Trojan.MulDrop21.22433

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

<SYSTEM32>\tasks\microsoft\windows\autochk\proxy
<SYSTEM32>\tasks\microsoft\windows\multimedia\systemsoundsservice
<SYSTEM32>\tasks\microsoft\windows\nettrace\gathernetworkinfo
<SYSTEM32>\tasks\microsoft\windows\ras\mobilitymanager
<SYSTEM32>\tasks\microsoft\windows\remoteassistance\remoteassistancetask
<SYSTEM32>\tasks\microsoft\windows\windows filtering platform\bfeonservicestarttypechange

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Update
Windows Defender

Executes the following

'<SYSTEM32>\net.exe' stop DiagTrack
'<SYSTEM32>\net.exe' stop dmwappushservice
'<SYSTEM32>\net.exe' stop diagnosticshub.standardcollector.service

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

Modifies file system

Creates the following files

%TEMP%\ef8c.tmp\ef8d.bat
nul

Deletes the following files

%TEMP%\ef8c.tmp\ef8d.bat

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c "%TEMP%\EF8C.tmp\EF8D.bat <Full path to file>"
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Offline Files\Background Synchronization" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Offline Files\Logon Synchronization" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\PI\Sqm-Tasks" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Ras\MobilityManager" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Servicing\StartComponentCleanup" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\SettingSync\BackupTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\SettingSync\NetworkStateChangeTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Shell\FamilySafetyMonitor" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Shell\FamilySafetyRefresh" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\SpacePort\SpaceAgentTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\SpacePort\SpaceManagerTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Speech\SpeechModelDownloadTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\User Profile Service\HiveUploadTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\WCM\WiFiTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Error Reporting\QueueReporting" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Media Sharing\UpdateLibrary" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Wininet\CacheTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\NetTrace\GatherNetworkInfo" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Work Folders\Work Folders Logon Synchronization" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Multimedia\SystemSoundsService" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Autochk\Proxy" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\CloudExperienceHost\CreateObjectTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\BthSQM" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\HypervisorFlightingTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Diagnosis\Scheduled" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\DiskFootprint\Diagnostics" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\DiskFootprint\StorageSense" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\ErrorDetails\EnableErrorDetailsUpdate" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClient" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\File Classification Infrastructure\Property Definition Sync" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Management\Provisioning\Logon" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Maintenance\WinSAT" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Maps\MapsToastTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Maps\MapsUpdateTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\NlaSvc\WiFiTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Work Folders\Work Folders Maintenance Work" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Workplace Join\Automatic-Device-Join" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /Disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Shell\FamilySafetyUpload"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Shell\FamilySafetyUpload" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Autochk\Proxy"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Autochk\Proxy" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Maintenance\WinSAT"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Maintenance\WinSAT" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Application Experience\AitAgent"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Application Experience\AitAgent" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\AppID\SmartScreenSpecific"
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting"
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\DiskFootprint\Diagnostics"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\DiskFootprint\Diagnostics" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\PI\Sqm-Tasks"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\PI\Sqm-Tasks" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor" /disable
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Driver Easy Scheduled Scan" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Office\OfficeTelemetryAgentFallBack2016" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Office\OfficeTelemetryAgentLogOn2016" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Office\Office ClickToRun Service Monitor" /Disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Application Experience\AitAgent" /Disable
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Application Experience\StartupAppTask"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /disable"
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver"
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\XblGameSave\XblGameSaveTaskLogon" /Disable
'<SYSTEM32>\schtasks.exe' /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader"
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting" /disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\ApplicationData\DsSvcCleanup" /Disable
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKCU\Control Panel\International\User Profile" /v "HttpAcceptLanguageOptOut" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{C1D23ACC-752B-43E5-8448-8D0E519CD6D6}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_TrackProgs" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSyncProviderNotifications" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{2297E4E2-5DBE-466D-A12B-0F8286F0D9CA}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{E5323777-F976-4f5b-9B55-B94699C46E44}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{2EEF81BE-33FA-4800-9670-1CD474972C3F}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{52079E78-A92B-413F-B213-E8FE35712E72}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{7D7E8402-7C54-4821-A34E-AEEFD62DED93}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{D89823BA-7180-4B81-B50C-7E471E6121A3}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{8BC668CF-7728-45BD-93F8-CF2B3B41D7AB}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{9231CB4C-BF57-4AF3-8C55-FDA7BFCC04C5}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{E390DF20-07DF-446D-B962-F5C953062741}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{992AFA70-6F47-4148-B3E9-3003349C1548}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications" /v "GlobalUserDisabled" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\DiagTrack" /v "Start" /t REG_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\dmwappushservice" /v "Start" /t REG_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener" /v "Start" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\WMDRM" /v "DisableOnline" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\{A8804298-2D5F-42E3-9531-9C8C39EB29CE}" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\Global\LooselyCoupled" /v "Value" /t REG_SZ /d "Deny" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CredUI" /v "DisablePasswordReveal" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main" /v "DoNotTrack" /t REG_DWORD /...
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Biometrics" /v "Enabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\SQMClient\Windows" /v "CEIPEnable" /t REG_DWORD /d "0" /f
'<SYSTEM32>\sc.exe' stop DiagTrack
'<SYSTEM32>\net1.exe' stop DiagTrack
'<SYSTEM32>\sc.exe' config DiagTrack start= disabled
'<SYSTEM32>\sc.exe' stop dmwappushservice
'<SYSTEM32>\net1.exe' stop dmwappushservice
'<SYSTEM32>\sc.exe' config dmwappushservice start= disabled
'<SYSTEM32>\sc.exe' config diagnosticshub.standardcollector.service start= disabled
'<SYSTEM32>\net1.exe' stop diagnosticshub.standardcollector.service
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\AutoLogger-Diagtrack-Listener" /v "Start" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\WindowsSelfHost\UI\Visibility" /v "DiagnosticErrorText" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\WindowsSelfHost\UI\Strings" /v "DiagnosticErrorText" /t REG_SZ /d "" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\WindowsSelfHost\UI\Strings" /v "DiagnosticLinkText" /t REG_SZ /d "" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t RE...
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\TabletPC" /v "PreventHandwritingDataSharing" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports" /v "PreventHandwritingErrorReports" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "DisableInventory" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "DisableUAR" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization" /v "NoLockScreenCamera" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v "Enabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v "Enabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Input\TIPC" /v "Enabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\System" /v "AllowExperimentation" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Bluetooth" /v "AllowAdvertising" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Messaging" /v "AllowMessageSync" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main" /v "OptimizeWindowsSearchResul...
'<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead" /v "FPEnabled" /t REG_DWO...
'<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\User\Default\SearchScopes" /v "ShowS...
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferUpgradePeriod" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferUpdatePeriod" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Metadata" /v "PreventDeviceMetadataFromNetwork" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsStore\WindowsUpdate" /v "AutoDownload" /t REG_DWORD /d "2" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\ControlSet001\Services\wuauserv" /v "Start" /t REG_DWORD /d "4" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\7971f918-a847-4430-9279-4a52d1efe18d" /v "RegisteredWithAU" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\OneDrive" /v "PreventNetworkTrafficPreUserSignIn" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\AppID\SmartScreenSpecific" /Disable
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Siuf\Rules" /v "NumberOfSIUFInPeriod" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Siuf\Rules" /v "PeriodInNanoSeconds" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "BingSearchEnabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SoftLandingEnabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\SettingSync\BackgroundUploadTask" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical" /Disable
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical" /Disable
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Speech" /v "AllowSpeechModelUpdate" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferUpgrade" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization" /v "SystemSettingsDownloadMode" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" /v "DODownloadMode" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy" /v "EnableEncryptedMediaExt...
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\SettingSync" /v "SyncPolicy" /t REG_DWORD /d "5" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Personalization" /v "Enabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\SettingSync\Groups\BrowserSettings" /v "Enabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Credentials" /v "Enabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Language" /v "Enabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Accessibility" /v "Enabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Windows" /v "Enabled" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCloudSearch" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchUseWeb" /t REG_DWORD /d "0" /f
'<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\ApplicationData\CleanupTemporaryState" /Disable
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowSearchToUseLocation" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "DisableWebSearch" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Speech_OneCore\Preferences" /v "ModelDownloadAllowed" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\InputPersonalization\TrainedDataStore" /v "HarvestContacts" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\InputPersonalization" /v "RestrictImplicitTextCollection" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\InputPersonalization" /v "RestrictImplicitInkCollection" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Personalization\Settings" /v "AcceptedPrivacyPolicy" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" /v "DisableWindowsLocationProvider" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LocationAndSensors" /v "DisableLocationScripting" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Sensor\Permissions\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" /v "SensorPermissionState" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "DoNotShowFeedbackNotifications" /t REG_DWORD /d "1" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Browser" /v "AllowAddressBarDropdown" /t REG_DWORD /d "0" /f
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCortana" /t REG_DWORD /d "0" /f
'<SYSTEM32>\schtasks.exe' /change /tn "\Microsoft\Windows\AppID\SmartScreenSpecific" /disable

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial