Trojan.DownLoader29.48932

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%WINDIR%\tasks\bkuzeulkgsfvjykvpnw.job
<SYSTEM32>\tasks\bkuzeulkgsfvjykvpnw
%WINDIR%\tasks\kjmnwfnoawmfhxh.job
<SYSTEM32>\tasks\kjmnwfnoawmfhxh
%WINDIR%\tasks\kzdjduzygnqrmza.job
<SYSTEM32>\tasks\kzdjduzygnqrmza
<SYSTEM32>\tasks\kjmnwfnoawmfhxh2
<SYSTEM32>\tasks\ejlcpxaxczflnx
<SYSTEM32>\tasks\wzdwamjoirsyg2
<SYSTEM32>\tasks\ibziuhjytxuptmnsu2
<SYSTEM32>\tasks\wbyhycedloqavqrewte2

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion with following registry keys:

[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NIErSAELLsOOC' = '0'
[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR' = '00000000'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\bzDQAplLjIE' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\bzDQAplLjIE' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\bzDQAplLjIE' = '00000000'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\bzDQAplLjIE' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\udVlifMMU' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\udVlifMMU' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\udVlifMMU' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\ZePIqOOyHXxJvXGe' = '00000000'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\udVlifMMU' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\LUBciApiRJzrvXVB' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\LUBciApiRJzrvXVB' = '00000000'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\LUBciApiRJzrvXVB' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\lltgznTbqqOCq' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\lltgznTbqqOCq' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\lltgznTbqqOCq' = '00000000'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\lltgznTbqqOCq' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\BBeQLtgiINwxnYokx' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\BBeQLtgiINwxnYokx' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR' = '00000000'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XAIfWVzjYwlU2' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XAIfWVzjYwlU2' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XAIfWVzjYwlU2' = '00000000'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XAIfWVzjYwlU2' = '0'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR' = '0'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\bzDQAplLjIE' = '0'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\udVlifMMU' = '0'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\LUBciApiRJzrvXVB' = '0'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '<LS_APPDATA>Low\lltgznTbqqOCq' = '0'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\BBeQLtgiINwxnYokx' = '0'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\ZePIqOOyHXxJvXGe' = '0'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\ZePIqOOyHXxJvXGe' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\BBeQLtgiINwxnYokx' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%PROGRAMDATA%\LUBciApiRJzrvXVB' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\ZePIqOOyHXxJvXGe' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NIErSAELLsOOC' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NIErSAELLsOOC' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NIErSAELLsOOC' = '00000000'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NIErSAELLsOOC' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NbbDohHftPUn' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NbbDohHftPUn' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NbbDohHftPUn' = '00000000'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NbbDohHftPUn' = '00000000'
[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\XAIfWVzjYwlU2' = '00000000'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\NbbDohHftPUn' = '0'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\ZePIqOOyHXxJvXGe' = '00000000'
[<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\BBeQLtgiINwxnYokx' = '00000000'

Creates and executes the following

'' (downloaded from the Internet)

Terminates or attempts to terminate

the following user processes:

iexplore.exe
firefox.exe

Modifies settings of Windows Internet Explorer

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Flags' = '000000DB'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'CurrentLevel' = '00000000'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Flags' = '000000DB'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'CurrentLevel' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'

Modifies file system

Creates the following files

<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\xml[1].xml
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\fr\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\gu\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\he\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\hi\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\hr\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\fi\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\fil\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\hu\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\ja\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\kn\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\ko\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\lt\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\lv\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\id\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\it\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\fa\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\et\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\es_419\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\am\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\ar\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\be\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\bg\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\bn\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\ca\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\kernel.js
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\cs\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\de\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\el\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\en\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\en_gb\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\en_us\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\es\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\da\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\mk\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\ml\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\mr\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\ms\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\vi\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\zh_cn\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\zh_tw\messages.json
%ProgramFiles(x86)%\bzdqaplljie\aivioqbkzh.exe
%ProgramFiles(x86)%\bzdqaplljie\tvggeuxbf.dll
%ProgramFiles(x86)%\bzdqaplljie\4xnre.dll
%ProgramFiles(x86)%\nbbdohhftpun\ngmrszctys.dll
%TEMP%\bbeqltgiinwxnyokx\tehkgkhgctsfytjk\ccnkozd.dll
%ProgramFiles(x86)%\udvlifmmu\pnzhzkz.xml
%ProgramFiles(x86)%\xaifwvzjywlu2\wsbnukhdnqwah.dll
%ProgramFiles(x86)%\xaifwvzjywlu2\vvrrihu.xml
%PROGRAMDATA%\lubciapirjzrvxvb\yhktowy.wsf
%PROGRAMDATA%\lubciapirjzrvxvb\oauuckp.xml
%ProgramFiles(x86)%\xsehbajlvbtdepgmqbr\ayhmhyt.dll
%ProgramFiles(x86)%\xsehbajlvbtdepgmqbr\scfdkrd.xml
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\uk\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\th\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\tr\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\te\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\nl\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\no\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\pl\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\pt\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\pt_br\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\pt_pt\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\ro\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\ru\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\sk\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\sl\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\sq\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\sr\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\sv\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\sw\messages.json
%ProgramFiles(x86)%\bzdqaplljie\files\_locales\ta\messages.json
%ProgramFiles(x86)%\niersaellsooc\ldzlqhf.dll
%ProgramFiles(x86)%\bzdqaplljie\files\background.html
%ProgramFiles(x86)%\bzdqaplljie\icon16.ico
%ProgramFiles(x86)%\bzdqaplljie\kmj0zit.dll
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\da\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\de\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\el\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\en\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\en_bs\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ca\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\cs\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\en_gb\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\es_419\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\et\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\fa\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\fi\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\fil\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\en_us\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\es\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\bn\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\bg\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\be\messages.json
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\oiuwertmnasgbkj[1].exe
%TEMP%\oiuwertmnasgbkj.exe
%WINDIR%\temp\zepiqooyhxxjvxge\oiqzehfcqgdtizpj.vbs
%TEMP%\bbeqltgiinwxnyokx\lzofpraczsssokwo\zohhbcfplnjdoere.exe
%ProgramFiles(x86)%\udvlifmmu\snkdqa.dll
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js_temppixpdd
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\things[1].xml
%ProgramFiles(x86)%\mozilla firefox\browser\features\{ba546d42-baec-4c9c-870e-d0be7892dbd5}.xpi
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\icons\icon128.png
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\icons\icon16.png
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\icons\icon48.png
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\manifest.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\am\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ar\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\icons\ficon128.png
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\fr\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\gu\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\he\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\hi\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ro\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ru\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sk\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sl\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sq\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sr\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sv\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\sw\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ta\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\te\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\th\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\tr\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\uk\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\vi\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\zh_cn\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\pt_pt\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\pt\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\pt_br\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\pl\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\hr\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\hu\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\id\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\it\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ja\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\kn\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ko\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\lt\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\lv\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\mk\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ml\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\mr\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\ms\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\nl\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\no\messages.json
%APPDATA%\opera software\opera stable\extensions\hbdopoiofnhphgohncpknhmcbhdnkjhc\2.0.0.900_0\_locales\zh_tw\messages.json
%ProgramFiles(x86)%\niersaellsooc\mujspdz.xml

Deletes the following files

<SYSTEM32>\tasks\adobe acrobat update task
%WINDIR%\tasks\adobe flash player updater.job
<SYSTEM32>\tasks\adobe flash player updater
%WINDIR%\temp\zepiqooyhxxjvxge\oiqzehfcqgdtizpj.vbs
%WINDIR%\tasks\bkuzeulkgsfvjykvpnw.job
<SYSTEM32>\tasks\bkuzeulkgsfvjykvpnw
%APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\prefs.js_temppixpdd
%ProgramFiles(x86)%\udvlifmmu\pnzhzkz.xml
%WINDIR%\tasks\kjmnwfnoawmfhxh.job
<SYSTEM32>\tasks\kjmnwfnoawmfhxh
%ProgramFiles(x86)%\xaifwvzjywlu2\vvrrihu.xml
%PROGRAMDATA%\lubciapirjzrvxvb\oauuckp.xml
%ProgramFiles(x86)%\xsehbajlvbtdepgmqbr\scfdkrd.xml
%ProgramFiles(x86)%\niersaellsooc\mujspdz.xml

Substitutes the following files

%PROGRAMDATA%\ntuser.pol
%PROGRAMDATA%\tempntuser.pol

Network activity

TCP

HTTP GET requests

http://ip##pi.com/xml
http://ho##pp2.ga/20190118/things.xml
http://in#####.portmdfmoon.com/download/APSFADexpNR
http://fi####strserver.pw/oiuwertmnasgbkj.exe

HTTP POST requests

http://go#####analytics.com/collect

UDP

DNS ASK ip##pi.com
DNS ASK go#####analytics.com
DNS ASK ho##pp2.ga
DNS ASK in#####.portmdfmoon.com
DNS ASK fi####strserver.pw

Miscellaneous

Creates and executes the following

'%TEMP%\oiuwertmnasgbkj.exe' /S /kr /site_id=724
'%TEMP%\oiuwertmnasgbkj.exe' /comm we /adp WSAZ4GTAZ5JSAZ1PSAZ4GTAZ6QSAZ2AUAZ2FUAZ4QSAZ8PTAZ4OSAZ0WSAZ7OUAZ1PTAZ3UTAZ5FUAZ6FUAZ0
'%WINDIR%\syswow64\wscript.exe' "%WINDIR%\Temp\ZePIqOOyHXxJvXGe\OiQZEhFCQGdtIzPj.vbs"
'%TEMP%\bbeqltgiinwxnyokx\lzofpraczsssokwo\zohhbcfplnjdoere.exe' /S /kr /site_id=724 /spi /adp MUAZ3NTAZ3DUAZ3OSAZ6XTAZ7LTAZ2FUAZ5KTAZ6USAZ5QSAZ4PUAZ0RSAZ3USAZ3ATAZ3MSAZ3BUAZ4
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%TEMP%\oiuwertmnasgbkj.exe' /comm we /adp WSAZ4GTAZ5JSAZ1PSAZ4GTAZ6QSAZ2AUAZ2FUAZ4QSAZ8PTAZ4OSAZ0WSAZ7OUAZ1PTAZ3UTAZ5FUAZ6FUAZ0' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:64' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:32' (with hidden window)
'<SYSTEM32>\rundll32.exe' "%TEMP%\BBeQLtgiINwxnYokx\TeHkgkhgctsFYtJK\ccnkozD.dll",#1 /adp XTAZ6MUAZ5GSAZ1QSAZ8GSAZ1DUAZ6GTAZ3JTAZ7LTAZ7STAZ3BTAZ4YSAZ4VTAZ9MUAZ1LSAZ0 /site_id 724' (with hidden window)

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "bkuzeuLkgsfVJyKVPNw" /SC once /ST 00:04:43 /V1 /F /RU "SYSTEM" /TR "\"%TEMP%\oiuwertmnasgbkj.exe\" /comm we /adp WSAZ4GTAZ5JSAZ1PSAZ4GTAZ6QSAZ2AUAZ2FUAZ4QSAZ8PTAZ4OSAZ0WSAZ7OUAZ1PT...
'%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "KJMNwfnoaWMfhxH" /F
'%WINDIR%\syswow64\schtasks.exe' /END /TN "KJMNwfnoaWMfhxH"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "bkuzeuLkgsfVJyKVPNw" /F
'%WINDIR%\syswow64\schtasks.exe' /END /TN "bkuzeuLkgsfVJyKVPNw"
'<SYSTEM32>\raserver.exe' /offerraupdate
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "<LS_APPDATA>Low\lltgznTbqqOCq" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\BBeQLtgiINwxnYokx" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\schtasks.exe' /END /TN "KJMNwfnoaWMfhxH2"
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "kzDJDuZYgnQRmzA" /SC once /ST 00:02:34 /V1 /F /RU "SYSTEM" /TR "rundll32 \"%TEMP%\BBeQLtgiINwxnYokx\TeHkgkhgctsFYtJK\ccnkozD.dll\",#1 /adp XTAZ6MUAZ5GSAZ1QSAZ8GSAZ1DUAZ6GTAZ3JTAZ7L...
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "WByhYcedlOQavqREWte2" /xml "%ProgramFiles(x86)%\NIErSAELLsOOC\MUjspDz.xml" /RU "SYSTEM"
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "ibZIUHjYTxUPTmNsU2" /xml "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR\sCfdKRd.xml" /RU "SYSTEM"
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "WZdwAMJoIRSYG2" /xml "%PROGRAMDATA%\LUBciApiRJzrvXVB\OAUUCKP.xml" /RU "SYSTEM"
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "EJlCPXAxczfLnX" /xml "%ProgramFiles(x86)%\XAIfWVzjYwlU2\VVRRIHU.xml" /RU "SYSTEM"
'<SYSTEM32>\rundll32.exe' "%TEMP%\BBeQLtgiINwxnYokx\TeHkgkhgctsFYtJK\ccnkozD.dll",#1 /adp XTAZ6MUAZ5GSAZ1QSAZ8GSAZ1DUAZ6GTAZ3JTAZ7LTAZ7STAZ3BTAZ4YSAZ4VTAZ9MUAZ1LSAZ0 /site_id 724
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "KJMNwfnoaWMfhxH2" /xml "%ProgramFiles(x86)%\udVlifMMU\pNzHZKz.xml" /RU "SYSTEM"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "EJlCPXAxczfLnX"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "KJMNwfnoaWMfhxH2" /F
'%WINDIR%\syswow64\schtasks.exe' /CREATE /TR "rundll32 \"%ProgramFiles(x86)%\udVlifMMU\SNkDQA.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "KJMNwfnoaWMfhxH" /V1 /F
'%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "WZdwAMJoIRSYG2" /F
'%WINDIR%\syswow64\schtasks.exe' /END /TN "WZdwAMJoIRSYG2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "WZdwAMJoIRSYG" /F
'%WINDIR%\syswow64\schtasks.exe' /END /TN "WZdwAMJoIRSYG"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /TN "EJlCPXAxczfLnX" /F
'%WINDIR%\syswow64\schtasks.exe' /run /tn "kzDJDuZYgnQRmzA"
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%PROGRAMDATA%\LUBciApiRJzrvXVB" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\cmd.exe' /C mkdir "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" && copy nul "%WINDIR%\Temp\ZePIqOOyHXxJvXGe\OiQZEhFCQGdtIzPj.vbs"
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\gpupdate.exe' /force /target:computer
'%WINDIR%\syswow64\schtasks.exe' /run /tn "bkuzeuLkgsfVJyKVPNw"
'%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\ZePIqOOyHXxJvXGe" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NIErSAELLsOOC" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\udVlifMMU" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\bzDQAplLjIE" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XSeHBAjlvbTDePgmqbR" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\XAIfWVzjYwlU2" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\NbbDohHftPUn" /t REG_DWORD /d 0 /reg:64
'%ProgramFiles(x86)%\internet explorer\iexplore.exe'
'%ProgramFiles(x86)%\mozilla firefox\firefox.exe'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial