12206d2f24d20109cf0f5606cf15aa696b62a5c6ae278270624aefc04f103e65

Analysis

max time kernel
256s
max time network
256s
platform
windows10_x64
resource
win10v20201028
submitted
23-02-2021 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Escobar Manager.exe
Size

2.1MB
MD5

6502c0701c4be2957a295f871b87cd9b
SHA1

b1211d62949bd30078d19a86f644b12845384075
SHA256

12206d2f24d20109cf0f5606cf15aa696b62a5c6ae278270624aefc04f103e65
SHA512

f9cf955c905579a8057eedfbe23d4673c116587e944c8db36d232cadbd7868661467a5370e669f93c5edc62b83218ba1b0bf02916395c79b799e737d63777315

Score

8^/10

evasion vmprotect

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

EscobarCombine.exeEscobarCombine.exeEscobarCombine.exe

pid process

2100 EscobarCombine.exe
4860 EscobarCombine.exe
5060 EscobarCombine.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe	vmprotect
C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe	vmprotect
behavioral1/memory/2100-5-0x0000000000AB0000-0x0000000000AB1000-memory.dmp	vmprotect
C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe	vmprotect
C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe	vmprotect

Loads dropped DLL 10 IoCs

Processes:

EscobarCombine.exeEscobarCombine.exeEscobarCombine.exe

pid	process
2100	EscobarCombine.exe
2100	EscobarCombine.exe
2100	EscobarCombine.exe
2100	EscobarCombine.exe
4860	EscobarCombine.exe
4860	EscobarCombine.exe
5060	EscobarCombine.exe
5060	EscobarCombine.exe
5060	EscobarCombine.exe
5060	EscobarCombine.exe

Drops file in System32 directory 3 IoCs

Processes:

EscobarCombine.exe

description	ioc	process
File created	C:\Windows\SysWOW64\WinCleanerBatch.bat	EscobarCombine.exe
File created	C:\Windows\SysWOW64\SysWin1.bat	EscobarCombine.exe
File created	C:\Windows\SysWOW64\Method1.bat	EscobarCombine.exe

Drops file in Windows directory 41 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\PeerDistRepubStoreCatalog.jfm	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edbtmp.log	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\PeerDistPubCatalog.jfm	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edb.chk	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.log	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\Store\GUID.dat	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edbres00001.jrs	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edb.chk	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.chk	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edbres00002.jrs	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\PeerDistPubCatalog.pds	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.chk	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edbres00002.jrs	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.jtx	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edbres00001.jrs	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\PeerDistRepubStoreCatalog.jfm	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\PeerDistRepubStoreCatalog.pds	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edbtmp.log	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\PeerDistRepubStoreCatalog.pds	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edb.log	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edbtmp.log	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\PeerDistRepubStoreCatalog.pds	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\PeerDistPubCatalog.pds	svchost.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.chk	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edbres00002.jrs	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\PeerDistPubCatalog.jfm	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.chk	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.jcp	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.jcp	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.log	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edb.chk	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edb.jcp	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edb.jtx	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\PeerDistPubCatalog.pds	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.jtx	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edbres00001.jrs	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\PeerDistRepubStoreCatalog.pds	svchost.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	svchost.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\Store\GUID.dat	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edb.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Gathers network information 2 TTPs 12 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

Processes:

ipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exe

pid	process
4508	ipconfig.exe
4864	ipconfig.exe
1120	ipconfig.exe
5896	ipconfig.exe
5884	ipconfig.exe
5952	ipconfig.exe
4496	ipconfig.exe
4544	ipconfig.exe
4668	ipconfig.exe
5852	ipconfig.exe
5928	ipconfig.exe
5912	ipconfig.exe

Modifies data under HKEY_USERS 4 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\16\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\16\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe

Modifies registry class 6 IoCs

Processes:

Escobar Manager.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Escobar Manager.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Escobar Manager.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To\ = "{C2FBB630-2971-11D1-A18C-00C04FD75D13}"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To\ = "{C2FBB631-2971-11D1-A18C-00C04FD75D13}"	reg.exe

Runs ping.exe 1 TTPs 30 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
6116	PING.EXE
5312	PING.EXE
5292	PING.EXE
2544	PING.EXE
384	PING.EXE
6044	PING.EXE
2092	PING.EXE
2536	PING.EXE
6060	PING.EXE
5920	PING.EXE
6096	PING.EXE
5380	PING.EXE
5744	PING.EXE
5132	PING.EXE
5172	PING.EXE
5500	PING.EXE
5760	PING.EXE
5836	PING.EXE
5816	PING.EXE
996	PING.EXE
5180	PING.EXE
5200	PING.EXE
5564	PING.EXE
5800	PING.EXE
4588	PING.EXE
5268	PING.EXE
5396	PING.EXE
3876	PING.EXE
5888	PING.EXE
5956	PING.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

svchost.exesvchost.exe

description	pid	process
Token: SeAuditPrivilege	4580	svchost.exe
Token: SeAuditPrivilege	4580	svchost.exe
Token: SeAuditPrivilege	5476	svchost.exe
Token: SeAuditPrivilege	5476	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Escobar Manager.exe

pid process

896 Escobar Manager.exe
896 Escobar Manager.exe

pid	process
896	Escobar Manager.exe
896	Escobar Manager.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

EscobarCombine.execmd.exe

description	pid	process	target process
PID 2100 wrote to memory of 2116	2100	EscobarCombine.exe	cmd.exe
PID 2100 wrote to memory of 2116	2100	EscobarCombine.exe	cmd.exe
PID 2100 wrote to memory of 2116	2100	EscobarCombine.exe	cmd.exe
PID 2116 wrote to memory of 2604	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2604	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2604	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2416	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2416	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2416	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3776	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3776	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3776	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2248	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2248	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2248	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3012	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3012	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3012	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1124	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1124	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1124	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 492	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 492	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 492	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1664	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1664	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1664	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1492	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1492	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1492	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2268	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2268	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2268	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 192	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 192	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 192	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1956	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1956	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1956	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1944	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1944	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1944	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3136	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3136	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3136	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3752	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3752	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3752	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1272	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1272	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1272	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1196	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1196	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1196	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1752	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1752	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 1752	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2888	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2888	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2888	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3800	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3800	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 3800	2116	cmd.exe	reg.exe
PID 2116 wrote to memory of 2112	2116	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\Escobar Manager.exe
"C:\Users\Admin\AppData\Local\Temp\Escobar Manager.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:496

C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe
"C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\WinCleanerBatch.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Control Panel\Desktop" /v "AutoEndTasks" /f
3⤵
PID:2604

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Control Panel\Desktop" /v "WaitToKillAppTimeout" /f
3⤵
PID:2416

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Control Panel\Desktop" /v "WaitToKillServiceTimeout" /f
3⤵
PID:3776

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Control Panel\Desktop" /v "HungAppTimeout" /f
3⤵
PID:2248

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Control Panel\Desktop" /v "LowLevelHooksTimeout" /f
3⤵
PID:3012

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPer1_0Server" /f
3⤵
PID:1124

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPer1_Server" /f
3⤵
PID:492

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPerServer" /f
3⤵
PID:1664

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CACHE" /v "Persistent" /f
3⤵
PID:1492

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SOFTWARE\Microsoft\MSMQ\Parameters" /v "IgnoreOSNameValidation" /f
3⤵
PID:2268

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SOFTWARE\Microsoft\MSMQ\Parameters" /v "TCPNoDelay" /f
3⤵
PID:192

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPer1_Server" /f
3⤵
PID:1956

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPerServer" /f
3⤵
PID:1944

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\Psched" /v "NonBestEffortLimit" /f
3⤵
PID:3136

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\ControlSet001\Control\PriorityControl" /v "IRQ8Priority" /f
3⤵
PID:3752

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\ControlSet001\Control\PriorityControl" /v "IRQ16Priority" /f
3⤵
PID:1272

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "IRQ8Priority" /f
3⤵
PID:1196

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLMSYSTEM\CurrentControlSet\Control\PriorityControl" /v "IRQ16Priority" /f
3⤵
PID:1752

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control" /v "IRPStackSize" /f
3⤵
PID:2888

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v "ScanWhenAssociated" /f
3⤵
PID:3800

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ScanWhenAssociated" /f
3⤵
PID:2112

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v "ScanWhenAssociated" /f
3⤵
PID:1348

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v "ScanWhenAssociated" /f
3⤵
PID:3512

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v "ScanWhenAssociated" /f
3⤵
PID:2844

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v "ScanWhenAssociated" /f
3⤵
PID:2172

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v "ScanWhenAssociated" /f
3⤵
PID:2656

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v "ScanWhenAssociated" /f
3⤵
PID:1652

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "IoPageLockLimit" /f
3⤵
PID:3292

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "LargeSystemCache" /f
3⤵
PID:2532

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "BufferMultiplier" /f
3⤵
PID:2220

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "DefaultReceiveWindow" /f
3⤵
PID:2856

