Троян(или майнер), который маскируется под процессом NT Kernel and System

begin
 TerminateProcessByName('c:\programdata\realtekhd\taskhost.exe');
 TerminateProcessByName('c:\programdata\windows\rutserv.exe');
 TerminateProcessByName('c:\programdata\windowstask\microsofthost.exe');
 TerminateProcessByName('c:\programdata\windowstask\audiodg.exe');
 TerminateProcessByName('c:\programdata\windowstask\appmodule.exe');
 QuarantineFile('C:\Programdata\WindowsTask\winlogon.exe', '');
 QuarantineFile('c:\programdata\realtekhd\taskhostw.exe', '');
 QuarantineFile('c:\programdata\realtekhd\taskhost.exe', '');
 QuarantineFile('c:\programdata\windows\rutserv.exe', '');
 QuarantineFile('c:\programdata\windowstask\microsofthost.exe', '');
 QuarantineFile('c:\programdata\windowstask\audiodg.exe', '');
 QuarantineFile('c:\programdata\windowstask\appmodule.exe', '');
 DeleteFile('c:\programdata\windowstask\appmodule.exe', '32');
 DeleteFile('c:\programdata\windowstask\audiodg.exe', '32');
 DeleteFile('c:\programdata\windowstask\microsofthost.exe', '32');
 DeleteFile('c:\programdata\windows\rutserv.exe', '32');
 DeleteFile('c:\programdata\realtekhd\taskhost.exe', '32');
 DeleteFile('c:\programdata\realtekhd\taskhostw.exe', '32');
 DeleteFile('C:\Programdata\WindowsTask\winlogon.exe', '64');
 DeleteFile('C:\Programdata\RealtekHD\taskhost.exe', '64');
 DeleteFile('C:\Programdata\RealtekHD\taskhostw.exe', '64');
 DeleteFile('c:\programdata\windows\rutserv.exe', '64');
 DeleteFile('c:\programdata\windowstask\appmodule.exe', '64');
 DeleteService('RManService');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Realtek HD Audio', 'x64');
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
 DeleteSchedulerTask('Microsoft\Windows\Wininet\Cleaner');
 DeleteSchedulerTask('Microsoft\Windows\Wininet\RealtekHDControl');
 DeleteSchedulerTask('Microsoft\Windows\Wininet\RealtekHDStartUP');
 DeleteSchedulerTask('Microsoft\Windows\Wininet\Taskhost');
 DeleteSchedulerTask('Microsoft\Windows\Wininet\Taskhostw');
 ClearHostsFile;
ExecuteSysClean;
 ExecuteWizard('TSW', 2, 3, true);
RebootWindows(true);
end.

begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pvirus quarantine ./Quarantine/', 1, 0, true);
end.

Start::
CreateRestorePoint:
HKLM\...\Run: [Realtek HD Audio] => C:\ProgramData\RealtekHD\taskhostw.exe <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-4224339370-3627809761-499081276-1001\...\Run: [Zoom] => [X]
BootExecute: autocheck autochk * sh4native 7099
GroupPolicy: Restriction ? <==== ATTENTION
S3 esgiguard; \??\D:\SpyHunter\esgiguard.sys [X]
2020-09-07 21:18 - 2020-06-03 16:56 - 000000000 __SHD C:\ProgramData\Windows
2020-09-07 21:18 - 2020-05-28 14:54 - 000000000 __SHD C:\ProgramData\RealtekHD
2020-09-07 21:42 - 2020-05-24 15:13 - 000000410 __RSH C:\ProgramData\ntuser.pol
2020-09-07 21:14 - 2020-05-28 14:54 - 000000000 __SHD C:\ProgramData\WindowsTask
2020-09-04 21:56 - 2020-05-28 14:55 - 000000000 __SHD C:\ProgramData\McAfee
2020-09-04 14:01 - 2020-06-03 16:57 - 000000000 __SHD C:\rdp
2020-09-04 14:01 - 2020-05-28 14:54 - 000000000 __SHD C:\ProgramData\Setup
2020-09-04 14:01 - 2020-05-28 14:54 - 000000000 __SHD C:\ProgramData\install
2020-05-08 17:52 - 2017-12-27 20:20 - 001460224 _____ (Stas'M Corp.) C:\ProgramData\RDPWinst.exe
CMD: net user john /delete
CMD: netsh advfirewall reset
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::