Program.Activator.2

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\sppsvc] 'Start' = '00000002'

Substitutes the following executable system files

<SYSTEM32>\ntoskrnl.exe with <SYSTEM32>\ntoskrnl.exe.lmceq
%WINDIR%\SysWOW64\systemcpl.dll with %WINDIR%\syswow64\systemcpl.dll.lmceq
%WINDIR%\SysWOW64\sppwmi.dll with %WINDIR%\syswow64\sppwmi.dll.lmceq
%WINDIR%\SysWOW64\sppcommdlg.dll with %WINDIR%\syswow64\sppcommdlg.dll.lmceq
%WINDIR%\SysWOW64\sppcomapi.dll with %WINDIR%\syswow64\sppcomapi.dll.lmceq
%WINDIR%\SysWOW64\slwga.dll with %WINDIR%\syswow64\slwga.dll.lmceq
%WINDIR%\SysWOW64\ntoskrnl.exe with %WINDIR%\syswow64\ntoskrnl.exe.lmceq
%WINDIR%\SysWOW64\ntkrnlpa.exe with %WINDIR%\syswow64\ntkrnlpa.exe.lmceq
<SYSTEM32>\winver.exe with <SYSTEM32>\winver.exe.lmceq
<SYSTEM32>\winlogon.exe with <SYSTEM32>\winlogon.exe.lmceq
<SYSTEM32>\user32.dll with <SYSTEM32>\user32.dll.lmceq
<SYSTEM32>\systemcpl.dll with <SYSTEM32>\systemcpl.dll.lmceq
<SYSTEM32>\sppwmi.dll with <SYSTEM32>\sppwmi.dll.lmceq
<SYSTEM32>\sppuinotify.dll with <SYSTEM32>\sppuinotify.dll.lmceq
<SYSTEM32>\sppcommdlg.dll with <SYSTEM32>\sppcommdlg.dll.lmceq
<SYSTEM32>\sppcomapi.dll with <SYSTEM32>\sppcomapi.dll.lmceq
<SYSTEM32>\slwga.dll with <SYSTEM32>\slwga.dll.lmceq
<SYSTEM32>\slui.exe with <SYSTEM32>\slui.exe.lmceq
%WINDIR%\SysWOW64\user32.dll with %WINDIR%\syswow64\user32.dll.lmceq
%WINDIR%\SysWOW64\winver.exe with %WINDIR%\syswow64\winver.exe.lmceq

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /im hale.exe /f
'<SYSTEM32>\net.exe' stop sppsvc
'<SYSTEM32>\net.exe' stop sppuinotify

Modifies file system

Creates the following files

C:\undo.bat
nul

Deletes the following files

<DRIVERS>\etc\hosts
C:\undo.bat

Moves the following system files

from %WINDIR%\syswow64\slmgr.vbs to %WINDIR%\syswow64\slmgr.vbs.lmceq
from <SYSTEM32>\winver.exe to <SYSTEM32>\winver.exe.lmceq
from <SYSTEM32>\winlogon.exe to <SYSTEM32>\winlogon.exe.lmceq
from <SYSTEM32>\systemcpl.dll to <SYSTEM32>\systemcpl.dll.lmceq
from <SYSTEM32>\sppwmi.dll to <SYSTEM32>\sppwmi.dll.lmceq
from <SYSTEM32>\sppuinotify.dll to <SYSTEM32>\sppuinotify.dll.lmceq
from <SYSTEM32>\sppcommdlg.dll to <SYSTEM32>\sppcommdlg.dll.lmceq
from <SYSTEM32>\sppcomapi.dll to <SYSTEM32>\sppcomapi.dll.lmceq
from <SYSTEM32>\slwga.dll to <SYSTEM32>\slwga.dll.lmceq
from <SYSTEM32>\user32.dll to <SYSTEM32>\user32.dll.lmceq
from <SYSTEM32>\slmgr.vbs to <SYSTEM32>\slmgr.vbs.lmceq
from %WINDIR%\syswow64\ntoskrnl.exe to %WINDIR%\syswow64\ntoskrnl.exe.lmceq
from %WINDIR%\syswow64\ntkrnlpa.exe to %WINDIR%\syswow64\ntkrnlpa.exe.lmceq
from %WINDIR%\syswow64\winver.exe to %WINDIR%\syswow64\winver.exe.lmceq
from %WINDIR%\syswow64\systemcpl.dll to %WINDIR%\syswow64\systemcpl.dll.lmceq
from %WINDIR%\syswow64\sppwmi.dll to %WINDIR%\syswow64\sppwmi.dll.lmceq
from %WINDIR%\syswow64\sppcommdlg.dll to %WINDIR%\syswow64\sppcommdlg.dll.lmceq
from %WINDIR%\syswow64\sppcomapi.dll to %WINDIR%\syswow64\sppcomapi.dll.lmceq
from %WINDIR%\syswow64\slwga.dll to %WINDIR%\syswow64\slwga.dll.lmceq
from %WINDIR%\syswow64\user32.dll to %WINDIR%\syswow64\user32.dll.lmceq
from <SYSTEM32>\slui.exe to <SYSTEM32>\slui.exe.lmceq
from <SYSTEM32>\ntoskrnl.exe to <SYSTEM32>\ntoskrnl.exe.lmceq