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "DefaultSendWindow" /f
3⤵
PID:3604

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "DynamicBacklogGrowthDelta" /f
3⤵
PID:1284

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "EnableDynamicBacklog" /f
3⤵
PID:852

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "FastCopyReceiveThreshold" /f
3⤵
PID:1484

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "FastSendDatagramThreshold" /f
3⤵
PID:1156

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "KeepAliveInterval" /f
3⤵
PID:3352

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "MaximumDynamicBacklog" /f
3⤵
PID:1516

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "MinimumDynamicBacklog" /f
3⤵
PID:1872

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "NonBlockingSendSpecialBuffering" /f
3⤵
PID:2192

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Class\Net" /v "MaxMSS" /f
3⤵
PID:3932

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Class\Net" /v "MaxMTU" /f
3⤵
PID:1804

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Class\NetTrans" /v "MaxMSS" /f
3⤵
PID:1388

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Class\NetTrans" /v "MaxMTU" /f
3⤵
PID:1392

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "CacheHashTableBucketSize" /f
3⤵
PID:2244

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "CacheHashTableSize" /f
3⤵
PID:1424

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "MaxCacheEntryTtlLimit" /f
3⤵
PID:3112

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "MaxCacheTtl" /f
3⤵
PID:1500

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "MaxNegativeCacheTtl" /f
3⤵
PID:2148

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "MaxSOACacheEntryTtlLimit" /f
3⤵
PID:3648

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "MaximumUdpPacketSize" /f
3⤵
PID:2600

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "NegativeCacheTime" /f
3⤵
PID:2300

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "NegativeSOACacheTime" /f
3⤵
PID:716

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "NetFailureCacheTime" /f
3⤵
PID:204

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "ServerPriorityTimeLimit" /f
3⤵
PID:1292

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "ServiceDllUnloadOnStop" /f
3⤵
PID:3240

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "DisablePagingExecutive" /f
3⤵
PID:1016

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "DisableStrictNameChecking" /f
3⤵
PID:1724

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "IRPStackSize" /f
3⤵
PID:1232

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "MaxCmds" /f
3⤵
PID:2188

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "MaxMpxCt" /f
3⤵
PID:1152

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "MaxWorkItems" /f
3⤵
PID:3084

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "SizReqBuf" /f
3⤵
PID:496

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "Size" /f
3⤵
PID:1756

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "DisableBandwidthThrottling" /f
3⤵
PID:3496

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "DisableLargeMTU" /f
3⤵
PID:3276

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "EnableSecuritySignature" /f
3⤵
PID:3540

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "KeepConn" /f
3⤵
PID:3140

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "MaxCmds" /f
3⤵
PID:1744

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "MaxCollectionCount" /f
3⤵
PID:1344

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "MaxThreads" /f
3⤵
PID:3452

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "UseLockReadUnlock" /f
3⤵
PID:3804

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "UtilizeNtCaching" /f
3⤵
PID:2212

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "BcastNameQueryCount" /f
3⤵
PID:3324

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "BcastQueryTimeout" /f
3⤵
PID:3564

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "CacheTimeout" /f
3⤵
PID:804

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "EnableLMHOSTS" /f
3⤵
PID:1948

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "NameServerPort" /f
3⤵
PID:740

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "NameSrvQueryCount" /f
3⤵
PID:1336

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "NameSrvQueryTimeout" /f
3⤵
PID:3412

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "SessionKeepAlive" /f
3⤵
PID:212

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "Size/Small/Medium/Large" /f
3⤵
PID:1668

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "UseNewSmb" /f
3⤵
PID:2620

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Psched" /v "NonBestEffortLimit" /f
3⤵
PID:1228

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ArpCacheLife" /f
3⤵
PID:584

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ArpCacheMinReferencedLife" /f
3⤵
PID:2168

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ArpCacheSize" /f
3⤵
PID:3980

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DeadGWDetectDefault" /f
3⤵
PID:3424

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DefaultTTL" /f
3⤵
PID:572

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableLargeMTU" /f
3⤵
PID:768

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableTaskOffload" /f
3⤵
PID:1528

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableConnectionRateLimiting" /f
3⤵
PID:3900

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableDCA" /f
3⤵
PID:3372

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableDHCP" /f
3⤵
PID:3788

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableDeadGWDetect" /f
3⤵
PID:2840

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableDynamicBacklog" /f
3⤵
PID:3916

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableICMPRedirect" /f
3⤵
PID:2096

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableMulticastForwarding" /f
3⤵
PID:3056

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnablePMTUBHDetect" /f
3⤵
PID:1480

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnablePMTUDiscovery" /f
3⤵
PID:1044

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableRSS" /f
3⤵
PID:2432

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableTCPA" /f
3⤵
PID:4104

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableWsd" /f
3⤵
PID:4120

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ForwardBroadcasts" /f
3⤵
PID:4136

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ForwardBufferMemory" /f
3⤵
PID:4152

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "GlobalMaxTcpWindowSize" /f
3⤵
PID:4168

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "IRPStackSize" /f
3⤵
PID:4184

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "KeepAliveInterval" /f
3⤵
PID:4200

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "KeepAliveTime" /f
3⤵
PID:4216

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MSS" /f
3⤵
PID:4232

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MTU" /f
3⤵
PID:4248

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxConnectionsPer1_0Server" /f
3⤵
PID:4264

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxConnectionsPer1_Server" /f
3⤵
PID:4280

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxConnectionsPerServer" /f
3⤵
PID:4296

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxDupAcks" /f
3⤵
PID:4312

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxForwardBufferMemory" /f
3⤵
PID:4328

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxFreeTcbs" /f
3⤵
PID:4344

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxHashTableSize" /f
3⤵
PID:4360

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxMSS" /f
3⤵
PID:4376

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxMTU" /f
3⤵
PID:4392

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxNumForwardPackets" /f
3⤵
PID:4408

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxUserPort" /f
3⤵
PID:4424

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaximumDynamicBacklog" /f
3⤵
PID:4440

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MinimumDynamicBacklog" /f
3⤵
PID:4456

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "NumForwardPackets" /f
3⤵
PID:4472

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "NumTcbTablePartitions" /f
3⤵
PID:4488

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "QualifyingDestinationThreshold" /f
3⤵
PID:4504

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "SackOpts" /f
3⤵
PID:4520

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "SizReqBuf" /f
3⤵
PID:4536

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "SynAttackProtect" /f
3⤵
PID:4552

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TCPDelAckTicks" /f
3⤵
PID:4568

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxHalfOpenRetried" /f
3⤵
PID:4584

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpLogLevel" /f
3⤵
PID:4600

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "QueryIpMatching" /f
3⤵
PID:4616

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "PPTPTcpMaxDataRetransmissions" /f
3⤵
PID:4632

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableUserTOSSetting" /f
3⤵
PID:4648

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpRecvSegmentSize" /f
3⤵
PID:4664

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxNormLookupMemory" /f
3⤵
PID:4680

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpSendSegmentSize" /f
3⤵
PID:4696

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "FFPControlFlags" /f
3⤵
PID:4712

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableFastRouteLookup" /f
3⤵
PID:4728

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableDynamicUpdate" /f
3⤵
PID:4744

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableReplaceAddressesInConflicts" /f
3⤵
PID:4760

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableReverseAddressRegistrations" /f
3⤵
PID:4776

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TCPInitialRtt" /f
3⤵
PID:4792

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TCPNoDelay" /f
3⤵
PID:4808

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "Tcp1323Opts" /f
3⤵
PID:4824

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpAckFrequency" /f
3⤵
PID:4840

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpCreateAndConnectTcbRateLimitDepth" /f
3⤵
PID:4856

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpFinWait2Delay" /f
3⤵
PID:4872

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxConnectRetransmissions" /f
3⤵
PID:4888

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxDataRetransmissions" /f
3⤵
PID:4904

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxDupAcks" /f
3⤵
PID:4920

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxHalfOpen" /f
3⤵
PID:4936

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxSendFree" /f
3⤵
PID:4952

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpNumConnections" /f
3⤵
PID:4968

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpTimedWaitDelay" /f
3⤵
PID:4984

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpUseRFC1122UrgentPointer" /f
3⤵
PID:5000

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpWindowSize" /f
3⤵
PID:5016

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TransmitWorker" /f
3⤵
PID:5032

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "UseZeroBroadcast" /f
3⤵
PID:5048

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "StrictTimeWaitSeqCheck" /f
3⤵
PID:5064

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TCPAllowedPorts" /f
3⤵
PID:5080

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxConnectResponseRetransmissions" /f
3⤵
PID:5096

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxFreeTWTcbs" /f
3⤵
PID:5112

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "LocalPriority" /f
3⤵
PID:2276

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "HostsPriority" /f
3⤵
PID:4132

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "NetbtPriority" /f
3⤵
PID:4148

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "AllowUnqualifiedQuery" /f
3⤵
PID:4160

