Technical Information
- %WINDIR%\tasks\bkuoyrqglqivbkjpmlt.job
- <SYSTEM32>\tasks\bkuoyrqglqivbkjpmlt
- %WINDIR%\tasks\liakypefedcbcvv.job
- <SYSTEM32>\tasks\liakypefedcbcvv
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\EnMwxePGuuPJC' = '0'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PdWztjahGOaU2' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PdWztjahGOaU2' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\ScBKUGHPU' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\ScBKUGHPU' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\ScBKUGHPU' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\ScBKUGHPU' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\gcEWixyojWUn' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\gcEWixyojWUn' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\gcEWixyojWUn' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\mZYGlpmalgeimlTy' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\gcEWixyojWUn' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\fXSlzuQEPHXZvQVB' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\fXSlzuQEPHXZvQVB' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\fXSlzuQEPHXZvQVB' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\jJggNGLcolNZq' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\jJggNGLcolNZq' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\jJggNGLcolNZq' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\jJggNGLcolNZq' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\ULwniJSFXCpNoitRJ' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\ULwniJSFXCpNoitRJ' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PdWztjahGOaU2' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PdWztjahGOaU2' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PdWztjahGOaU2' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\ScBKUGHPU' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\gcEWixyojWUn' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\fXSlzuQEPHXZvQVB' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\jJggNGLcolNZq' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\ULwniJSFXCpNoitRJ' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\mZYGlpmalgeimlTy' = '0'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\mZYGlpmalgeimlTy' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\ULwniJSFXCpNoitRJ' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\fXSlzuQEPHXZvQVB' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\mZYGlpmalgeimlTy' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\EnMwxePGuuPJC' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\EnMwxePGuuPJC' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\EnMwxePGuuPJC' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\EnMwxePGuuPJC' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\LiLsspvSkIE' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\LiLsspvSkIE' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\LiLsspvSkIE' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\LiLsspvSkIE' = '00000000'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\LiLsspvSkIE' = '0'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\mZYGlpmalgeimlTy' = '00000000'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\ULwniJSFXCpNoitRJ' = '00000000'
- %WINDIR%\temp\mzyglpmalgeimlty\ivvheaqcimruiinu.vbs
- %ProgramFiles(x86)%\scbkughpu\boaixp.dll
- %ProgramFiles(x86)%\gcewixyojwun\nyfirqwfmr.dll
- %WINDIR%\temp\mzyglpmalgeimlty\ivvheaqcimruiinu.vbs
- %WINDIR%\tasks\bkuoyrqglqivbkjpmlt.job
- <SYSTEM32>\tasks\bkuoyrqglqivbkjpmlt
- %PROGRAMDATA%\ntuser.pol
- %PROGRAMDATA%\tempntuser.pol
- DNS ASK clients2.google.com
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\Temp\mZYGlpmalgeimlTy\IVVhEaQCiMRUIINU.vbs"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\gcEWixyojWUn" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\gcEWixyojWUn" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\gcEWixyojWUn" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\fXSlzuQEPHXZvQVB" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\fXSlzuQEPHXZvQVB" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\fXSlzuQEPHXZvQVB" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\fXSlzuQEPHXZvQVB" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\jJggNGLcolNZq" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\jJggNGLcolNZq" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\jJggNGLcolNZq" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\ULwniJSFXCpNoitRJ" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\ULwniJSFXCpNoitRJ" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\ULwniJSFXCpNoitRJ" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\ULwniJSFXCpNoitRJ" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '<Full path to file>' /comm we /adp FSIQ2ZQIQ7JSIQ4TRIQ6LRIQ5PRIQ3MQIQ3ESIQ5HRIQ2GRIQ8AQIQ1KRIQ9FQIQ5JSIQ2ERIQ5JRIQ0LQIQ0' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\gcEWixyojWUn" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\ScBKUGHPU" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\ScBKUGHPU" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\EnMwxePGuuPJC" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\EnMwxePGuuPJC" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\EnMwxePGuuPJC" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\EnMwxePGuuPJC" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\LiLsspvSkIE" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\LiLsspvSkIE" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\LiLsspvSkIE" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\LiLsspvSkIE" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\jJggNGLcolNZq" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PdWztjahGOaU2" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PdWztjahGOaU2" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PdWztjahGOaU2" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PdWztjahGOaU2" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\ScBKUGHPU" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\ScBKUGHPU" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR" /t REG_DWORD /d 0 /reg:32' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:64' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "bkuOyRqgLqivbkjpMlT" /SC once /ST 00:09:45 /V1 /F /RU "SYSTEM" /TR "\"<Full path to file>\" /comm we /adp FSIQ2ZQIQ7JSIQ4TRIQ6LRIQ5PRIQ3MQIQ3ESIQ5HRIQ2GRIQ8AQIQ1KRIQ9FQIQ5JSIQ2ERIQ...
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "hYPJlpPBzYjdfsETwLI" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "hYPJlpPBzYjdfsETwLI"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "iTeawIIdQMsySzaYEnI2" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "iTeawIIdQMsySzaYEnI2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "iTeawIIdQMsySzaYEnI" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "iTeawIIdQMsySzaYEnI"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "dMgogLzESOhPgVvUR2" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "dMgogLzESOhPgVvUR2"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\ULwniJSFXCpNoitRJ" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "dMgogLzESOhPgVvUR" /F
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "nFrYBIbXfmLJFmNNV2" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "nFrYBIbXfmLJFmNNV2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "nFrYBIbXfmLJFmNNV" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "nFrYBIbXfmLJFmNNV"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "bkuOyRqgLqivbkjpMlT" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "bkuOyRqgLqivbkjpMlT"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\ULwniJSFXCpNoitRJ" /t REG_DWORD /d 0 /reg:64
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "dMgogLzESOhPgVvUR"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\ULwniJSFXCpNoitRJ" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "hYPJlpPBzYjdfsETwLI2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "aEKDrfyXoDMzRm" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "DSVxamWwETNzC2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "DSVxamWwETNzC" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "DSVxamWwETNzC"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "OVmPOmDstyQiQ2" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "OVmPOmDstyQiQ2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "OVmPOmDstyQiQ" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "OVmPOmDstyQiQ"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "TVQGCyKxcboGvx" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "ZVagmKYdjlbWlYY"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "hYPJlpPBzYjdfsETwLI2" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "aEKDrfyXoDMzRm"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "LiaKYpeFedCbCVv2" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "LiaKYpeFedCbCVv2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "LiaKYpeFedCbCVv" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "LiaKYpeFedCbCVv"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "ZVagmKYdjlbWlYY2" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "ZVagmKYdjlbWlYY2"
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "ZVagmKYdjlbWlYY" /F
- '%WINDIR%\syswow64\schtasks.exe' /END /TN "TVQGCyKxcboGvx"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\ULwniJSFXCpNoitRJ" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\jJggNGLcolNZq" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\jJggNGLcolNZq" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\LiLsspvSkIE" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\LiLsspvSkIE" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\EnMwxePGuuPJC" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\EnMwxePGuuPJC" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\EnMwxePGuuPJC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\EnMwxePGuuPJC" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\cmd.exe' /C mkdir "%WINDIR%\Temp\mZYGlpmalgeimlTy" && copy nul "%WINDIR%\Temp\mZYGlpmalgeimlTy\IVVhEaQCiMRUIINU.vbs"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\LiLsspvSkIE" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\gpupdate.exe' /force /target:computer
- '%WINDIR%\syswow64\schtasks.exe' /run /tn "bkuOyRqgLqivbkjpMlT"
- '%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\mZYGlpmalgeimlTy" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\LiLsspvSkIE" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\jJggNGLcolNZq" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\gcEWixyojWUn" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\jJggNGLcolNZq" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\fXSlzuQEPHXZvQVB" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\fXSlzuQEPHXZvQVB" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\fXSlzuQEPHXZvQVB" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\fXSlzuQEPHXZvQVB" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\gcEWixyojWUn" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\gcEWixyojWUn" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\gcEWixyojWUn" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\ScBKUGHPU" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\ScBKUGHPU" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\ScBKUGHPU" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\ScBKUGHPU" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PdWztjahGOaU2" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PdWztjahGOaU2" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PdWztjahGOaU2" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PdWztjahGOaU2" /t REG_DWORD /d 0 /reg:32
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\PIuAjHjrAbtUEDRgbNR" /t REG_DWORD /d 0 /reg:64
- '%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "DSVxamWwETNzC2" /F
- '%WINDIR%\syswow64\schtasks.exe' /CREATE /TR "rundll32 \"%ProgramFiles(x86)%\ScBKUGHPU\bOAIxP.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "LiaKYpeFedCbCVv" /V1 /F