Substitutes the HOSTS file.

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'WAT Fix v1.1 - By Daz - <Full path to file>'
ClassName: '' WindowName: ''

Creates and executes the following

'<SYSTEM32>\cmd.exe' /A /C "taskkill /im hale.exe /f 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppwmi.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppwmi.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppuinotify.dll sppuinotify.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppuinotify.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppuinotify.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppcommdlg.dll sppcommdlg.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppcommdlg.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppcommdlg.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppcomapi.dll sppcomapi.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppcomapi.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppcomapi.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slwga.dll slwga.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slwga.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\systemcpl.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\user32.dll user32.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\user32.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\user32.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slmgr.vbs slmgr.vbs.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slmgr.vbs /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slmgr.vbs"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\Wat\* /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\Wat\*"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\ntoskrnl.exe ntoskrnl.exe.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\ntoskrnl.exe /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\ntoskrnl.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slwga.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppwmi.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\systemcpl.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\*.lmceq *."' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "NET START "Windows Modules Installer" 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "schtasks.exe /delete /tn \Microsoft\Windows\PMS\ResetDTL /f 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "schtasks.exe /delete /tn \Microsoft\Windows\RAI\RaiTask /f 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Chew7Hale /f 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\Chew7 /f 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\HAL7600 /f 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "rmdir /s /q %ALLUSERSPROFILE%\Microsoft\Windows\SXS 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "rmdir /s /q %ALLUSERSPROFILE%\Microsoft\Windows\RAI 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\Wat\* /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\Wat\*"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\ntoskrnl.exe ntoskrnl.exe.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\ntkrnlpa.exe ntkrnlpa.exe.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppwmi.dll sppwmi.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\ntkrnlpa.exe ntkrnlpa.exe.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\ntkrnlpa.exe /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\ntkrnlpa.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slui.exe slui.exe.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slui.exe /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slui.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\winver.exe winver.exe.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\winver.exe /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\winver.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\winlogon.exe winlogon.exe.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\winlogon.exe /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\winlogon.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\ntoskrnl.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\systemcpl.dll systemcpl.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\ntkrnlpa.exe /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\ntkrnlpa.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slui.exe slui.exe.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "sc stop uodin86 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slmgr.vbs"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "del /f <DRIVERS>\uodin64.sys 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "del /f <DRIVERS>\uodin86.sys 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <DRIVERS>\uodin64.sys /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <DRIVERS>\uodin86.sys /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <DRIVERS>\uodin64.sys"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <DRIVERS>\uodin86.sys"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "net stop sppuinotify 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "net stop sppsvc 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "sc delete uodin64 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "sc stop uodin64 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\*.lmceq *."' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slmgr.vbs slmgr.vbs.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "cscript.exe //nologo <SYSTEM32>\slmgr.vbs -rilc 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slmgr.vbs.removewat slmgr.vbs 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slmgr.vbs.removewat slmgr.vbs 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "net start sppuinotify 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "net start sppsvc 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "sc config sppuinotify start= demand 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "sc config sppsvc start= delayed-auto 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "bcdedit.exe -set testsigning off 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\servicing\TrustedInstaller.exe /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\servicing\TrustedInstaller.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "del /f <SYSTEM32>\hale.exe 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "attrib -r -a -s -h <SYSTEM32>\hale.exe 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "sc delete uodin86 2>NUL>NUL"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\ntoskrnl.exe /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\user32.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slwga.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\user32.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slui.exe /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slui.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\winver.exe winver.exe.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\winver.exe /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\winver.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\winlogon.exe winlogon.exe.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\winlogon.exe /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\winlogon.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\systemcpl.dll systemcpl.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\systemcpl.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\systemcpl.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\user32.dll user32.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppwmi.dll sppwmi.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slmgr.vbs /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppuinotify.dll sppuinotify.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppuinotify.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppuinotify.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppcommdlg.dll sppcommdlg.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppcommdlg.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppcommdlg.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppcomapi.dll sppcomapi.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppcomapi.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppcomapi.dll"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slwga.dll slwga.dll.lmceq"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slwga.dll /grant *S-1-1-0:F"' (with hidden window)
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppwmi.dll /grant *S-1-1-0:F"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /A /C "shutdown -r -t 0"' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /A /C "taskkill /im hale.exe /f 2>NUL>NUL"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\sppwmi.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppwmi.dll /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\sppwmi.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppwmi.dll sppwmi.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\systemcpl.dll"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\systemcpl.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\systemcpl.dll /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\systemcpl.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\systemcpl.dll systemcpl.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\winlogon.exe"
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppuinotify.dll sppuinotify.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppwmi.dll"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\winlogon.exe
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\winlogon.exe winlogon.exe.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\winver.exe"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\winver.exe
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\winver.exe /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\winver.exe /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\winver.exe winver.exe.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slui.exe"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\slui.exe
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slui.exe /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\slui.exe /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\winlogon.exe /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\winlogon.exe /grant *S-1-1-0:F
'<SYSTEM32>\icacls.exe' <SYSTEM32>\sppuinotify.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppuinotify.dll /grant *S-1-1-0:F"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\sppuinotify.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slmgr.vbs /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\slmgr.vbs /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slmgr.vbs slmgr.vbs.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\user32.dll"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\user32.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\user32.dll /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\user32.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\user32.dll user32.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slwga.dll"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\slwga.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\slwga.dll /grant *S-1-1-0:F"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\slmgr.vbs
'<SYSTEM32>\icacls.exe' <SYSTEM32>\slwga.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppcomapi.dll"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\sppcomapi.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppcomapi.dll /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\sppcomapi.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppcomapi.dll sppcomapi.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppcommdlg.dll"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\sppcommdlg.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\sppcommdlg.dll /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\sppcommdlg.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\sppcommdlg.dll sppcommdlg.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\sppuinotify.dll"
