEM32>\slui.exe to <SYSTEM32>\slui.exe.lmceq
- from <SYSTEM32>\ntoskrnl.exe to <SYSTEM32>\ntoskrnl.exe.lmceq
- ClassName: '' WindowName: 'WAT Fix v1.1 - By Daz - <Full path to file>'
- ClassName: '' WindowName: ''
- '<SYSTEM32>\cmd.exe' /A /C "taskkill /im hale.exe /f 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppwmi.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppwmi.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppuinotify.dll sppuinotify.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppuinotify.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppuinotify.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppcommdlg.dll sppcommdlg.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppcommdlg.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppcommdlg.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppcomapi.dll sppcomapi.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppcomapi.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppcomapi.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slwga.dll slwga.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slwga.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\systemcpl.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\user32.dll user32.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\user32.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\user32.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slmgr.vbs slmgr.vbs.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slmgr.vbs /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slmgr.vbs"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\Wat\* /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\Wat\*"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\ntoskrnl.exe ntoskrnl.exe.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\ntoskrnl.exe /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\ntoskrnl.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slwga.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppwmi.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\systemcpl.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\*.lmceq *."' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "NET START "Windows Modules Installer" 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "schtasks.exe /delete /tn \Microsoft\Windows\PMS\ResetDTL /f 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "schtasks.exe /delete /tn \Microsoft\Windows\RAI\RaiTask /f 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Chew7Hale /f 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\Chew7 /f 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\HAL7600 /f 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "rmdir /s /q %ALLUSERSPROFILE%\Microsoft\Windows\SXS 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "rmdir /s /q %ALLUSERSPROFILE%\Microsoft\Windows\RAI 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\Wat\* /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\Wat\*"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\ntoskrnl.exe ntoskrnl.exe.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\ntkrnlpa.exe ntkrnlpa.exe.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppwmi.dll sppwmi.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\ntkrnlpa.exe ntkrnlpa.exe.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\ntkrnlpa.exe /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\ntkrnlpa.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slui.exe slui.exe.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slui.exe /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slui.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\winver.exe winver.exe.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\winver.exe /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\winver.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\winlogon.exe winlogon.exe.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\winlogon.exe /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\winlogon.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\ntoskrnl.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\systemcpl.dll systemcpl.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\ntkrnlpa.exe /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\ntkrnlpa.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slui.exe slui.exe.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "sc stop uodin86 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slmgr.vbs"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "del /f <DRIVERS>\uodin64.sys 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "del /f <DRIVERS>\uodin86.sys 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <DRIVERS>\uodin64.sys /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <DRIVERS>\uodin86.sys /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <DRIVERS>\uodin64.sys"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <DRIVERS>\uodin86.sys"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "net stop sppuinotify 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "net stop sppsvc 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "sc delete uodin64 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "sc stop uodin64 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\*.lmceq *."' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slmgr.vbs slmgr.vbs.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "cscript.exe //nologo <SYSTEM32>\slmgr.vbs -rilc 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slmgr.vbs.removewat slmgr.vbs 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slmgr.vbs.removewat slmgr.vbs 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "net start sppuinotify 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "net start sppsvc 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "sc config sppuinotify start= demand 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "sc config sppsvc start= delayed-auto 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "bcdedit.exe -set testsigning off 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\servicing\TrustedInstaller.exe /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\servicing\TrustedInstaller.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "del /f <SYSTEM32>\hale.exe 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "attrib -r -a -s -h <SYSTEM32>\hale.exe 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "sc delete uodin86 2>NUL>NUL"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\ntoskrnl.exe /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\user32.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slwga.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\user32.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slui.exe /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slui.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\winver.exe winver.exe.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\winver.exe /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\winver.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\winlogon.exe winlogon.exe.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\winlogon.exe /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\winlogon.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\systemcpl.dll systemcpl.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\systemcpl.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\systemcpl.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\user32.dll user32.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppwmi.dll sppwmi.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slmgr.vbs /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppuinotify.dll sppuinotify.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppuinotify.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppuinotify.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppcommdlg.dll sppcommdlg.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppcommdlg.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppcommdlg.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppcomapi.dll sppcomapi.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppcomapi.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppcomapi.dll"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slwga.dll slwga.dll.lmceq"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slwga.dll /grant *S-1-1-0:F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppwmi.dll /grant *S-1-1-0:F"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /A /C "shutdown -r -t 0"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /A /C "taskkill /im hale.exe /f 2>NUL>NUL"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\sppwmi.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppwmi.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\sppwmi.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppwmi.dll sppwmi.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\systemcpl.dll"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\systemcpl.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\systemcpl.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\systemcpl.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\systemcpl.dll systemcpl.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\winlogon.exe"
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppuinotify.dll sppuinotify.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppwmi.dll"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\winlogon.exe
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\winlogon.exe winlogon.exe.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\winver.exe"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\winver.exe
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\winver.exe /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\winver.exe /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\winver.exe winver.exe.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slui.exe"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\slui.exe
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slui.exe /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\slui.exe /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\winlogon.exe /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\winlogon.exe /grant *S-1-1-0:F
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\sppuinotify.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppuinotify.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\sppuinotify.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slmgr.vbs /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\slmgr.vbs /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slmgr.vbs slmgr.vbs.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\user32.dll"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\user32.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\user32.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\user32.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\user32.dll user32.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slwga.dll"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\slwga.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slwga.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\slmgr.vbs
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\slwga.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppcomapi.dll"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\sppcomapi.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppcomapi.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\sppcomapi.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppcomapi.dll sppcomapi.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppcommdlg.dll"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\sppcommdlg.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppcommdlg.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\sppcommdlg.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppcommdlg.dll sppcommdlg.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppuinotify.dll"
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slwga.dll slwga.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slui.exe slui.exe.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\ntkrnlpa.exe"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\ntkrnlpa.exe
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\ntkrnlpa.exe /grant *S-1-1-0:F"
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\user32.dll
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\slwga.dll
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\slwga.dll
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\sppcomapi.dll
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\sppcomapi.dll
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\sppcommdlg.dll
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\sppcommdlg.dll
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\sppuinotify.dll
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\sppuinotify.dll
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\sppwmi.dll
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\sppwmi.dll
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\systemcpl.dll
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\systemcpl.dll
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\winlogon.exe
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\winlogon.exe
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\winver.exe
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\winver.exe
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\slui.exe
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\slui.exe
- '<SYSTEM32>\sfc.exe' /scannow
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\ntoskrnl
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\ntkrnlpa
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\ntoskrnl
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\*.lmceq *."
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\*.lmceq *."
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\user32.dll
- '<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\slmgr.vbs
- '<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\slmgr.vbs
- '<SYSTEM32>\net1.exe' START "Windows Modules Installer"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\ntkrnlpa.exe /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\ntkrnlpa.exe ntkrnlpa.exe.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\ntoskrnl.exe"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\ntoskrnl.exe
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\ntoskrnl.exe /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\ntoskrnl.exe /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\ntoskrnl.exe ntoskrnl.exe.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\Wat\*"
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\Wat\*
- '<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\Wat\* /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <SYSTEM32>\Wat\* /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "rmdir /s /q %ALLUSERSPROFILE%\Microsoft\Windows\RAI 2>NUL>NUL"
- '<SYSTEM32>\cmd.exe' /A /C "rmdir /s /q %ALLUSERSPROFILE%\Microsoft\Windows\SXS 2>NUL>NUL"
- '<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\HAL7600 /f 2>NUL>NUL"
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\HAL7600 /f
- '<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\Chew7 /f 2>NUL>NUL"
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Chew7 /f
- '<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Chew7Hale /f 2>NUL>NUL"
- '<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Chew7Hale /f
- '<SYSTEM32>\cmd.exe' /A /C "schtasks.exe /delete /tn \Microsoft\Windows\RAI\RaiTask /f 2>NUL>NUL"
- '<SYSTEM32>\schtasks.exe' /delete /tn \Microsoft\Windows\RAI\RaiTask /f
- '<SYSTEM32>\cmd.exe' /A /C "schtasks.exe /delete /tn \Microsoft\Windows\PMS\ResetDTL /f 2>NUL>NUL"
- '<SYSTEM32>\schtasks.exe' /delete /tn \Microsoft\Windows\PMS\ResetDTL /f
- '<SYSTEM32>\cmd.exe' /A /C "NET START "Windows Modules Installer" 2>NUL>NUL"
- '<SYSTEM32>\net.exe' START "Windows Modules Installer"
- '%WINDIR%\syswow64\cmd.exe' /A /C "shutdown -r -t 0"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slmgr.vbs"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\Wat\* /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\Wat\* /grant *S-1-1-0:F"
- '<SYSTEM32>\sc.exe' delete uodin64
- '<SYSTEM32>\cmd.exe' /A /C "net stop sppsvc 2>NUL>NUL"
- '<SYSTEM32>\net1.exe' stop sppsvc
- '<SYSTEM32>\cmd.exe' /A /C "net stop sppuinotify 2>NUL>NUL"
- '<SYSTEM32>\net1.exe' stop sppuinotify
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <DRIVERS>\uodin86.sys"
- '<SYSTEM32>\takeown.exe' /f <DRIVERS>\uodin86.sys
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f <DRIVERS>\uodin64.sys"
- '<SYSTEM32>\takeown.exe' /f <DRIVERS>\uodin64.sys
- '<SYSTEM32>\cmd.exe' /A /C "icacls <DRIVERS>\uodin86.sys /grant *S-1-1-0:F"
- '<SYSTEM32>\sc.exe' stop uodin64
- '<SYSTEM32>\cmd.exe' /A /C "sc delete uodin64 2>NUL>NUL"
- '<SYSTEM32>\icacls.exe' <DRIVERS>\uodin86.sys /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "del /f <DRIVERS>\uodin86.sys 2>NUL>NUL"
- '<SYSTEM32>\cmd.exe' /A /C "del /f <DRIVERS>\uodin64.sys 2>NUL>NUL"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slmgr.vbs"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\slmgr.vbs
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slmgr.vbs /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\slmgr.vbs /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slmgr.vbs slmgr.vbs.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\user32.dll"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\user32.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\user32.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\cmd.exe' /A /C "icacls <DRIVERS>\uodin64.sys /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' <DRIVERS>\uodin64.sys /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "sc stop uodin64 2>NUL>NUL"
- '<SYSTEM32>\sc.exe' delete uodin86
- '<SYSTEM32>\cmd.exe' /A /C "sc delete uodin86 2>NUL>NUL"
- '<SYSTEM32>\attrib.exe' -r -a -s -h <SYSTEM32>\hale.exe
- '<SYSTEM32>\cmd.exe' /A /C "del /f <SYSTEM32>\hale.exe 2>NUL>NUL"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\servicing\TrustedInstaller.exe"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\servicing\TrustedInstaller.exe
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\servicing\TrustedInstaller.exe /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\servicing\TrustedInstaller.exe /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "bcdedit.exe -set testsigning off 2>NUL>NUL"
- '<SYSTEM32>\bcdedit.exe' -set testsigning off
- '<SYSTEM32>\cmd.exe' /A /C "sc config sppsvc start= delayed-auto 2>NUL>NUL"
- '<SYSTEM32>\sc.exe' config sppsvc start= delayed-auto
- '<SYSTEM32>\cmd.exe' /A /C "sc config sppuinotify start= demand 2>NUL>NUL"
- '<SYSTEM32>\cmd.exe' /A /C "attrib -r -a -s -h <SYSTEM32>\hale.exe 2>NUL>NUL"
- '<SYSTEM32>\sc.exe' config sppuinotify start= demand
- '<SYSTEM32>\net.exe' start sppsvc
- '<SYSTEM32>\net1.exe' start sppsvc
- '<SYSTEM32>\cmd.exe' /A /C "net start sppuinotify 2>NUL>NUL"
- '<SYSTEM32>\net.exe' start sppuinotify
- '<SYSTEM32>\net1.exe' start sppuinotify
- '<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slmgr.vbs.removewat slmgr.vbs 2>NUL>NUL"
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slmgr.vbs.removewat slmgr.vbs 2>NUL>NUL"
- '<SYSTEM32>\cmd.exe' /A /C "cscript.exe //nologo <SYSTEM32>\slmgr.vbs -rilc 2>NUL>NUL"
- '<SYSTEM32>\cscript.exe' //nologo <SYSTEM32>\slmgr.vbs -rilc
- '<SYSTEM32>\cmd.exe' /A /C "sc stop uodin86 2>NUL>NUL"
- '<SYSTEM32>\sc.exe' stop uodin86
- '<SYSTEM32>\cmd.exe' /A /C "net start sppsvc 2>NUL>NUL"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\user32.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\user32.dll user32.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slwga.dll"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\slwga.dll
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\winlogon.exe
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\winlogon.exe /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\winlogon.exe /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\winlogon.exe winlogon.exe.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\winver.exe"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\winver.exe
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\winver.exe /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\winver.exe /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\winver.exe winver.exe.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slui.exe"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\slui.exe
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slui.exe /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\slui.exe /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slui.exe slui.exe.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\ntkrnlpa.exe"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\ntkrnlpa.exe
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\ntkrnlpa.exe /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\ntkrnlpa.exe /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\ntkrnlpa.exe ntkrnlpa.exe.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\ntoskrnl.exe"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\ntoskrnl.exe
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\ntoskrnl.exe /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\ntoskrnl.exe /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\ntoskrnl.exe ntoskrnl.exe.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\Wat\*"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\winlogon.exe"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\systemcpl.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\systemcpl.dll systemcpl.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\systemcpl.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slwga.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\slwga.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slwga.dll slwga.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppcomapi.dll"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\sppcomapi.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppcomapi.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\sppcomapi.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppcomapi.dll sppcomapi.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppcommdlg.dll"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\sppcommdlg.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppcommdlg.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\sppcommdlg.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppcommdlg.dll sppcommdlg.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppuinotify.dll"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\sppuinotify.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppuinotify.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\sppuinotify.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppuinotify.dll sppuinotify.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppwmi.dll"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\sppwmi.dll
- '<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppwmi.dll /grant *S-1-1-0:F"
- '<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\sppwmi.dll /grant *S-1-1-0:F
- '<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppwmi.dll sppwmi.dll.lmceq"
- '<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\systemcpl.dll"
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\systemcpl.dll
- '<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\Wat\*
- '%WINDIR%\syswow64\shutdown.exe' -r -t 0