Miner wup.exe на ПК

begin
 TerminateProcessByName('c:\users\papiros\appdata\roaming\microsoft\defragmentation\optimization.exe');
 TerminateProcessByName('c:\users\papiros\appdata\roaming\microsoft\defragmentation\chkdsk\ntfs.exe');
 QuarantineFile('C:\ProgramData\EsnAHBLBMOGFYIVB\UUWZvFL.wsf', '');
 QuarantineFile('C:\Program Files (x86)\fSyJFcrtzSruXXdjXdR\tpqOvjH.dll', '');
 QuarantineFile('C:\Users\Papiros\AppData\Local\Programs\Netreklami\updater.exe', '');
 QuarantineFile('C:\Program Files (x86)\dQowkZuWU\wyNdka.dll', '');
 QuarantineFile('C:\Program Files (x86)\zBlRBklInkjU2\FwUydNodRksah.dll', '');
 QuarantineFile('C:\ProgramData\dirForDJ\V_K_D_J.exe', '');
 QuarantineFile('C:\Program Files (x86)\BoKHLQCvtCltC\tvCVHuG.dll', '');
 QuarantineFile('C:\WINDOWS\rss\csrss.exe', '');
 QuarantineFile('c:\users\papiros\appdata\roaming\microsoft\defragmentation\optimization.exe', '');
 QuarantineFile('c:\users\papiros\appdata\roaming\microsoft\defragmentation\chkdsk\ntfs.exe', '');
 DeleteFile('c:\users\papiros\appdata\roaming\microsoft\defragmentation\optimization.exe', '32');
 DeleteFile('c:\users\papiros\appdata\roaming\microsoft\defragmentation\chkdsk\ntfs.exe', '32');
 DeleteFile('C:\ProgramData\dirForDJ\V_K_D_J.exe', '64');
 DeleteFile('C:\WINDOWS\rss\csrss.exe', '64');
 DeleteFile('C:\Program Files (x86)\BoKHLQCvtCltC\tvCVHuG.dll', '64');
 DeleteFile('C:\Program Files (x86)\zBlRBklInkjU2\FwUydNodRksah.dll', '64');
 DeleteFile('C:\Program Files (x86)\dQowkZuWU\wyNdka.dll', '64');
 DeleteFile('C:\Users\Papiros\AppData\Local\Programs\Netreklami\updater.exe', '64');
 DeleteFile('C:\Users\Papiros\AppData\Roaming\Microsoft\Defragmentation\Optimization.exe', '64');
 DeleteFile('C:\Program Files (x86)\fSyJFcrtzSruXXdjXdR\tpqOvjH.dll', '64');
 DeleteFile('C:\ProgramData\EsnAHBLBMOGFYIVB\UUWZvFL.wsf', '64');
 DeleteFile('c:\users\papiros\appdata\roaming\microsoft\defragmentation\chkdsk\ntfs.exe', '64');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'SparklingDream', 'x64');
 DeleteFileMask('C:\Users\Papiros\AppData\Local\Programs\Netreklami\', '*', true);
 DeleteDirectory('C:\Users\Papiros\AppData\Local\Programs\Netreklami\');
 DeleteFileMask('C:\Program Files (x86)\zBlRBklInkjU2\', '*', true);
 DeleteDirectory('C:\Program Files (x86)\zBlRBklInkjU2\');
 DeleteFileMask('C:\Program Files (x86)\BoKHLQCvtCltC\', '*', true);
 DeleteDirectory('C:\Program Files (x86)\BoKHLQCvtCltC\');
 DeleteFileMask('C:\Program Files (x86)\dQowkZuWU\', '*', true);
 DeleteDirectory('C:\Program Files (x86)\dQowkZuWU\');
 DeleteFileMask('C:\ProgramData\dirForDJ\', '*', true);
 DeleteDirectory('C:\ProgramData\dirForDJ\');
 DeleteFileMask('c:\users\papiros\appdata\roaming\microsoft\defragmentation\', '*', true);
 DeleteDirectory('c:\users\papiros\appdata\roaming\microsoft\defragmentation\');
 DeleteSchedulerTask('eLmdoneBDkVnNMUMMGA2');
 DeleteSchedulerTask('jdsltod');
 DeleteSchedulerTask('jTCFciAMJTFiCI');
 DeleteSchedulerTask('LhVInomDFaKvgmi2');
 DeleteSchedulerTask('NetReklamiLogonUpdate');
 DeleteSchedulerTask('ProactiveScan');
 DeleteSchedulerTask('sRRihYzekXjxjkwjn2');
 DeleteSchedulerTask('VgEOxzRROSEul2');
ExecuteSysClean;
 Executerepair(1);
 ExecuteWizard('TSW', 2, 3, true);
RebootWindows(true);
end.

begin
 DeleteFile(GetAVZDirectory+'quarantine.7z');
 ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine .\Quarantine\*', 1, 300000, false);
end.

Start::
SystemRestore: On
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ограничение <==== ВНИМАНИЕ
HKU\S-1-5-21-2615889275-921536827-1412634802-1001\...\Policies\Explorer: [] 
HKU\S-1-5-21-2615889275-921536827-1412634802-1001\...\MountPoints2: {68a22686-de32-11eb-9be3-00270e0dc608} - "D:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-2615889275-921536827-1412634802-1001\...\MountPoints2: {b753bae6-896d-11eb-9bb5-00270e0dc608} - "D:\Setup.exe" 
GroupPolicy: Ограничение - Windows Defender <==== ВНИМАНИЕ
Policies: C:\ProgramData\NTUSER.pol: Ограничение <==== ВНИМАНИЕ
CHR HKLM-x32\...\Chrome\Extension: [fpfmmadpecocfkeapbffclpmjpbgidaf]
OPR Extension: (Adblocker for Youtube™) - C:\Users\Papiros\AppData\Roaming\Opera Software\Opera Stable\Extensions\kofpgjgokfidcohjcdfcndkbindgmcmc [2021-07-13]
Edge Extension: (T-Сashback — кэшбэк-сервис) - C:\Users\Papiros\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\odbmjgikedenicicookngdckhkjbebpd [2021-07-13]
Edge HKLM-x32\...\Edge\Extension: [odbmjgikedenicicookngdckhkjbebpd]
YAN Extension: (Find-it.Pro Поиск) - C:\Users\Papiros\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\npiclhkkbgabhapklngkpahnaafkgpne [2021-07-05]
YAN Extension: (T-Сashback — кэшбэк-сервис) - C:\Users\Papiros\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\odbmjgikedenicicookngdckhkjbebpd [2021-07-05]
2021-07-13 17:27 - 2021-07-13 17:27 - 000000000 ____D C:\ProgramData\HFltlfldbJPjBpr
2021-07-05 15:27 - 2021-07-24 18:55 - 000000000 ____D C:\Program Files (x86)\fSyJFcrtzSruXXdjXdR
AlternateDataStreams: C:\ProgramData\TEMP:58A5270D [376]
HKU\S-1-5-21-2615889275-921536827-1412634802-1001\Software\Classes\.scr: scrfile =>  <==== ВНИМАНИЕ
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
EmptyTemp:
Reboot:
End::