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slwga.dll slwga.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slui.exe slui.exe.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\ntkrnlpa.exe"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\ntkrnlpa.exe
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\ntkrnlpa.exe /grant *S-1-1-0:F"
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\user32.dll
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\slwga.dll
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\slwga.dll
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\sppcomapi.dll
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\sppcomapi.dll
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\sppcommdlg.dll
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\sppcommdlg.dll
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\sppuinotify.dll
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\sppuinotify.dll
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\sppwmi.dll
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\sppwmi.dll
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\systemcpl.dll
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\systemcpl.dll
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\winlogon.exe
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\winlogon.exe
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\winver.exe
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\winver.exe
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\slui.exe
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\slui.exe
'<SYSTEM32>\sfc.exe' /scannow
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\ntoskrnl
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\ntkrnlpa
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\ntoskrnl
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\*.lmceq *."
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\*.lmceq *."
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\user32.dll
'<SYSTEM32>\sfc.exe' /scanfile=%WINDIR%\SysWOW64\slmgr.vbs
'<SYSTEM32>\sfc.exe' /scanfile=<SYSTEM32>\slmgr.vbs
'<SYSTEM32>\net1.exe' START "Windows Modules Installer"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\ntkrnlpa.exe /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\ntkrnlpa.exe ntkrnlpa.exe.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\ntoskrnl.exe"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\ntoskrnl.exe
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\ntoskrnl.exe /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\ntoskrnl.exe /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\ntoskrnl.exe ntoskrnl.exe.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\Wat\*"
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\Wat\*
'<SYSTEM32>\cmd.exe' /A /C "icacls <SYSTEM32>\Wat\* /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\Wat\* /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "rmdir /s /q %ALLUSERSPROFILE%\Microsoft\Windows\RAI 2>NUL>NUL"
'<SYSTEM32>\cmd.exe' /A /C "rmdir /s /q %ALLUSERSPROFILE%\Microsoft\Windows\SXS 2>NUL>NUL"
'<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\HAL7600 /f 2>NUL>NUL"
'<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\HAL7600 /f
'<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\Chew7 /f 2>NUL>NUL"
'<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Chew7 /f
'<SYSTEM32>\cmd.exe' /A /C "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Chew7Hale /f 2>NUL>NUL"
'<SYSTEM32>\reg.exe' delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Chew7Hale /f
'<SYSTEM32>\cmd.exe' /A /C "schtasks.exe /delete /tn \Microsoft\Windows\RAI\RaiTask /f 2>NUL>NUL"
'<SYSTEM32>\schtasks.exe' /delete /tn \Microsoft\Windows\RAI\RaiTask /f
'<SYSTEM32>\cmd.exe' /A /C "schtasks.exe /delete /tn \Microsoft\Windows\PMS\ResetDTL /f 2>NUL>NUL"
'<SYSTEM32>\schtasks.exe' /delete /tn \Microsoft\Windows\PMS\ResetDTL /f
'<SYSTEM32>\cmd.exe' /A /C "NET START "Windows Modules Installer" 2>NUL>NUL"
'<SYSTEM32>\net.exe' START "Windows Modules Installer"
'%WINDIR%\syswow64\cmd.exe' /A /C "shutdown -r -t 0"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <SYSTEM32>\slmgr.vbs"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\Wat\* /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\Wat\* /grant *S-1-1-0:F"
'<SYSTEM32>\sc.exe' delete uodin64
'<SYSTEM32>\cmd.exe' /A /C "net stop sppsvc 2>NUL>NUL"
'<SYSTEM32>\net1.exe' stop sppsvc
'<SYSTEM32>\cmd.exe' /A /C "net stop sppuinotify 2>NUL>NUL"
'<SYSTEM32>\net1.exe' stop sppuinotify
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <DRIVERS>\uodin86.sys"
'<SYSTEM32>\takeown.exe' /f <DRIVERS>\uodin86.sys
'<SYSTEM32>\cmd.exe' /A /C "takeown /f <DRIVERS>\uodin64.sys"
'<SYSTEM32>\takeown.exe' /f <DRIVERS>\uodin64.sys
'<SYSTEM32>\cmd.exe' /A /C "icacls <DRIVERS>\uodin86.sys /grant *S-1-1-0:F"
'<SYSTEM32>\sc.exe' stop uodin64
'<SYSTEM32>\cmd.exe' /A /C "sc delete uodin64 2>NUL>NUL"
'<SYSTEM32>\icacls.exe' <DRIVERS>\uodin86.sys /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "del /f <DRIVERS>\uodin86.sys 2>NUL>NUL"
'<SYSTEM32>\cmd.exe' /A /C "del /f <DRIVERS>\uodin64.sys 2>NUL>NUL"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slmgr.vbs"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\slmgr.vbs
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slmgr.vbs /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\slmgr.vbs /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slmgr.vbs slmgr.vbs.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\user32.dll"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\user32.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\user32.dll /grant *S-1-1-0:F"
'<SYSTEM32>\cmd.exe' /A /C "icacls <DRIVERS>\uodin64.sys /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' <DRIVERS>\uodin64.sys /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "sc stop uodin64 2>NUL>NUL"
'<SYSTEM32>\sc.exe' delete uodin86
'<SYSTEM32>\cmd.exe' /A /C "sc delete uodin86 2>NUL>NUL"
'<SYSTEM32>\attrib.exe' -r -a -s -h <SYSTEM32>\hale.exe
'<SYSTEM32>\cmd.exe' /A /C "del /f <SYSTEM32>\hale.exe 2>NUL>NUL"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\servicing\TrustedInstaller.exe"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\servicing\TrustedInstaller.exe
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\servicing\TrustedInstaller.exe /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\servicing\TrustedInstaller.exe /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "bcdedit.exe -set testsigning off 2>NUL>NUL"
'<SYSTEM32>\bcdedit.exe' -set testsigning off
'<SYSTEM32>\cmd.exe' /A /C "sc config sppsvc start= delayed-auto 2>NUL>NUL"
'<SYSTEM32>\sc.exe' config sppsvc start= delayed-auto
'<SYSTEM32>\cmd.exe' /A /C "sc config sppuinotify start= demand 2>NUL>NUL"
'<SYSTEM32>\cmd.exe' /A /C "attrib -r -a -s -h <SYSTEM32>\hale.exe 2>NUL>NUL"
'<SYSTEM32>\sc.exe' config sppuinotify start= demand
'<SYSTEM32>\net.exe' start sppsvc
'<SYSTEM32>\net1.exe' start sppsvc
'<SYSTEM32>\cmd.exe' /A /C "net start sppuinotify 2>NUL>NUL"
'<SYSTEM32>\net.exe' start sppuinotify
'<SYSTEM32>\net1.exe' start sppuinotify
'<SYSTEM32>\cmd.exe' /A /C "ren <SYSTEM32>\slmgr.vbs.removewat slmgr.vbs 2>NUL>NUL"
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slmgr.vbs.removewat slmgr.vbs 2>NUL>NUL"
'<SYSTEM32>\cmd.exe' /A /C "cscript.exe //nologo <SYSTEM32>\slmgr.vbs -rilc 2>NUL>NUL"
'<SYSTEM32>\cscript.exe' //nologo <SYSTEM32>\slmgr.vbs -rilc
'<SYSTEM32>\cmd.exe' /A /C "sc stop uodin86 2>NUL>NUL"
'<SYSTEM32>\sc.exe' stop uodin86
'<SYSTEM32>\cmd.exe' /A /C "net start sppsvc 2>NUL>NUL"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\user32.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\user32.dll user32.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slwga.dll"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\slwga.dll
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\winlogon.exe
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\winlogon.exe /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\winlogon.exe /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\winlogon.exe winlogon.exe.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\winver.exe"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\winver.exe
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\winver.exe /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\winver.exe /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\winver.exe winver.exe.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\slui.exe"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\slui.exe
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slui.exe /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\slui.exe /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slui.exe slui.exe.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\ntkrnlpa.exe"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\ntkrnlpa.exe
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\ntkrnlpa.exe /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\ntkrnlpa.exe /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\ntkrnlpa.exe ntkrnlpa.exe.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\ntoskrnl.exe"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\ntoskrnl.exe
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\ntoskrnl.exe /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\ntoskrnl.exe /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\ntoskrnl.exe ntoskrnl.exe.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\Wat\*"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\winlogon.exe"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\systemcpl.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\systemcpl.dll systemcpl.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\systemcpl.dll /grant *S-1-1-0:F"
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\slwga.dll /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\slwga.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\slwga.dll slwga.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppcomapi.dll"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\sppcomapi.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppcomapi.dll /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\sppcomapi.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppcomapi.dll sppcomapi.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppcommdlg.dll"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\sppcommdlg.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppcommdlg.dll /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\sppcommdlg.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppcommdlg.dll sppcommdlg.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppuinotify.dll"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\sppuinotify.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppuinotify.dll /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\sppuinotify.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppuinotify.dll sppuinotify.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\sppwmi.dll"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\sppwmi.dll
'<SYSTEM32>\cmd.exe' /A /C "icacls %WINDIR%\SysWOW64\sppwmi.dll /grant *S-1-1-0:F"
'<SYSTEM32>\icacls.exe' %WINDIR%\SysWOW64\sppwmi.dll /grant *S-1-1-0:F
'<SYSTEM32>\cmd.exe' /A /C "ren %WINDIR%\SysWOW64\sppwmi.dll sppwmi.dll.lmceq"
'<SYSTEM32>\cmd.exe' /A /C "takeown /f %WINDIR%\SysWOW64\systemcpl.dll"
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\systemcpl.dll
'<SYSTEM32>\takeown.exe' /f %WINDIR%\SysWOW64\Wat\*
'%WINDIR%\syswow64\shutdown.exe' -r -t 0

Attempts to shut down the Windows operating system.

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial