Техническая информация
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im dwm.exe
Запускает большое число процессов
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\dwm.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\1c4e.tmp\b2e.exe
- %TEMP%\219d.tmp\batchfile.bat
- nul
Сетевая активность
UDP
- DNS ASK fi#####.###tings.services.mozilla.com
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\1c4e.tmp\b2e.exe' %TEMP%\1C4E.tmp\b2e.exe <SYSTEM32>\WindowsPowerShell\v1.0 "<Полный путь к файлу>"
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\219D.tmp\batchfile.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c wmic path Win32_VideoController get PNPDeviceID| findstr /L "PCI\VEN_"
- '%WINDIR%\syswow64\wbem\wmic.exe' path Win32_VideoController get PNPDeviceID
- '%WINDIR%\syswow64\findstr.exe' /L "PCI\VEN_"
- '%WINDIR%\syswow64\cmd.exe' /c reg query "HKLM\SYSTEM\ControlSet001\Enum\PCI\VEN_1234&DEV_1111&SUBSYS_00000000&REV_02\3&267A616A&0&10" /v "Driver"
- '%WINDIR%\syswow64\reg.exe' query "HKLM\SYSTEM\ControlSet001\Enum\PCI\VEN_1234&DEV_1111&SUBSYS_00000000&REV_02\3&267A616A&0&10" /v "Driver"
- '%WINDIR%\syswow64\cmd.exe' /c echo {4d36e968-e325-11ce-bfc1-08002be10318}\0001 | findstr "{"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo {4d36e968-e325-11ce-bfc1-08002be10318}\0001 "
- '%WINDIR%\syswow64\findstr.exe' "{"
- '%WINDIR%\syswow64\reg.exe' add "HKLM\System\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0001" /v "DisableDynamicPstate" /t REG_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\System\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0001" /v "RMHdcpKeyglobZero" /t REG_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\NVIDIA Corporation\NvControlPanel2\Client" /v "OptInOrOutPreference" /t REG_DWORD /d "0" /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\Startup" /v "SendTelemetryData" /t REG_DWORD /d "0" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v "RmGpsPsEnablePerCpuCoreDpc" /t REG_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "RmGpsPsEnablePerCpuCoreDpc" /t REG_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "RmGpsPsEnablePerCpuCoreDpc" /t REG_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm\NVAPI" /v "RmGpsPsEnablePerCpuCoreDpc" /t REG_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\NVTweak" /v "RmGpsPsEnablePerCpuCoreDpc" /t REG_DWORD /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v DpcWatchdogProfileOffset /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v DpcTimeout /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v IdealDpcRate /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v MaximumDpcQueueDepth /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v MinimumDpcRate /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v DpcWatchdogPeriod /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v MaxDynamicTickDuration /t REG_DWORD /d 10 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v MaximumSharedReadyQueueSize /t REG_DWORD /d 128 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v BufferSize /t REG_DWORD /d 32 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v IoQueueWorkItem /t REG_DWORD /d 32 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v IoQueueWorkItemToNode /t REG_DWORD /d 32 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v IoQueueWorkItemEx /t REG_DWORD /d 32 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v IoQueueThreadIrp /t REG_DWORD /d 32 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v ExTryQueueWorkItem /t REG_DWORD /d 32 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v ExQueueWorkItem /t REG_DWORD /d 32 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v IoEnqueueIrp /t REG_DWORD /d 32 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v XMMIZeroingEnable /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v UseNormalStack /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v UseNewEaBuffering /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v StackSubSystemStackSize /t REG_DWORD /d 65536 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v SplitLargeCaches /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v ThreadDpcEnable /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "InterruptSteeringDisabled" /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v CreateGdiPrimaryOnSlaveGPU /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v DriverSupportsCddDwmInterop /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v DxgkCddSyncDxAccess /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v DxgkCddSyncGPUAccess /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v DxgkCddWaitForVerticalBlankEvent /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v DxgkCreateSwapChain /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v DxgkFreeGpuVirtualAddress /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v DxgkOpenSwapChain /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v DxgkShareSwapChainObject /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v DxgkWaitForVerticalBlankEvent /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v DxgkWaitForVerticalBlankEvent2 /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v SwapChainBackBuffer /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v TdrResetFromTimeoutAsync /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D12_ENABLE_UNSAFE_COMMAND_BUFFER_REUSE /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D12_ENABLE_RUNTIME_DRIVER_OPTIMIZATIONS /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D12_RESOURCE_ALIGNMENT /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D11_MULTITHREADED /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D12_MULTITHREADED /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D11_DEFERRED_CONTEXTS /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D12_DEFERRED_CONTEXTS /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D11_ALLOW_TILING /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D11_ENABLE_DYNAMIC_CODEGEN /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D12_ALLOW_TILING /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D12_CPU_PAGE_TABLE_ENABLED /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D12_HEAP_SERIALIZATION_ENABLED /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D12_MAP_HEAP_ALLOCATIONS /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\DirectX" /v D3D12_RESIDENCY_MANAGEMENT_ENABLED /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v SuperWetEnabled /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v SDRBoostPercentOverride /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v ResampleInLinearSpace /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v OneCoreNoDWMRawGameController /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v MPCInputRouterWaitForDebugger /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v InteractionOutputPredictionDisabled /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v InkGPUAccelOverrideVendorWhitelist /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v EnableRenderPathTestMode /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v FlattenVirtualSurfaceEffectInput /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v EnableCpuClipping /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v DisallowNonDrawListRendering /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v DisableProjectedShadowsRendering /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v DisableProjectedShadows /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v DisableLockingMemory /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v DisableHologramCompositor /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v DisableDeviceBitmaps /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v DebugFailFast /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v DDisplayTestMode /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v FrameLatency /t REG_DWORD /d 2 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v ForceDirectDrawSync /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v MaxQueuedPresentBuffers /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v UseHWDrawListEntriesOnWARP /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v ResampleModeOverride /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v RenderThreadWatchdogTimeoutMilliseconds /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v ParallelModePolicy /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v EnableResizeOptimization /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v EnableMegaRects /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v EnableFrontBufferRenderChecks /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v EnableEffectCaching /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v EnableDesktopOverlays /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v EnablePrimitiveReordering /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v MaxD3DFeatureLevel /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v OverlayQualifyCount /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v OverlayDisqualifyCount /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v ResizeTimeoutModern /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v ResizeTimeoutGdi /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v HighColor /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v DisableDrawListCaching /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v AnimationsShiftKey /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v AnimationAttributionEnabled /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v EnableCommonSuperSets /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Microsoft\WINDOWS\DWM" /v DisableAdvancedDirectFlip /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000\UMD" /v Main3D_DEF /t REG_SZ /d "1" /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000\UMD" /v Main3D /t REG_BINARY /d 3100 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000\UMD" /v FlipQueueSize /t REG_BINARY /d 3100 /f
- '%WINDIR%\syswow64\reg.exe' add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\PriorityControl" /v Win32PrioritySeparation /t REG_DWORD /d 0x00000024 /f
- '<SYSTEM32>\dwm.exe'
- '%WINDIR%\syswow64\timeout.exe' /t 5