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "AllowUserRawAccess" /f
3⤵
PID:4196

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableSecurityFilters" /f
3⤵
PID:4212

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DefaultTOSValue" /f
3⤵
PID:4220

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ServerInfoTimeout" /f
3⤵
PID:4252

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DnsPriority" /f
3⤵
PID:4272

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "WorldMaxTcpWindowsSize" /f
3⤵
PID:4288

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "WorldMaxTcpWindowSize" /f
3⤵
PID:4324

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpInitialRTT" /f
3⤵
PID:4340

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\QoS" /v "Do not use NLA" /f
3⤵
PID:4352

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\System\CurrentControlSet\Services\NDIS\Parameters" /v "MaxNumRssCpus" /f
3⤵
PID:4388

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPer1_0Server" /f
3⤵
PID:4404

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPerServer" /f
3⤵
PID:4412

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" /va /f
3⤵
PID:4452

C:\Windows\SysWOW64\netsh.exe
netsh int ip reset global
3⤵
PID:4468

C:\Windows\SysWOW64\netsh.exe
netsh winsock reset
3⤵
PID:4516

C:\Windows\SysWOW64\netsh.exe
netsh int tcp reset
3⤵
PID:4556

C:\Windows\SysWOW64\netsh.exe
netsh int ip reset
3⤵
PID:4612

C:\Windows\SysWOW64\netsh.exe
netsh nap reset
3⤵
PID:4660

C:\Windows\SysWOW64\netsh.exe
netsh rpc reset
3⤵
PID:4688

C:\Windows\SysWOW64\netsh.exe
netsh winhttp reset
3⤵
PID:4748

C:\Windows\SysWOW64\netsh.exe
netsh http flush
3⤵
PID:4796

C:\Windows\SysWOW64\netsh.exe
netsh routing reset
3⤵
PID:4844

C:\Windows\SysWOW64\netsh.exe
netsh int ipv4 reset
3⤵
PID:4944

C:\Windows\SysWOW64\netsh.exe
netsh int ipv6 reset
3⤵
PID:5040

C:\Windows\SysWOW64\netsh.exe
netsh int ip reset all
3⤵
PID:4144

C:\Windows\SysWOW64\netsh.exe
netsh winsock reset
3⤵
PID:4228

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall reset
3⤵
PID:4284

C:\Windows\SysWOW64\netsh.exe
netsh firewall reset
3⤵
PID:4364

C:\Windows\SysWOW64\netsh.exe
netsh http delete cache
3⤵
PID:4432

C:\Windows\SysWOW64\netsh.exe
netsh interface reset all
3⤵
PID:3208

C:\Windows\SysWOW64\netsh.exe
netsh winhttp reset proxy
3⤵
PID:4476

C:\Windows\SysWOW64\netsh.exe
netsh branchcache reset
3⤵
PID:4532

C:\Windows\SysWOW64\netsh.exe
netsh winhttp reset tracing
3⤵
PID:4820

C:\Windows\SysWOW64\netsh.exe
netsh winsock reset catalog
3⤵
PID:4908

C:\Windows\SysWOW64\netsh.exe
netsh int ip reset c:resetlog.txt
3⤵
PID:4976

C:\Windows\SysWOW64\netsh.exe
netsh int ip reset C: cplog.txt
3⤵
PID:5052

C:\Windows\SysWOW64\netsh.exe
netsh interface httpstunnel reset
3⤵
PID:5108

C:\Windows\SysWOW64\netsh.exe
netsh interface ip delete arpcache
3⤵
PID:4336

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release
3⤵
- Gathers network information
PID:4496

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:4508

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
3⤵
- Gathers network information
PID:4544

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release6
3⤵
- Gathers network information
PID:4864

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew6
3⤵
- Gathers network information
PID:4668

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:1120

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\WinCleanerBatch.bat""
2⤵
PID:4772

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Control Panel\Desktop" /v "AutoEndTasks" /f
3⤵
PID:4788

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Control Panel\Desktop" /v "WaitToKillAppTimeout" /f
3⤵
PID:4876

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Control Panel\Desktop" /v "WaitToKillServiceTimeout" /f
3⤵
PID:4972

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Control Panel\Desktop" /v "HungAppTimeout" /f
3⤵
PID:5072

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Control Panel\Desktop" /v "LowLevelHooksTimeout" /f
3⤵
PID:4764

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPer1_0Server" /f
3⤵
PID:4924

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPer1_Server" /f
3⤵
PID:4948

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPerServer" /f
3⤵
PID:4932

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CACHE" /v "Persistent" /f
3⤵
PID:5008

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SOFTWARE\Microsoft\MSMQ\Parameters" /v "IgnoreOSNameValidation" /f
3⤵
PID:4956

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SOFTWARE\Microsoft\MSMQ\Parameters" /v "TCPNoDelay" /f
3⤵
PID:4980

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPer1_Server" /f
3⤵
PID:5092

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPerServer" /f
3⤵
PID:4204

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SOFTWARE\Policies\Microsoft\Windows\Psched" /v "NonBestEffortLimit" /f
3⤵
PID:4292

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\ControlSet001\Control\PriorityControl" /v "IRQ8Priority" /f
3⤵
PID:5084

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\ControlSet001\Control\PriorityControl" /v "IRQ16Priority" /f
3⤵
PID:4300

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "IRQ8Priority" /f
3⤵
PID:4416

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLMSYSTEM\CurrentControlSet\Control\PriorityControl" /v "IRQ16Priority" /f
3⤵
PID:1000

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control" /v "IRPStackSize" /f
3⤵
PID:3884

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0000" /v "ScanWhenAssociated" /f
3⤵
PID:4372

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ScanWhenAssociated" /f
3⤵
PID:4320

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0002" /v "ScanWhenAssociated" /f
3⤵
PID:4492

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0003" /v "ScanWhenAssociated" /f
3⤵
PID:4540

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0004" /v "ScanWhenAssociated" /f
3⤵
PID:1216

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0005" /v "ScanWhenAssociated" /f
3⤵
PID:4400

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0006" /v "ScanWhenAssociated" /f
3⤵
PID:4100

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0007" /v "ScanWhenAssociated" /f
3⤵
PID:4700

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "IoPageLockLimit" /f
3⤵
PID:4768

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "LargeSystemCache" /f
3⤵
PID:4676

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "BufferMultiplier" /f
3⤵
PID:4124

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "DefaultReceiveWindow" /f
3⤵
PID:3920

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "DefaultSendWindow" /f
3⤵
PID:4140

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "DynamicBacklogGrowthDelta" /f
3⤵
PID:4240

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "EnableDynamicBacklog" /f
3⤵
PID:4720

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "FastCopyReceiveThreshold" /f
3⤵
PID:4560

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "FastSendDatagramThreshold" /f
3⤵
PID:2628

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "KeepAliveInterval" /f
3⤵
PID:4900

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "MaximumDynamicBacklog" /f
3⤵
PID:4896

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "MinimumDynamicBacklog" /f
3⤵
PID:2272

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "NonBlockingSendSpecialBuffering" /f
3⤵
PID:4880

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Class\Net" /v "MaxMSS" /f
3⤵
PID:4832

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Class\Net" /v "MaxMTU" /f
3⤵
PID:4928

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Class\NetTrans" /v "MaxMSS" /f
3⤵
PID:4940

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Class\NetTrans" /v "MaxMTU" /f
3⤵
PID:4964

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "CacheHashTableBucketSize" /f
3⤵
PID:5024

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "CacheHashTableSize" /f
3⤵
PID:4256

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "MaxCacheEntryTtlLimit" /f
3⤵
PID:4276

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "MaxCacheTtl" /f
3⤵
PID:4420

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "MaxNegativeCacheTtl" /f
3⤵
PID:2932

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "MaxSOACacheEntryTtlLimit" /f
3⤵
PID:3888

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "MaximumUdpPacketSize" /f
3⤵
PID:4384

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "NegativeCacheTime" /f
3⤵
PID:4016

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "NegativeSOACacheTime" /f
3⤵
PID:1648

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "NetFailureCacheTime" /f
3⤵
PID:4464

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "ServerPriorityTimeLimit" /f
3⤵
PID:4156

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\DNScache\Parameters" /v "ServiceDllUnloadOnStop" /f
3⤵
PID:4716

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "DisablePagingExecutive" /f
3⤵
PID:4672

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "DisableStrictNameChecking" /f
3⤵
PID:4640

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "IRPStackSize" /f
3⤵
PID:4692

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "MaxCmds" /f
3⤵
PID:184

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "MaxMpxCt" /f
3⤵
PID:4724

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "MaxWorkItems" /f
3⤵
PID:4580

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "SizReqBuf" /f
3⤵
PID:4512

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "Size" /f
3⤵
PID:4916

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "DisableBandwidthThrottling" /f
3⤵
PID:4992

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "DisableLargeMTU" /f
3⤵
PID:4116

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "EnableSecuritySignature" /f
3⤵
PID:4828

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "KeepConn" /f
3⤵
PID:4868

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "MaxCmds" /f
3⤵
PID:5036

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "MaxCollectionCount" /f
3⤵
PID:5056

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "MaxThreads" /f
3⤵
PID:4244

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "UseLockReadUnlock" /f
3⤵
PID:5116

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "UtilizeNtCaching" /f
3⤵
PID:2924

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "BcastNameQueryCount" /f
3⤵
PID:4428

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "BcastQueryTimeout" /f
3⤵
PID:4368

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "CacheTimeout" /f
3⤵
PID:4480

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "EnableLMHOSTS" /f
3⤵
PID:4108

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "NameServerPort" /f
3⤵
PID:4528

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "NameSrvQueryCount" /f
3⤵
PID:4652

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "NameSrvQueryTimeout" /f
3⤵
PID:4596

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "SessionKeepAlive" /f
3⤵
PID:4684

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "Size/Small/Medium/Large" /f
3⤵
PID:4780

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" /v "UseNewSmb" /f
3⤵
PID:2548

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Psched" /v "NonBestEffortLimit" /f
3⤵
PID:2128

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ArpCacheLife" /f
3⤵
PID:5012

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ArpCacheMinReferencedLife" /f
3⤵
PID:4884

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ArpCacheSize" /f
3⤵
PID:4804

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DeadGWDetectDefault" /f
3⤵
PID:4892

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DefaultTTL" /f
3⤵
PID:5104

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableLargeMTU" /f
3⤵
PID:5068

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableTaskOffload" /f
3⤵
PID:788

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableConnectionRateLimiting" /f
3⤵
PID:4460

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableDCA" /f
3⤵
PID:4176

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableDHCP" /f
3⤵
PID:4704

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableDeadGWDetect" /f
3⤵
PID:4564

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableDynamicBacklog" /f
3⤵
PID:4572

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableICMPRedirect" /f
3⤵
PID:4656

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableMulticastForwarding" /f
3⤵
PID:648

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnablePMTUBHDetect" /f
3⤵
PID:4960

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnablePMTUDiscovery" /f
3⤵
PID:4112

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableRSS" /f
3⤵
PID:5004

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableTCPA" /f
3⤵
PID:5088

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableWsd" /f
3⤵
PID:4356

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ForwardBroadcasts" /f
3⤵
PID:4448

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ForwardBufferMemory" /f
3⤵
PID:4348

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "GlobalMaxTcpWindowSize" /f
3⤵
PID:3912

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "IRPStackSize" /f
3⤵
PID:4708

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "KeepAliveInterval" /f
3⤵
PID:3636

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "KeepAliveTime" /f
3⤵
PID:4208

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MSS" /f
3⤵
PID:4756

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MTU" /f
3⤵
PID:4812

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxConnectionsPer1_0Server" /f
3⤵
PID:4996

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxConnectionsPer1_Server" /f
3⤵
PID:4180

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxConnectionsPerServer" /f
3⤵
PID:4444

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxDupAcks" /f
3⤵
PID:4316

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxForwardBufferMemory" /f
3⤵
PID:888

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxFreeTcbs" /f
3⤵
PID:1520

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxHashTableSize" /f
3⤵
PID:5044

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxMSS" /f
3⤵
PID:4800

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxMTU" /f
3⤵
PID:4912

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxNumForwardPackets" /f
3⤵
PID:5076

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxUserPort" /f
3⤵
PID:4484

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaximumDynamicBacklog" /f
3⤵
PID:2152

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MinimumDynamicBacklog" /f
3⤵
PID:4128

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "NumForwardPackets" /f
3⤵
PID:4576

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "NumTcbTablePartitions" /f
3⤵
PID:4988

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "QualifyingDestinationThreshold" /f
3⤵
PID:4380

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "SackOpts" /f
3⤵
PID:4604

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "SizReqBuf" /f
3⤵
PID:4608

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "SynAttackProtect" /f
3⤵
PID:504

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TCPDelAckTicks" /f
3⤵
PID:5020

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxHalfOpenRetried" /f
3⤵
PID:4068

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpLogLevel" /f
3⤵
PID:2132

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "QueryIpMatching" /f
3⤵
PID:4852

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "PPTPTcpMaxDataRetransmissions" /f
3⤵
PID:4260

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableUserTOSSetting" /f
3⤵
PID:4848

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpRecvSegmentSize" /f
3⤵
PID:4396

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxNormLookupMemory" /f
3⤵
PID:4164

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpSendSegmentSize" /f
3⤵
PID:5028

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "FFPControlFlags" /f
3⤵
PID:3716

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableFastRouteLookup" /f
3⤵
PID:3820

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableDynamicUpdate" /f
3⤵
PID:4500

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableReplaceAddressesInConflicts" /f
3⤵
PID:5128

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableReverseAddressRegistrations" /f
3⤵
PID:5144

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TCPInitialRtt" /f
3⤵
PID:5160

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TCPNoDelay" /f
3⤵
PID:5176

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "Tcp1323Opts" /f
3⤵
PID:5192

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpAckFrequency" /f
3⤵
PID:5208

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpCreateAndConnectTcbRateLimitDepth" /f
3⤵
PID:5224

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpFinWait2Delay" /f
3⤵
PID:5240

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxConnectRetransmissions" /f
3⤵
PID:5256

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxDataRetransmissions" /f
3⤵
PID:5272

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxDupAcks" /f
3⤵
PID:5288

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxHalfOpen" /f
3⤵
PID:5304

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxSendFree" /f
3⤵
PID:5320

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpNumConnections" /f
3⤵
PID:5336

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpTimedWaitDelay" /f
3⤵
PID:5352

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpUseRFC1122UrgentPointer" /f
3⤵
PID:5368

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpWindowSize" /f
3⤵
PID:5384

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TransmitWorker" /f
3⤵
PID:5400

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "UseZeroBroadcast" /f
3⤵
PID:5416

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "StrictTimeWaitSeqCheck" /f
3⤵
PID:5432

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TCPAllowedPorts" /f
3⤵
PID:5448

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxConnectResponseRetransmissions" /f
3⤵
PID:5464

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxFreeTWTcbs" /f
3⤵
PID:5480

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "LocalPriority" /f
3⤵
PID:5496

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "HostsPriority" /f
3⤵
PID:5512

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "NetbtPriority" /f
3⤵
PID:5528

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "AllowUnqualifiedQuery" /f
3⤵
PID:5544

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "AllowUserRawAccess" /f
3⤵
PID:5560

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableSecurityFilters" /f
3⤵
PID:5576

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DefaultTOSValue" /f
3⤵
PID:5592

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "ServerInfoTimeout" /f
3⤵
PID:5608

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DnsPriority" /f
3⤵
PID:5624

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "WorldMaxTcpWindowsSize" /f
3⤵
PID:5640

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "WorldMaxTcpWindowSize" /f
3⤵
PID:5656

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpInitialRTT" /f
3⤵
PID:5672

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\QoS" /v "Do not use NLA" /f
3⤵
PID:5688

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKLM\System\CurrentControlSet\Services\NDIS\Parameters" /v "MaxNumRssCpus" /f
3⤵
PID:5704

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPer1_0Server" /f
3⤵
PID:5720

C:\Windows\SysWOW64\reg.exe
Reg.exe delete "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPerServer" /f
3⤵
PID:5736

C:\Windows\SysWOW64\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" /va /f
3⤵
PID:5752

C:\Windows\SysWOW64\netsh.exe
netsh int ip reset global
3⤵
PID:5768

C:\Windows\SysWOW64\netsh.exe
netsh winsock reset
3⤵
PID:5804

C:\Windows\SysWOW64\netsh.exe
netsh int tcp reset
3⤵
PID:5840

C:\Windows\SysWOW64\netsh.exe
netsh int ip reset
3⤵
PID:5876

C:\Windows\SysWOW64\netsh.exe
netsh nap reset
3⤵
PID:5908

C:\Windows\SysWOW64\netsh.exe
netsh rpc reset
3⤵
PID:5944

C:\Windows\SysWOW64\netsh.exe
netsh winhttp reset
3⤵
PID:5976

C:\Windows\SysWOW64\netsh.exe
netsh http flush
3⤵
PID:6008

C:\Windows\SysWOW64\netsh.exe
netsh routing reset
3⤵
PID:6040

C:\Windows\SysWOW64\netsh.exe
netsh int ipv4 reset
3⤵
PID:6072

C:\Windows\SysWOW64\netsh.exe
netsh int ipv6 reset
3⤵
PID:6104

C:\Windows\SysWOW64\netsh.exe
netsh int ip reset all
3⤵
PID:6140

C:\Windows\SysWOW64\netsh.exe
netsh winsock reset
3⤵
PID:5156

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall reset
3⤵
PID:5196

C:\Windows\SysWOW64\netsh.exe
netsh firewall reset
3⤵
PID:5244

C:\Windows\SysWOW64\netsh.exe
netsh http delete cache
3⤵
PID:5300

C:\Windows\SysWOW64\netsh.exe
netsh interface reset all
3⤵
PID:5340

C:\Windows\SysWOW64\netsh.exe
netsh winhttp reset proxy
3⤵
PID:5388

C:\Windows\SysWOW64\netsh.exe
netsh branchcache reset
3⤵
PID:5424

C:\Windows\SysWOW64\netsh.exe
netsh winhttp reset tracing
3⤵
PID:5628

C:\Windows\SysWOW64\netsh.exe
netsh winsock reset catalog
3⤵
PID:5664

C:\Windows\SysWOW64\netsh.exe
netsh int ip reset c:resetlog.txt
3⤵
PID:5716

C:\Windows\SysWOW64\netsh.exe
netsh int ip reset C: cplog.txt
3⤵
PID:5756

C:\Windows\SysWOW64\netsh.exe
netsh interface httpstunnel reset
3⤵
PID:5796

C:\Windows\SysWOW64\netsh.exe
netsh interface ip delete arpcache
3⤵
PID:5820

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:5852

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release
3⤵
- Gathers network information
PID:5896

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew
3⤵
- Gathers network information
PID:5884

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /release6
3⤵
- Gathers network information
PID:5928

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /renew6
3⤵
- Gathers network information
PID:5912

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:5952

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\SysWin1.bat""
2⤵
PID:5992

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:6016

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1500
3⤵
- Runs ping.exe
PID:6060

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1498
3⤵
- Runs ping.exe
PID:6044

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1496
3⤵
- Runs ping.exe
PID:6096

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1494
3⤵
- Runs ping.exe
PID:6116

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1492
3⤵
- Runs ping.exe
PID:5132

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1490
3⤵
- Runs ping.exe
PID:5180

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1488
3⤵
- Runs ping.exe
PID:5172

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1486
3⤵
- Runs ping.exe
PID:5200

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1484
3⤵
- Runs ping.exe
PID:5268

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1482
3⤵
- Runs ping.exe
PID:5312

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1480
3⤵
- Runs ping.exe
PID:5292

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1478
3⤵
- Runs ping.exe
PID:5380

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1476
3⤵
- Runs ping.exe
PID:5396

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1474
3⤵
- Runs ping.exe
PID:5564

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1472
3⤵
- Runs ping.exe
PID:5500

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{03135B4A-AACF-4A0A-9A6C-4E8872C40EEC}" /v "TcpInitialRTT" /t REG_DWORD /d "32767" /f
3⤵
PID:5572

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{03135B4A-AACF-4A0A-9A6C-4E8872C40EEC}" /v "TCPNoDelay" /t REG_DWORD /d "1" /f
3⤵
PID:5552

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{03135B4A-AACF-4A0A-9A6C-4E8872C40EEC}" /v "TcpAckFrequency" /t REG_DWORD /d "13" /f
3⤵
PID:5484

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{03135B4A-AACF-4A0A-9A6C-4E8872C40EEC}" /v "TcpDelAckTicks" /t REG_DWORD /d "0" /f
3⤵
PID:5612

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{03135B4A-AACF-4A0A-9A6C-4E8872C40EEC}" /v "MTU" /t REG_DWORD /d "1500" /f
3⤵
PID:5456

C:\Windows\SysWOW64\netsh.exe
netsh interface ipv4 set subinterface "{03135B4A-AACF-4A0A-9A6C-4E8872C40EEC}" mtu=1500 store=persistent
3⤵
PID:5452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\SysWin1.bat""
2⤵
PID:5636

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:5696

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1500
3⤵
- Runs ping.exe
PID:5744

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1498
3⤵
- Runs ping.exe
PID:5800

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1496
3⤵
- Runs ping.exe
PID:5760

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1494
3⤵
- Runs ping.exe
PID:5836

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1492
3⤵
- Runs ping.exe
PID:5816

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1490
3⤵
- Runs ping.exe
PID:5888

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1488
3⤵
- Runs ping.exe
PID:5920

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1486
3⤵
- Runs ping.exe
PID:996

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1484
3⤵
- Runs ping.exe
PID:3876

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1482
3⤵
- Runs ping.exe
PID:2092

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1480
3⤵
- Runs ping.exe
PID:2536

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1478
3⤵
- Runs ping.exe
PID:2544

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1476
3⤵
- Runs ping.exe
PID:5956

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1474
3⤵
- Runs ping.exe
PID:384

C:\Windows\SysWOW64\PING.EXE
ping www.google.com -n 1 -f -l 1472
3⤵
- Runs ping.exe
PID:4588

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BC0F0533-198C-11EB-B58E-806E6F6E6963}" /v "TcpInitialRTT" /t REG_DWORD /d "32767" /f
3⤵
PID:3464

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BC0F0533-198C-11EB-B58E-806E6F6E6963}" /v "TCPNoDelay" /t REG_DWORD /d "1" /f
3⤵
PID:32

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BC0F0533-198C-11EB-B58E-806E6F6E6963}" /v "TcpAckFrequency" /t REG_DWORD /d "13" /f
3⤵
PID:5964

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BC0F0533-198C-11EB-B58E-806E6F6E6963}" /v "TcpDelAckTicks" /t REG_DWORD /d "0" /f
3⤵
PID:5948

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{BC0F0533-198C-11EB-B58E-806E6F6E6963}" /v "MTU" /t REG_DWORD /d "1500" /f
3⤵
PID:4752

C:\Windows\SysWOW64\netsh.exe
netsh interface ipv4 set subinterface "{BC0F0533-198C-11EB-B58E-806E6F6E6963}" mtu=1500 store=persistent
3⤵
PID:4736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\Method1.bat""
2⤵
PID:6088

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:6112

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set global autotuninglevel=restricted
3⤵
PID:5124

C:\Windows\SysWOW64\netsh.exe
netsh interface tcp set heuristics disabled
3⤵
PID:5232

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set global dca=enabled
3⤵
PID:5280

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set global netdma=enabled
3⤵
PID:5328

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set global rss=enabled
3⤵
PID:5348

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set global rsc=disabled
3⤵
PID:2156

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set global ecncapability=disabled
3⤵
PID:5488

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set global timestamps=disabled
3⤵
PID:5472

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set global nonsackrttresiliency=disabled
3⤵
PID:5600

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set supplemental custom congestionprovider=ctcp
3⤵
PID:3152

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set global maxsynretransmissions=2
3⤵
PID:5988

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set global fastopen=enabled
3⤵
PID:5712

C:\Windows\SysWOW64\netsh.exe
netsh int tcp set global initialRto=1000
3⤵
PID:5808

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\ContentIndex" /v "StartupDelay" /t REG_DWORD /d "40000" /f
3⤵
PID:5860

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "NoAutoRebootWithLoggedOnUsers" /t REG_DWORD /d "1" /f
3⤵
PID:5848

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WSearch" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:5880

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\cisvc" /v "Start" /t REG_DWORD /d "4" /f
3⤵
PID:5924

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\cisvc" /v "Enableprefetcher" /t REG_DWORD /d "1" /f
3⤵
PID:800

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v "HiberbootEnabled" /t REG_DWORD /d "1" /f
3⤵
PID:2088

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "NtfsDisableLastAccessUpdate" /t REG_DWORD /d "1" /f
3⤵
PID:3824

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "AlwaysUnloadDll" /t REG_DWORD /d "1" /f
3⤵
PID:4644

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKCR\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To" /ve /t REG_SZ /d "{C2FBB630-2971-11D1-A18C-00C04FD75D13}" /f
3⤵
- Modifies registry class
PID:2596

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKCR\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To" /ve /t REG_SZ /d "{C2FBB631-2971-11D1-A18C-00C04FD75D13}" /f
3⤵
- Modifies registry class
PID:1860

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "NtfsDisableLastAccessUpdate" /t REG_DWORD /d "1" /f
3⤵
PID:2588

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d "1" /f
3⤵
PID:3676

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v "EnablePrefetcher" /t REG_DWORD /d "3" /f
3⤵
PID:3764

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxDataRetransmissions" /t REG_DWORD /d "3" /f
3⤵
PID:4592

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "Tcp1323Opts" /t REG_DWORD /d "1" /f
3⤵
PID:3256

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxDupAcks" /t REG_DWORD /d "2" /f
3⤵
PID:248

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpTimedWaitDelay" /t REG_DWORD /d "30" /f
3⤵
PID:5936

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "SackOpts" /t REG_DWORD /d "1" /f
3⤵
PID:5980

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "SynAttackProtect" /t REG_DWORD /d "1" /f
3⤵
PID:6048

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnablePMTUBHDetect" /t REG_DWORD /d "0" /f
3⤵
PID:6068

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnablePMTUDiscovery" /t REG_DWORD /d "1" /f
3⤵
PID:5692

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxUserPort" /t REG_DWORD /d "65534" /f
3⤵
PID:5660

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxFreeTcbs" /t REG_DWORD /d "65536" /f
3⤵
PID:5140

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxHashTableSize" /t REG_DWORD /d "65536" /f
3⤵
PID:5168

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "GlobalMaxTcpWindowSize" /t REG_DWORD /d "1250000" /f
3⤵
PID:4740

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableTaskOffload" /t REG_DWORD /d "1" /f
3⤵
PID:5216

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DefaultTTL" /t REG_DWORD /d "64" /f
3⤵
PID:5236

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SOFTWARE\Microsoft\MSMQ\Parameters" /v "TCPNoDelay" /t REG_DWORD /d "1" /f
3⤵
PID:5316

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPerServer" /t REG_DWORD /d "10" /f
3⤵
PID:5204

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPer1_0Server" /t REG_DWORD /d "10" /f
3⤵
PID:5296

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v "SmoothScroll" /t REG_DWORD /d "1" /f
3⤵
PID:4636

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v "NetworkThrottlingIndex" /t REG_DWORD /d "4294967295" /f
3⤵
PID:5344

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v "SystemResponsiveness" /t REG_DWORD /d "0" /f
3⤵
PID:5580

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider" /v "LocalPriority" /t REG_DWORD /d "4" /f
3⤵
PID:1100

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider" /v "HostsPriority" /t REG_DWORD /d "5" /f
3⤵
PID:5516

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider" /v "DnsPriority" /t REG_DWORD /d "6" /f
3⤵
PID:5492

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\ServiceProvider" /v "NetbtPriority" /t REG_DWORD /d "7" /f
3⤵
PID:5596

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows" /v "NonBestEffortLimit" /t REG_DWORD /d "0" /f
3⤵
PID:5620

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Psched" /v "NonBestEffortLimit" /t REG_DWORD /d "0" /f
3⤵
PID:5468

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "IRPStackSize" /t REG_DWORD /d "50" /f
3⤵
PID:5648

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "SizReqBuf" /t REG_DWORD /d "17424" /f
3⤵
PID:6004

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "Size" /t REG_DWORD /d "3" /f
3⤵
PID:5740

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "MaxMpxCt" /t REG_DWORD /d "125" /f
3⤵
PID:5676

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "MaxCmds" /t REG_DWORD /d "30" /f
3⤵
PID:5764

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "MaxThreads" /t REG_DWORD /d "30" /f
3⤵
PID:5748

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v "MaxCollectionCount" /t REG_DWORD /d "32" /f
3⤵
PID:5864

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "LargeSystemCache" /t REG_DWORD /d "0" /f
3⤵
PID:5856

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "SystemPages" /t REG_DWORD /d "4294967295" /f
3⤵
PID:5872

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "EnableDynamicBacklog" /t REG_SZ /d "" /f
3⤵
PID:5900

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "MinimumDynamicBacklog" /t REG_SZ /d "" /f
3⤵
PID:5940

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "MaximumDynamicBacklog" /t REG_SZ /d "" /f
3⤵
PID:1276

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "DynamicBacklogGrowthDelta" /t REG_SZ /d "" /f
3⤵
PID:4048

C:\Windows\SysWOW64\reg.exe
Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "KeepAliveInterval" /t REG_SZ /d "" /f
3⤵
PID:3400

C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe
"C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4860

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k peerdist -s PeerDistSvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe
"C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5060

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k peerdist -s PeerDistSvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5476

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EscobarCombine.exe.log
MD5
05c5f43f360b13d7659edbc4eabc4d17

SHA1
9fee9421a7df61cd4de7da889329061b9e79482d

SHA256
2574ec4cf92299863ae14cfaafe3ec92a68f725429c03085af80c9820f64d8ef

SHA512
d395ff6b93dfd042ea7f528d844bca13165fbee1a183f5624eae754f239b933aaf0a724634627c51d6c8a7a11b4b86f9ef042510d4853eab9f0dcebd01206d9d

Download Submit
C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe
MD5
0a592a6c9610653aabebfa24f7e38deb

SHA1
76a936c4b3fb1b19fbd5e4272ea7fa394eba5a34

SHA256
cac7adf12fae7bc84d1fb21d3a7fef33ddf9bec1568612a857cb672eeb65686e

SHA512
1350c2dbb447c2709ee7a9255f1aa9244fb57e255f68d2ea8e472719aaee79fc4cf4540444a79c44e4b298792a19cf3ed0f2835c6d809e71d536c96068c19449

Download Submit
C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe
MD5
0a592a6c9610653aabebfa24f7e38deb

SHA1
76a936c4b3fb1b19fbd5e4272ea7fa394eba5a34

SHA256
cac7adf12fae7bc84d1fb21d3a7fef33ddf9bec1568612a857cb672eeb65686e

SHA512
1350c2dbb447c2709ee7a9255f1aa9244fb57e255f68d2ea8e472719aaee79fc4cf4540444a79c44e4b298792a19cf3ed0f2835c6d809e71d536c96068c19449

Download Submit
C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe
MD5
0a592a6c9610653aabebfa24f7e38deb

SHA1
76a936c4b3fb1b19fbd5e4272ea7fa394eba5a34

SHA256
cac7adf12fae7bc84d1fb21d3a7fef33ddf9bec1568612a857cb672eeb65686e

SHA512
1350c2dbb447c2709ee7a9255f1aa9244fb57e255f68d2ea8e472719aaee79fc4cf4540444a79c44e4b298792a19cf3ed0f2835c6d809e71d536c96068c19449

Download Submit
C:\Users\Admin\Desktop\Escobar Manager\EscobarCombine.exe
MD5
0a592a6c9610653aabebfa24f7e38deb

SHA1
76a936c4b3fb1b19fbd5e4272ea7fa394eba5a34

SHA256
cac7adf12fae7bc84d1fb21d3a7fef33ddf9bec1568612a857cb672eeb65686e

SHA512
1350c2dbb447c2709ee7a9255f1aa9244fb57e255f68d2ea8e472719aaee79fc4cf4540444a79c44e4b298792a19cf3ed0f2835c6d809e71d536c96068c19449

Download Submit
C:\Users\Admin\Desktop\Escobar Manager\MetroFramework.Fonts.dll
MD5
65ef4b23060128743cef937a43b82aa3

SHA1
cc72536b84384ec8479b9734b947dce885ef5d31

SHA256
c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26

SHA512
d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7

Download Submit
C:\Users\Admin\Desktop\Escobar Manager\MetroFramework.dll
MD5
34ea7f7d66563f724318e322ff08f4db

SHA1
d0aa8038a92eb43def2fffbbf4114b02636117c5

SHA256
c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49

SHA512
dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\PeerDistPubCatalog.jfm
MD5
b161cdbd563d1956be46094f7a690423

SHA1
a5d2c952e1cf02294584619d8f196a289371165f

SHA256
cc09d80d4b4c3746fa06f6d8e3e29480776e9f54b5a5c3694b7855fe0f0f5b66

SHA512
d51dc89b6ac23be90d0ae8970e9323cc7c0bb52323888d92caea3bc1fe980f169acdd0531ccf075789182faa2e0b30632247ac0644a62ba5cbf9bdaf4965812a

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\PeerDistPubCatalog.pds
MD5
f39d9e5c19608cd80a905eff2e86da8b

SHA1
cb25839e34de507dcb14ccf5a4a23eca6f4857a1

SHA256
bfbca468d7813a8a7f61ef46969b71bec90ef123810cd822a04657477156735b

SHA512
c6c080b4e435a7813812a3e6c62676e78feaa6ec4d840293b1ed87f0f32d6121ee18c8e3cc43daf260a672e1a937b0c620fa1836f113697583cd06cf95e5ed5d

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edb.chk
MD5
792de1da16e283a2e442557d01576383

SHA1
2c75dc593c536632124bca7f1fb8f31181f4b037

SHA256
c4d0eb98772cd3ed10e6df746150c4c6eedf10eedcf168c1ebb3f291dcef3678

SHA512
4769d0e6cb4dd3f58f6b50169baa75d1923f7b30ebf028d15495e69a1c74f0cc20600a8b06723d5664542a4d93c7e9b5200276527dcb97c4aea3776625f1fbf1

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistPub\edb.log
MD5
b3c0492bdc2ca990f547ad33b1c1bbd8

SHA1
f452fdd2a097f788c32481b934516f399833d5de

SHA256
234e3bb9a67dda029e0ce3cca6588e8de6a056efbe1188e201fbc613e7ebd227

SHA512
944022cbe817811592439160a06fe042f4125f896fcbd99a62a29a3f7c7477f78841ca07cb016d4e1ff688e3413fda9781cf69ef28e8f63131ec631a88b2ba1c

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\PeerDistRepubStoreCatalog.jfm
MD5
3ba71e79f81b33fdc663911b609cbd43

SHA1
d95c1b5f4206a733b0b879bec61a7196f04ff6aa

SHA256
2ea4d5daa36dbda97ca43c84c160258ba96a9174a9c0b463594aa37d049c9bfd

SHA512
42a6d1b16fd92da2e186c03855cf6dcb079002db6471e9ad22d97b8967c776c24f1cdf64b003774cde63245685b2ec6607a2737253dbf36b44f5c8d9caf1fba3

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\PeerDistRepubStoreCatalog.jfm
MD5
83e282f09d6e9e9883148594f484541b

SHA1
6163d027e37a0f78b6513c657b74904a944a4bb4

SHA256
bd4fb7522e7800807b424088689515eb1b67173634b5cf7ff335877553b33a4a

SHA512
c5ae83bbb57845430e8fdef6802f57a1380d61c2f49f3a36c70b889c61c1b5554a61b3103a0ad88b344730066f96c7aa8947c53b3f7fefd5b729f8b65c7633c6

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\PeerDistRepubStoreCatalog.pds
MD5
07118da5ecf71dd41268807953246acd

SHA1
cd33683f3047732aa46843f1d4d4c81d20247b4c

SHA256
cb05986ee82f9f1ca5fd8b68900efbd6d9c88500691111bed96245ba416ac753

SHA512
4f753ea3617dffd8a5039dd9e4f94633481ea4f9b650540bdb921e8efa46740492792b5d9b8b9a4ed7c9b7b9cc80d27824cbd6add7edaf8458b9dd044ee9ea0b

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\PeerDistRepubStoreCatalog.pds
MD5
1bc4e4b08f03142bd90cdb521de0f5ed

SHA1
4ea396fbab3758c08992f539f271121582fbb1ff

SHA256
81a158cff32b4a8ac8883bfad555039a38409e33aad2b6f71e24cb9796ca796a

SHA512
f5e7cbf0e79b7e740aa80aca9c046ca6fcd00407ba37e54de1066bd64ddf8529e1772b53c89b09d223a5f5ed16b75b70cbabf9ccec7673205c2cd14ca292029f

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\Store\GUID.dat
MD5
1e989126cfdfc6bc2ca0eaecd61044ea

SHA1
8756ed4b476fb321a4d81ee8438b623f057debda

SHA256
336c02f9e31c566e76393ccd37cfdc917b0bcbed9f4e9772e11640127bfe81a5

SHA512
33b5514660fe3b210f0cb3b1d48f3d1137c52fd6210a507e9b88c35a038dfebde53c588655fbf79726a9ab6307e8e5529c6b25aefe447c318d354fef87c48887

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\Store\GUID.dat
MD5
34a33fc3ab9e8a9400fa4cbbaa1cdd4d

SHA1
0454ac4ce998b32a7476353cab7abcfaf26e5412

SHA256
a62596f39dc2768341dfdb3d33283904f03aa26b34559a624f8865e0ae7f345e

SHA512
e151b6af44da844e52a1e72e281066b549690e8280e2b86c3a3ef08a1a06f913ba425c620f3c8419e97b74241585737ce3a263af26a6c48a6ccfc49e127ffa9f

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.chk
MD5
7a6babaf876e313cf1c83193faeed428

SHA1
2cbab2720a4a4d601c333f319e84588f082da7f9

SHA256
8073fc4f1a4c93f1b76877599c0dc8cbf67d93e0b822c44928cc46950f92388d

SHA512
07a8477f0305bf78c6ccff5ae796d98e80d9eaaa90a15641ea6c9e746e7fc804c83380be3c89b5fc95822a1197f030dabb9dbd375d62d8eb7e285936dc9b17a7

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.chk
MD5
720d13a81ad3e99ad68e785f52941279

SHA1
e1286fc43250c1caf8ac911268fc9024d1f30619

SHA256
018c39afb943355c4215a53035bd2c30afb3893f9eb223282be57fa26a431564

SHA512
bd968e54d178cadc682aee69c79edbc849cb75ad72be6d3eaf6c80d866e070daa5a49f40b0bf82041257d1c447b2ee8df040e9d65cf6faf8797ee848da93f6fc

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.log
MD5
d0727f462012109d48ed412820bc0ce5

SHA1
e6b5667ed37b30b00deaac72a965ae22070675c0

SHA256
8c553838600561e0bec7a999fd7bbafb60add77a0d72ce70c5ba8325c6f242cf

SHA512
9f6eeb577ddad80500143fbefea2f2222c46549d2c18ee206270c6e4dbe1b98da78f08598159e4927ce1abd7ec6267be1b79368c8ef3f69332444a5a2c9a09a2

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edb.log
MD5
4f491ccb28f39a0c568f4d1824697209

SHA1
025e480b384518c514b51eccda9129221b76ca0e

SHA256
bccc5dc5f2000d856c96c9a83c45290c0855f2b13bac8a3e43b766a8ffaff169

SHA512
06ab9052abbe45e05b9a922d0402374e9648f27016950f2bbe27b816141eeb3fba30702955a296aab4b5fc8c556c2525217fe377ca3b7562be113ff311ada64f

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edbtmp.log
MD5
5f363e0e58a95f06cbe9bbc662c5dfb6

SHA1
2e95d7582c53583fa8afb54e0fe7a2597c92cbba

SHA256
c036cbb7553a909f8b8877d4461924307f27ecb66cff928eeeafd569c3887e29

SHA512
f1e554807f6e927530f7461e2ed5e8e3509c0245e082b2db5c88763a3764d1278b88d0d220f8b7050a71b2677e463fb7a3ad1d5b0fe6588c6ff18fddf977864c

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\PeerDistRepub\edbtmp.log
MD5
5f363e0e58a95f06cbe9bbc662c5dfb6

SHA1
2e95d7582c53583fa8afb54e0fe7a2597c92cbba

SHA256
c036cbb7553a909f8b8877d4461924307f27ecb66cff928eeeafd569c3887e29

SHA512
f1e554807f6e927530f7461e2ed5e8e3509c0245e082b2db5c88763a3764d1278b88d0d220f8b7050a71b2677e463fb7a3ad1d5b0fe6588c6ff18fddf977864c

Download Submit
C:\Windows\SysWOW64\Method1.bat
MD5
cc99e466afdaf041e1656e3f684785e1

SHA1
35d182dde82d2bcfca1c40710fbf2048f8c27691

SHA256
9ef925121421c3ab1788e16123d377a81fd393d74891b5d6a7b74ba123bcfc77

SHA512
18657394b54c9b3edfcfd6622a65ff7da9bb26e6682e847a3350c8708325fa0db2c105647efbe22feb49647283a9df1d6dabe1356ecccaa6297c49bcb199ec5e

Download Submit
C:\Windows\SysWOW64\SysWin1.bat
MD5
b93cdcb3d180df8a2ea5a9575d71d007

SHA1
ba235f90774151531da9264893ade9bde97f6ad2

SHA256
a6136a89c0e9c297288eb301b19f4a42127f952a9377c87fd8cb98092cf55587

SHA512
6607224ef591e1fb3d816ce55c0abba93dfaaa58ff5f8825ba31113dcb72b1a3879396d98c2d0f9c0c3cce63a21157e8dc052d4e4c18fae20edd2491c95c615f

Download Submit
C:\Windows\SysWOW64\SysWin1.bat
MD5
53f1c71dc90971a0e261b836a850df2b

SHA1
9913b914660fe5e82ed284c8c156fb2d0238b748

SHA256
d0d2f117a09868ac9d894398c4da710e3572edede150b13e715d9f642eca3ec3

SHA512
796752e9690eb278661471f24c4d80fe12a145963c934e7cab5946ae3cdf3cfd81a0b9d749b60e3fddcd90e09e7ffe78a0ef6e670aa925e8cda70358ccc21cda

Download Submit
C:\Windows\SysWOW64\WinCleanerBatch.bat
MD5
360437b821d591015482ce00ee4d9b37

SHA1
0daacde5f6f9f9a1924747b20b25d824e2f84e2e

SHA256
da13f26425fb1d5d410310261bc3976bd4dbf2971a9ee8ce60c7cb8229b7c1d6

SHA512
4bf5f01a64938be5283ea15cfc456e77671b07506f4f64075ceb2a7104b01aa1beddc38341edec1506fc1020d16c228d7a7ad093776eb6310f66c475c43a5811

Download Submit
C:\Windows\SysWOW64\WinCleanerBatch.bat
MD5
360437b821d591015482ce00ee4d9b37

SHA1
0daacde5f6f9f9a1924747b20b25d824e2f84e2e

SHA256
da13f26425fb1d5d410310261bc3976bd4dbf2971a9ee8ce60c7cb8229b7c1d6

SHA512
4bf5f01a64938be5283ea15cfc456e77671b07506f4f64075ceb2a7104b01aa1beddc38341edec1506fc1020d16c228d7a7ad093776eb6310f66c475c43a5811

Download Submit
\Users\Admin\Desktop\Escobar Manager\MetroFramework.Fonts.dll
MD5
65ef4b23060128743cef937a43b82aa3

SHA1
cc72536b84384ec8479b9734b947dce885ef5d31

SHA256
c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26

SHA512
d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7

Download Submit
\Users\Admin\Desktop\Escobar Manager\MetroFramework.Fonts.dll
MD5
65ef4b23060128743cef937a43b82aa3

SHA1
cc72536b84384ec8479b9734b947dce885ef5d31

SHA256
c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26

SHA512
d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7

Download Submit
\Users\Admin\Desktop\Escobar Manager\MetroFramework.Fonts.dll
MD5
65ef4b23060128743cef937a43b82aa3

SHA1
cc72536b84384ec8479b9734b947dce885ef5d31

SHA256
c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26

SHA512
d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7

Download Submit
\Users\Admin\Desktop\Escobar Manager\MetroFramework.Fonts.dll
MD5
65ef4b23060128743cef937a43b82aa3

SHA1
cc72536b84384ec8479b9734b947dce885ef5d31

SHA256
c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26

SHA512
d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7

Download Submit
\Users\Admin\Desktop\Escobar Manager\MetroFramework.dll
MD5
34ea7f7d66563f724318e322ff08f4db

SHA1
d0aa8038a92eb43def2fffbbf4114b02636117c5

SHA256
c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49

SHA512
dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148

Download Submit
\Users\Admin\Desktop\Escobar Manager\MetroFramework.dll
MD5
34ea7f7d66563f724318e322ff08f4db

SHA1
d0aa8038a92eb43def2fffbbf4114b02636117c5

SHA256
c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49

SHA512
dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148

Download Submit
\Users\Admin\Desktop\Escobar Manager\MetroFramework.dll
MD5
34ea7f7d66563f724318e322ff08f4db

SHA1
d0aa8038a92eb43def2fffbbf4114b02636117c5

SHA256
c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49

SHA512
dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148

Download Submit
\Users\Admin\Desktop\Escobar Manager\MetroFramework.dll
MD5
34ea7f7d66563f724318e322ff08f4db

SHA1
d0aa8038a92eb43def2fffbbf4114b02636117c5

SHA256
c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49

SHA512
dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148

Download Submit
\Users\Admin\Desktop\Escobar Manager\MetroFramework.dll
MD5
34ea7f7d66563f724318e322ff08f4db

SHA1
d0aa8038a92eb43def2fffbbf4114b02636117c5

SHA256
c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49

SHA512
dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148

Download Submit
\Users\Admin\Desktop\Escobar Manager\MetroFramework.dll
MD5
34ea7f7d66563f724318e322ff08f4db

SHA1
d0aa8038a92eb43def2fffbbf4114b02636117c5

SHA256
c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49

SHA512
dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148

Download Submit
memory/192-36-0x0000000000000000-mapping.dmp

Download
memory/204-79-0x0000000000000000-mapping.dmp

Download
memory/492-32-0x0000000000000000-mapping.dmp

Download
memory/496-88-0x0000000000000000-mapping.dmp

Download
memory/716-78-0x0000000000000000-mapping.dmp

Download
memory/852-59-0x0000000000000000-mapping.dmp

Download
memory/1016-82-0x0000000000000000-mapping.dmp

Download
memory/1124-31-0x0000000000000000-mapping.dmp

Download
memory/1152-86-0x0000000000000000-mapping.dmp

Download
memory/1156-61-0x0000000000000000-mapping.dmp

Download
memory/1196-42-0x0000000000000000-mapping.dmp

Download
memory/1232-84-0x0000000000000000-mapping.dmp

Download
memory/1272-41-0x0000000000000000-mapping.dmp

Download
memory/1284-58-0x0000000000000000-mapping.dmp

Download
memory/1292-80-0x0000000000000000-mapping.dmp

Download
memory/1348-47-0x0000000000000000-mapping.dmp

Download
memory/1388-68-0x0000000000000000-mapping.dmp

Download
memory/1392-69-0x0000000000000000-mapping.dmp

Download
memory/1424-71-0x0000000000000000-mapping.dmp

Download
memory/1484-60-0x0000000000000000-mapping.dmp

Download
memory/1492-34-0x0000000000000000-mapping.dmp

Download
memory/1500-73-0x0000000000000000-mapping.dmp

Download
memory/1516-63-0x0000000000000000-mapping.dmp

Download
memory/1652-52-0x0000000000000000-mapping.dmp

Download
memory/1664-33-0x0000000000000000-mapping.dmp

Download
memory/1724-83-0x0000000000000000-mapping.dmp

Download
memory/1752-43-0x0000000000000000-mapping.dmp

Download
memory/1804-67-0x0000000000000000-mapping.dmp

Download
memory/1872-64-0x0000000000000000-mapping.dmp

Download
memory/1944-38-0x0000000000000000-mapping.dmp

Download
memory/1956-37-0x0000000000000000-mapping.dmp

Download
memory/2100-23-0x00000000068F0000-0x00000000068F1000-memory.dmp

Filesize
4KB

Download
memory/2100-16-0x0000000009EA0000-0x0000000009EA1000-memory.dmp

Filesize
4KB

Download
memory/2100-18-0x000000000D750000-0x000000000D751000-memory.dmp

Filesize
4KB

Download
memory/2100-17-0x0000000009DD0000-0x0000000009DD1000-memory.dmp

Filesize
4KB

Download
memory/2100-7-0x0000000009A10000-0x0000000009A11000-memory.dmp

Filesize
4KB

Download
memory/2100-11-0x000000000A220000-0x000000000A221000-memory.dmp

Filesize
4KB

Download
memory/2100-12-0x0000000009E00000-0x0000000009E01000-memory.dmp

Filesize
4KB

Download
memory/2100-8-0x0000000004E50000-0x0000000004E51000-memory.dmp

Filesize
4KB

Download
memory/2100-19-0x0000000009A13000-0x0000000009A15000-memory.dmp

Filesize
8KB

Download
memory/2100-4-0x00000000739E0000-0x00000000740CE000-memory.dmp

Filesize
6.9MB

Download
memory/2100-5-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/2112-46-0x0000000000000000-mapping.dmp

Download
memory/2116-24-0x0000000000000000-mapping.dmp

Download
memory/2148-74-0x0000000000000000-mapping.dmp

Download
memory/2172-50-0x0000000000000000-mapping.dmp

Download
memory/2188-85-0x0000000000000000-mapping.dmp

Download
memory/2192-65-0x0000000000000000-mapping.dmp

Download
memory/2220-55-0x0000000000000000-mapping.dmp

Download
memory/2244-70-0x0000000000000000-mapping.dmp

Download
memory/2248-29-0x0000000000000000-mapping.dmp

Download
memory/2268-35-0x0000000000000000-mapping.dmp

Download
memory/2300-77-0x0000000000000000-mapping.dmp

Download
memory/2416-27-0x0000000000000000-mapping.dmp

Download
memory/2532-54-0x0000000000000000-mapping.dmp

Download
memory/2600-76-0x0000000000000000-mapping.dmp

Download
memory/2604-26-0x0000000000000000-mapping.dmp

Download
memory/2656-51-0x0000000000000000-mapping.dmp

Download
memory/2844-49-0x0000000000000000-mapping.dmp

Download
memory/2856-56-0x0000000000000000-mapping.dmp

Download
memory/2888-44-0x0000000000000000-mapping.dmp

Download
memory/3012-30-0x0000000000000000-mapping.dmp

Download
memory/3084-87-0x0000000000000000-mapping.dmp

Download
memory/3112-72-0x0000000000000000-mapping.dmp

Download
memory/3136-39-0x0000000000000000-mapping.dmp

Download
memory/3240-81-0x0000000000000000-mapping.dmp

Download
memory/3292-53-0x0000000000000000-mapping.dmp

Download
memory/3352-62-0x0000000000000000-mapping.dmp

Download
memory/3512-48-0x0000000000000000-mapping.dmp

Download
memory/3604-57-0x0000000000000000-mapping.dmp

Download
memory/3648-75-0x0000000000000000-mapping.dmp

Download
memory/3752-40-0x0000000000000000-mapping.dmp

Download
memory/3776-28-0x0000000000000000-mapping.dmp

Download
memory/3800-45-0x0000000000000000-mapping.dmp

Download
memory/3932-66-0x0000000000000000-mapping.dmp

Download
memory/4860-104-0x0000000005303000-0x0000000005305000-memory.dmp

Filesize
8KB

Download
memory/4860-99-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/4860-90-0x00000000739E0000-0x00000000740CE000-memory.dmp

Filesize
6.9MB

Download
memory/5060-116-0x00000000016E0000-0x00000000016E1000-memory.dmp

Filesize
4KB

Download
memory/5060-113-0x00000000739E0000-0x00000000740CE000-memory.dmp

Filesize
6.9MB

Download
memory/5060-127-0x00000000016E3000-0x00000000016E5000-memory.dmp

Filesize
8KB

Download