;uVS v4.1.8 [http://dsrt.dyndns.org:8888]
;Target OS: NTv10.0
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------

zoo %SystemDrive%\PROGRAMDATA\WINDOWSTASK\MICROSOFTHOST.EXE
addsgn BA6F9BB2BD1549720B9C2D754C2160FBDA75303AC179F350C8488484185DBB05A8C62B5A3E559DF12A80849F0E958DD2BE1324BE1589F5A7353F2FF58685C18B 15 Win64/CoinMiner.GA 7

zoo %SystemDrive%\PROGRAMDATA\RUNDLL\RUNDLL.EXE
addsgn 9252772ADE6AC1CC0BB41A4E33231995AF8CBA7E8EBD1EA3F0C44EA2D3388D5DF8652EEF3F559D492A5BF198CD08CA1481CE336395DB6B5F26028CA4D985CC8F 8 Python/Agent.BL 7

zoo %SystemDrive%\PROGRAMDATA\WINDOWSTASK\APPMODULE.EXE
addsgn BA6F9BB2BDAD4B720B9C2D754C2164FBDA75303AC9A957FB69E38D3789E5B8B336C8D4523E1D1682D4955A884316B6EFA5C7ED721D5178962473A4EF8F85E653 8 Win64/CoinMiner.GA 7

zoo %SystemDrive%\PROGRAMDATA\RUNDLL\TRFO-2.DLL
addsgn 79132211B9E9317E0AA1AB592ECC12057863670B76059487D048293DBCFE724C23B46BD23E4514448F05848FCF03E97F7DCF616FC95FB03CA4423CAAC716AB4E 64 Win32/HackTool.Equation 7

zoo %SystemDrive%\PROGRAMDATA\RUNDLL\TIBE-2.DLL
addsgn 79132211B9E9317E0AA1AB5958CB12057863670B76059487D048293DBCFE724C23B41BFD3D451444FF2A878FCF0399507ECF616F9970B33CA4426C85C416AB4E 64 Win32/Exploit.Equation 7

zoo %SystemDrive%\PROGRAMDATA\RUNDLL\COLI-0.DLL
addsgn 79132211B9E9317E0AA1AB59E4CB12057863670B76059487D048293DBCFE724C23B4E3133E45144437C4848FCF0351BE7DCF616F419EB03CA442B46BC716AB4E 64 Win32/HackTool.Equation 7

zoo %SystemDrive%\PROGRAMDATA\RUNDLL\LIBXML2.DLL
addsgn 79132211B9E9317E0AA1AB5970DA12057863670B76059487D048293DBCFE724C23B4BB05324514445FD2888FCF0339A871CF616F3988BC3CA442CC7DCB16AB4E 64 Win32/HackTool.Equation 7

zoo %SystemDrive%\PROGRAMDATA\RUNDLL\POSH-0.DLL
addsgn 79132211B9E9317E0AA1AB5911CB12057863670B76059487D048293DBCFE724C23B4E3133E45144437C4848FCF0351BE7DCF616F419EB03CA442B46BC716AB4E 64 Win32/HackTool.Equation 7

zoo %SystemDrive%\PROGRAMDATA\RUNDLL\TRCH-1.DLL
addsgn 79132211B9E9317E0AA1AB5914CB12057863670B76059487D048293DBCFE724C23B4B3A33E4514444774848FCF03210E7DCF616F312EB03CA442C4DBC716AB4E 64 Win32/HackTool.Equation 7

zoo %SystemDrive%\PROGRAMDATA\RUNDLL\TUCL-1.DLL
addsgn 79132211B9E9317E0AA1AB59E4CB12057863670B76059487D048293DBCFE724C23B4E3633E45144437B4848FCF0351CE7DCF616F41EEB03CA442B41BC716AB4E 64 Win32/HackTool.Equation 7

zoo %SystemDrive%\PROGRAMDATA\RUNDLL\ETERNALBLUE-2.2.0.EXE
addsgn 1A00709A55838C8FF42B624E41A083442575D9D218BB1F87A0E354FD502954BCB356C39BF2995185E74C48538ADA8536B154AC565D51FC083D7C6CA48B222E06 8 Win32/Exploit.Equation.EternalBlue 7

zoo %SystemDrive%\PROGRAMDATA\RUNDLL\EXMA-1.DLL
zoo %SystemDrive%\PROGRAMDATA\RUNDLL\UCL.DLL
addsgn 79132211B9E9317E0AA1AB5916CB12057863670B76059487D048293DBCFE724C23B483A33E4514441774848FCF03710E7DCF616F612EB03CA44294DBC716AB4E 64 Win32/HackTool.Equation 7

zoo %SystemDrive%\USERS\ZVER\APPDATA\ROAMING\.MINECRAFT\TLAUNCHER.EXE
addsgn A7659219B9628B762FD6AEB16437079517CBFC1E2104E087154E719A50D6714C769CCE9F0C149DC0CEDD7B7ECB626FFA2854E5C6679BB0A5C82A5BCE5796B2E3 8 Trojan.DownLoader29.14148 [DrWeb] 7

chklst
delvir

delref %SystemDrive%\PROGRAMDATA\WINDOWSTASK\NVRTC64_80.DLL
delref %SystemDrive%\PROGRAMDATA\WINDOWSTASK\NVRTC-BUILTINS64_80.DLL
apply

regt 27
deltmp
delref {35EF4182-F900-4632-B072-8639E4478A61}\[CLSID]
delref %SystemRoot%\SYSWOW64\MAPSTOASTTASK.DLL
delref %SystemRoot%\SYSWOW64\MAPSUPDATETASK.DLL
delref %SystemDrive%\USERS\ZVER\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\ONEDRIVESTANDALONEUPDATER.EXE
delref %SystemRoot%\SYSWOW64\GPSVC.DLL
delref %SystemRoot%\SYSWOW64\PEERDISTSVC.DLL
delref %SystemRoot%\SYSWOW64\APPVETWCLIENTRES.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\MRXSMB.SYS
delref %SystemRoot%\SYSWOW64\W32TIME.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\USBXHCI.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\SRV2.SYS
delref %SystemRoot%\SYSWOW64\RDPCORETS.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\HTTP.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\TCPIP.SYS
delref %SystemRoot%\SYSWOW64\UMPOEXT.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\VMBUSR.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\DMVSC.SYS
delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL
delref %SystemRoot%\SYSWOW64\CSCSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\VMBKMCL.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\SPACEPORT.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\FVEVOL.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\AFD.SYS
delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS
delref %SystemRoot%\SYSWOW64\HVHOSTSVC.DLL
delref %SystemRoot%\SYSWOW64\LSM.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\SYNTH3DVSC.SYS
delref %SystemRoot%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORSEC.DLL
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref %SystemRoot%\SYSWOW64\IE4UINIT.EXE
delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID]
delref {E0DD6CAB-2D10-11D2-8F1A-0000F87ABD16}\[CLSID]
delref %SystemRoot%\SYSWOW64\BLANK.HTM
delref {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}\[CLSID]
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref {B1883831-F0D8-4453-8245-EEAAD866DD6E}\[CLSID]
delref {BBACC218-34EA-4666-9D7A-C78F2274A524}\[CLSID]
delref {5AB7172C-9C11-405C-8DD5-AF20F3606282}\[CLSID]
delref {A78ED123-AB77-406B-9962-2A5D9D2F7F30}\[CLSID]
delref {F241C880-6982-4CE5-8CF7-7085BA96DA5A}\[CLSID]
delref {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\NOTEPAD++\NPPSHELL_06.DLL
delref %Sys32%\DRIVERS\VMBUSR.SYS
delref %SystemRoot%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORSEC.DLL
delref %SystemDrive%\PROGRAM FILES\JAVA\JRE-10.0.1\BIN\SSV.DLL
delref %Sys32%\BLANK.HTM
delref HELPSVC\[SERVICE]
delref SACSVR\[SERVICE]
delref SWPRV\[SERVICE]
delref TBS\[SERVICE]
delref VMMS\[SERVICE]
delref MESSENGER\[SERVICE]
delref RDSESSMGR\[SERVICE]
delref %SystemDrive%\USERS\ZVER\APPDATA\LOCAL\TEMP\V8_D658_4F.TMP
delref %SystemDrive%\USERS\USR1CV8\APPDATA\LOCAL\TEMP\V8_D658_4F.TMP
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.23\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.342\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.34.7\PSMACHINE_64.DLL
delref %Sys32%\MSMIRADISP.DLL
delref %SystemDrive%\PROGRAM FILES\NVIDIA CORPORATION\DISPLAY\NVLICENSINGS.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.34.11\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.7\PSMACHINE_64.DLL
delref %Sys32%\TETHERINGSETTINGHANDLER.DLL
delref %Sys32%\QUICKACTIONSPS.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\DAO\DAO360.DLL
delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SPEECHRUNTIME.EXE
delref %SystemRoot%\SYSWOW64\TAPILUA.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.23\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\LOCATIONFRAMEWORK.DLL
delref %SystemRoot%\SYSWOW64\MAPSBTSVCPROXY.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.342\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.34.7\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\EAPPCFGUI.DLL
delref %SystemRoot%\SYSWOW64\MAPSCSP.DLL
delref %SystemRoot%\SYSWOW64\LISTSVC.DLL
delref %SystemRoot%\SYSWOW64\AUTHHOSTPROXY.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.34.11\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\WBEM\NLMCIM.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.7\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\TEAMVIEWER\TEAMVIEWER.EXE
delref %SystemRoot%\SYSWOW64\SMARTSCREEN.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.23\GOOGLEUPDATEBROKER.EXE
delref %SystemRoot%\SYSWOW64\IDLISTEN.DLL
delref %SystemRoot%\SYSWOW64\WIFICONFIGSP.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\SYSTEM\OLE DB\MSDAORA.DLL
delref {EAF483F9-215A-46E1-ACE5-2637AEABC2C1}\[CLSID]
;-------------------------------------------------------------

deldirex %SystemDrive%\PROGRAMDATA\WINDOWSTASK
restart