aef29bb9fdd5a886dea3fd46654827237e2ddf77c91921fcf0b356b61fd458c1

Analysis

max time kernel
655s
max time network
651s
platform
windows10_x64
resource
win10-en-20211208
submitted
18-01-2022 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wizard Loader.exe
Size

12.2MB
MD5

d81339bceaf855749edcdc71aee5a0c0
SHA1

4ae534a44cb7cde94b9e9619ea4be6397b97b6d7
SHA256

aef29bb9fdd5a886dea3fd46654827237e2ddf77c91921fcf0b356b61fd458c1
SHA512

f15c57de5dc997143785ab3e320adcd6db951747f6532c0f8e20c9ad93e7545575012f2a2534f77d382593cb20b9e8e97624022dd93ebdf9aa5269bad47d45c3

Score

9^/10

evasion ransomware themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 1 IoCs

Processes:

Wizard Loader.exe

pid process

1324 Wizard Loader.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
1324	Wizard Loader.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Wizard Loader.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Wizard Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Wizard Loader.exe

Loads dropped DLL 2 IoCs

Processes:

Wizard Loader.exe

pid process

1324 Wizard Loader.exe
1324 Wizard Loader.exe

pid	process
1324	Wizard Loader.exe
1324	Wizard Loader.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe	themida
C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe	themida
behavioral2/memory/1324-128-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp	themida
behavioral2/memory/1324-129-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp	themida
behavioral2/memory/1324-130-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp	themida
behavioral2/memory/1324-131-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp	themida
behavioral2/memory/1324-133-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp	themida
behavioral2/memory/1324-134-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Wizard Loader.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Wizard Loader.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wizard Loader.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Wizard Loader.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Image1.jpg"	Wizard Loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Image2.jpg"	Wizard Loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Wizard Loader.exe

pid process

1324 Wizard Loader.exe
Drops file in Windows directory 1 IoCs

Processes:

Wizard Loader.exe

description ioc process

File created C:\Windows\0.txt Wizard Loader.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disabling Security Tools
T1089

Modify Registry
T1112

pid	process
1324	Wizard Loader.exe

description	ioc	process
File created	C:\Windows\0.txt	Wizard Loader.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\PhishingFilter	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	reg.exe

Modifies registry class 13 IoCs

Processes:

reg.exeWizard Loader.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Wizard Loader.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Wizard Loader.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software	reg.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

3984 PING.EXE
1640 PING.EXE
2968 PING.EXE
2900 PING.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 3492 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 3492 AUDIODG.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Wizard Loader.exe

pid process

2660 Wizard Loader.exe
2660 Wizard Loader.exe

pid	process
3984	PING.EXE
1640	PING.EXE
2968	PING.EXE
2900	PING.EXE

description	pid	process
Token: 33	3492	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3492	AUDIODG.EXE

pid	process
2660	Wizard Loader.exe
2660	Wizard Loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Wizard Loader.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1324 wrote to memory of 3664	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 3664	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 2556	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 2556	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 2552	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 2552	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 2024	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 2024	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 2020	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 2020	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 1428	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 1428	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 1272	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 1272	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 3852	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 3852	1324	Wizard Loader.exe	cmd.exe
PID 3852 wrote to memory of 1288	3852	cmd.exe	netsh.exe
PID 3852 wrote to memory of 1288	3852	cmd.exe	netsh.exe
PID 1324 wrote to memory of 908	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 908	1324	Wizard Loader.exe	cmd.exe
PID 908 wrote to memory of 1020	908	cmd.exe	netsh.exe
PID 908 wrote to memory of 1020	908	cmd.exe	netsh.exe
PID 1324 wrote to memory of 584	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 584	1324	Wizard Loader.exe	cmd.exe
PID 584 wrote to memory of 676	584	cmd.exe	netsh.exe
PID 584 wrote to memory of 676	584	cmd.exe	netsh.exe
PID 1324 wrote to memory of 1884	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 1884	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 3488	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 3488	1324	Wizard Loader.exe	cmd.exe
PID 3488 wrote to memory of 2300	3488	cmd.exe	netsh.exe
PID 3488 wrote to memory of 2300	3488	cmd.exe	netsh.exe
PID 1324 wrote to memory of 2660	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 2660	1324	Wizard Loader.exe	cmd.exe
PID 2660 wrote to memory of 800	2660	cmd.exe	netsh.exe
PID 2660 wrote to memory of 800	2660	cmd.exe	netsh.exe
PID 1324 wrote to memory of 3784	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 3784	1324	Wizard Loader.exe	cmd.exe
PID 3784 wrote to memory of 1424	3784	cmd.exe	netsh.exe
PID 3784 wrote to memory of 1424	3784	cmd.exe	netsh.exe
PID 1324 wrote to memory of 3944	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 3944	1324	Wizard Loader.exe	cmd.exe
PID 3944 wrote to memory of 3124	3944	cmd.exe	netsh.exe
PID 3944 wrote to memory of 3124	3944	cmd.exe	netsh.exe
PID 1324 wrote to memory of 3332	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 3332	1324	Wizard Loader.exe	cmd.exe
PID 3332 wrote to memory of 3180	3332	cmd.exe	netsh.exe
PID 3332 wrote to memory of 3180	3332	cmd.exe	netsh.exe
PID 1324 wrote to memory of 700	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 700	1324	Wizard Loader.exe	cmd.exe
PID 700 wrote to memory of 3676	700	cmd.exe	netsh.exe
PID 700 wrote to memory of 3676	700	cmd.exe	netsh.exe
PID 1324 wrote to memory of 3744	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 3744	1324	Wizard Loader.exe	cmd.exe
PID 3744 wrote to memory of 4056	3744	cmd.exe	netsh.exe
PID 3744 wrote to memory of 4056	3744	cmd.exe	netsh.exe
PID 1324 wrote to memory of 2552	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 2552	1324	Wizard Loader.exe	cmd.exe
PID 2552 wrote to memory of 2024	2552	cmd.exe	netsh.exe
PID 2552 wrote to memory of 2024	2552	cmd.exe	netsh.exe
PID 1324 wrote to memory of 1272	1324	Wizard Loader.exe	cmd.exe
PID 1324 wrote to memory of 1272	1324	Wizard Loader.exe	cmd.exe
PID 1272 wrote to memory of 2724	1272	cmd.exe	netsh.exe
PID 1272 wrote to memory of 2724	1272	cmd.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Wizard Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Wizard Loader.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3224

C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
"C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color F
2⤵
PID:3664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c del /s /f /q c:\\windows\\temp\\*.*
2⤵
PID:2556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c rd /s /q c:\windows\temp
2⤵
PID:2552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c md c:\windows\temp
2⤵
PID:2024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c del /s /f /q %temp%\*.*
2⤵
PID:2020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c rd /s /q %temp%
2⤵
PID:1428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c md %temp%
2⤵
PID:1272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global autotuninglevel=default
2⤵
- Suspicious use of WriteProcessMemory
PID:3852

C:\Windows\system32\netsh.exe
netsh int tcp set global autotuninglevel=default
3⤵
PID:1288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global dca=default
2⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global netdma=default
2⤵
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\system32\netsh.exe
netsh int tcp set global netdma=default
3⤵
PID:676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c md %temp%
2⤵
PID:1884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set heuristics default
2⤵
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\system32\netsh.exe
netsh int tcp set heuristics default
3⤵
PID:2300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global rss=default
2⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\system32\netsh.exe
netsh int tcp set global rss=default
3⤵
PID:800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global fastopen=default
2⤵
- Suspicious use of WriteProcessMemory
PID:3784

C:\Windows\system32\netsh.exe
netsh int tcp set global fastopen=default
3⤵
PID:1424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global timestamps=default
2⤵
- Suspicious use of WriteProcessMemory
PID:3944

C:\Windows\system32\netsh.exe
netsh int tcp set global timestamps=default
3⤵
PID:3124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global nonsackrttresiliency=default
2⤵
- Suspicious use of WriteProcessMemory
PID:3332

C:\Windows\system32\netsh.exe
netsh int tcp set global nonsackrttresiliency=default
3⤵
PID:3180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global rsc=default
2⤵
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\system32\netsh.exe
netsh int tcp set global rsc=default
3⤵
PID:3676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global maxsynretransmissions=2
2⤵
- Suspicious use of WriteProcessMemory
PID:3744

C:\Windows\system32\netsh.exe
netsh int tcp set global maxsynretransmissions=2
3⤵
PID:4056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global initialRto=3000
2⤵
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\system32\netsh.exe
netsh int tcp set global initialRto=3000
3⤵
PID:2024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int ip reset global
2⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\system32\netsh.exe
netsh int ip reset global
3⤵
PID:2724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int ip reset show global
2⤵
PID:3836

C:\Windows\system32\netsh.exe
netsh int ip reset show global
3⤵
PID:496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp reset global
2⤵
PID:908

C:\Windows\system32\netsh.exe
netsh int tcp reset global
3⤵
PID:2220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp reset show global
2⤵
PID:584

C:\Windows\system32\netsh.exe
netsh int tcp reset show global
3⤵
PID:1884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int ip reset c:resetlog.txt
2⤵
PID:3760

C:\Windows\system32\netsh.exe
netsh int ip reset c:resetlog.txt
3⤵
PID:1344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int ip reset C:\tcplog.txt
2⤵
PID:800

C:\Windows\system32\netsh.exe
netsh int ip reset C:\tcplog.txt
3⤵
PID:2660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int ip reset e:resetlog.txt
2⤵
PID:2236

C:\Windows\system32\netsh.exe
netsh int ip reset e:resetlog.txt
3⤵
PID:1912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int ip reset E:\tcplog.txt
2⤵
PID:1952

C:\Windows\system32\netsh.exe
netsh int ip reset E:\tcplog.txt
3⤵
PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color A
2⤵
PID:2876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color A
2⤵
PID:2288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int ip reset d:resetlog.txt
2⤵
PID:1308

C:\Windows\system32\netsh.exe
netsh int ip reset d:resetlog.txt
3⤵
PID:712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int ip reset D:\tcplog.txt
2⤵
PID:1472

C:\Windows\system32\netsh.exe
netsh int ip reset D:\tcplog.txt
3⤵
PID:1208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh winsock reset
2⤵
PID:2112

C:\Windows\system32\netsh.exe
netsh winsock reset
3⤵
PID:828

C:\Windows\system32\sc.exe
sc stop "RemoteRegistry"
4⤵
PID:4068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int ip reset
2⤵
PID:204

C:\Windows\system32\netsh.exe
netsh int ip reset
3⤵
PID:3028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh interface ipv4 reset
2⤵
PID:3176

C:\Windows\system32\netsh.exe
netsh interface ipv4 reset
3⤵
PID:1956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh interface tcp reset
2⤵
PID:1796

C:\Windows\system32\netsh.exe
netsh interface tcp reset
3⤵
PID:3764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh advfirewall reset
2⤵
PID:2096

C:\Windows\system32\netsh.exe
netsh advfirewall reset
3⤵
PID:2392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh interface ip delete arpcache
2⤵
PID:2176

C:\Windows\system32\netsh.exe
netsh interface ip delete arpcache
3⤵
PID:1160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ping 87.240.139.194 -n 1 > C:\ping.txt
2⤵
PID:3856

C:\Windows\system32\PING.EXE
ping 87.240.139.194 -n 1
3⤵
- Runs ping.exe
PID:3984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ping 172.67.147.28 -n 1 > C:\ping2.txt
2⤵
PID:3836

C:\Windows\system32\PING.EXE
ping 172.67.147.28 -n 1
3⤵
- Runs ping.exe
PID:1640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ping 87.240.139.194 -n 1 > C:\ping.txt
2⤵
PID:2656

C:\Windows\system32\PING.EXE
ping 87.240.139.194 -n 1
3⤵
- Runs ping.exe
PID:2968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ping 172.67.147.28 -n 1 > C:\ping2.txt
2⤵
PID:912

C:\Windows\system32\PING.EXE
ping 172.67.147.28 -n 1
3⤵
- Runs ping.exe
PID:2900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c msg %username% Àêòèâèðîâàíî! Ìîæåòå çàêðûòü êîìàíäíóþ ñòðîêó.
2⤵
PID:656

C:\Windows\system32\msg.exe
msg Admin Àêòèâèðîâàíî! Ìîæåòå çàêðûòü êîìàíäíóþ ñòðîêó.
3⤵
PID:1500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c %APPDATA%/.vimeworld/VimeWorld.exe -home "%APPDATA%/.vimeworld\" -jre "%APPDATA%/.vimeworld\jre-x64" -jvmargs -Xmx22000M -jar "launcher.jar"
2⤵
PID:1344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color F
2⤵
PID:2236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
2⤵
PID:368

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
3⤵
PID:2696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
2⤵
PID:2972

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
3⤵
PID:2888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v DisableSoftLanding /t REG_DWORD /d 1 /f
2⤵
PID:2288

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v DisableSoftLanding /t REG_DWORD /d 1 /f
3⤵
PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsSpotlightFeatures /t REG_DWORD /d 1 /f
2⤵
PID:2648

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsSpotlightFeatures /t REG_DWORD /d 1 /f
3⤵
PID:3064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
2⤵
PID:1496

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
3⤵
PID:3784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f
2⤵
PID:1584

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f
3⤵
PID:628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\Software\Policies\Microsoft\WindowsInkWorkspace" /v AllowSuggestedAppsInWindowsInkWorkspace /t REG_DWORD /d 0 /f
2⤵
PID:716

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\Software\Policies\Microsoft\WindowsInkWorkspace" /v AllowSuggestedAppsInWindowsInkWorkspace /t REG_DWORD /d 0 /f
3⤵
PID:1096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
2⤵
PID:1000

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
3⤵
PID:2108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d "0" /f
2⤵
PID:2112

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d "0" /f
3⤵
PID:3160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d "0" /f
2⤵
PID:3184

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d "0" /f
3⤵
- Modifies registry class
PID:2844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d 1 /f
2⤵
PID:620

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d 1 /f
3⤵
PID:4068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d 1 /f
2⤵
PID:1812

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d 1 /f
3⤵
PID:3164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Siuf\Rules" /v "NumberOfSIUFInPeriod" /t REG_DWORD /d 0 /f
2⤵
PID:2224

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Siuf\Rules" /v "NumberOfSIUFInPeriod" /t REG_DWORD /d 0 /f
3⤵
PID:952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\SYSTEM\ControlSet001\Control\WMI\AutoLogger\AutoLogger-Diagtrack-Listener" /v Start /t REG_DWORD /d 0 /f
2⤵
PID:1924

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\SYSTEM\ControlSet001\Control\WMI\AutoLogger\AutoLogger-Diagtrack-Listener" /v Start /t REG_DWORD /d 0 /f
3⤵
PID:2744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v AITEnable /t REG_DWORD /d 0 /f
2⤵
PID:2264

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v AITEnable /t REG_DWORD /d 0 /f
3⤵
PID:2392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisableInventory /t REG_DWORD /d 1 /f
2⤵
PID:3660

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisableInventory /t REG_DWORD /d 1 /f
3⤵
PID:4020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisablePCA /t REG_DWORD /d 1 /f
2⤵
PID:1160

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisablePCA /t REG_DWORD /d 1 /f
3⤵
PID:2176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisableUAR /t REG_DWORD /d 1 /f
2⤵
PID:3644

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v DisableUAR /t REG_DWORD /d 1 /f
3⤵
PID:2788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d 0 /f
2⤵
PID:236

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d 0 /f
3⤵
PID:2556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t REG_DWORD /d 0 /f
2⤵
PID:2752

C:\Windows\system32\reg.exe
Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t REG_DWORD /d 0 /f
3⤵
PID:2504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKCU\Software\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d 0 /f
2⤵
PID:920

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d 0 /f
3⤵
- Modifies Internet Explorer Phishing Filter
PID:3664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRecentDocsHistory" /t REG_DWORD /d 1 /f
2⤵
PID:3872

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRecentDocsHistory" /t REG_DWORD /d 1 /f
3⤵
PID:3392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DiagTrack" /v "Start" /t REG_DWORD /d 4 /f
2⤵
PID:1428

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DiagTrack" /v "Start" /t REG_DWORD /d 4 /f
3⤵
PID:1456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DiagTrack\Parameters" /v "ServiceDllUnloadOnStop" /t REG_DWORD /d 1 /f
2⤵
PID:2828

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DiagTrack\Parameters" /v "ServiceDllUnloadOnStop" /t REG_DWORD /d 1 /f
3⤵
PID:2088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\edgeupdatem" /v "Start" /t REG_DWORD /d 4 /f
2⤵
PID:3132

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\edgeupdatem" /v "Start" /t REG_DWORD /d 4 /f
3⤵
PID:2784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RetailDemo" /v "ServiceDllUnloadOnStop" /t REG_DWORD /d 1 /f
2⤵
PID:3984

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RetailDemo" /v "ServiceDllUnloadOnStop" /t REG_DWORD /d 1 /f
3⤵
PID:3832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\edgeupdatem" /v "ServiceDllUnloadOnStop" /t REG_DWORD /d 1 /f
2⤵
PID:2724

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\edgeupdatem" /v "ServiceDllUnloadOnStop" /t REG_DWORD /d 1 /f
3⤵
PID:1288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MapsBroker" /v "Start" /t REG_DWORD /d 4 /f
2⤵
PID:908

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MapsBroker" /v "Start" /t REG_DWORD /d 4 /f
3⤵
PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MapsBroker" /v "ServiceDllUnloadOnStop" /t REG_DWORD /d 1 /f
2⤵
PID:2220

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MapsBroker" /v "ServiceDllUnloadOnStop" /t REG_DWORD /d 1 /f
3⤵
PID:3736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RetailDemo" /v "Start" /t REG_DWORD /d 4 /f
2⤵
PID:1188

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RetailDemo" /v "Start" /t REG_DWORD /d 4 /f
3⤵
PID:1676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v RMDisablePostL2Compression /t REG_DWORD /d 1 /f
2⤵
PID:832

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v RMDisablePostL2Compression /t REG_DWORD /d 1 /f
3⤵
PID:1592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v RmDisableRegistryCaching /t REG_DWORD /d 1 /f
2⤵
PID:1152

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v RmDisableRegistryCaching /t REG_DWORD /d 1 /f
3⤵
PID:708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v RmGpsPsEnablePerCpuCoreDpc /t REG_DWORD /d 1 /f
2⤵
PID:340

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v RmGpsPsEnablePerCpuCoreDpc /t REG_DWORD /d 1 /f
3⤵
PID:940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v RmDisableRegistryCaching /t REG_DWORD /d 1 /f
2⤵
PID:2860

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v RmDisableRegistryCaching /t REG_DWORD /d 1 /f
3⤵
PID:1252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DisableWriteCombining /t REG_DWORD /d 1 /f
2⤵
PID:912

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DisableWriteCombining /t REG_DWORD /d 1 /f
3⤵
PID:3864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnablePreemption /t REG_DWORD /d 0 /f
2⤵
PID:2636

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnablePreemption /t REG_DWORD /d 0 /f
3⤵
PID:3772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v GPUPreemptionLevel /t REG_DWORD /d 0 /f
2⤵
PID:1500

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v GPUPreemptionLevel /t REG_DWORD /d 0 /f
3⤵
PID:1192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v ComputePreemption /t REG_DWORD /d 0 /f
2⤵
PID:696

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v ComputePreemption /t REG_DWORD /d 0 /f
3⤵
PID:1328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableMidGfxPreemptionVGPU /t REG_DWORD /d 0 /f
2⤵
PID:3012

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableMidGfxPreemptionVGPU /t REG_DWORD /d 0 /f
3⤵
PID:1736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableMidBufferPreemptionForHighTdrTimeout /t REG_DWORD /d 0 /f
2⤵
PID:3760

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableMidBufferPreemptionForHighTdrTimeout /t REG_DWORD /d 0 /f
3⤵
PID:1268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableAsyncMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:2236

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableAsyncMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableSCGMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:368

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableSCGMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:3516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v PerfAnalyzeMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:2972

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v PerfAnalyzeMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:2144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableMidGfxPreemption /t REG_DWORD /d 0 /f
2⤵
PID:2288

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableMidGfxPreemption /t REG_DWORD /d 0 /f
3⤵
PID:4060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:2648

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:1208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableCEPreemption /t REG_DWORD /d 0 /f
2⤵
PID:1496

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v EnableCEPreemption /t REG_DWORD /d 0 /f
3⤵
PID:532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DisableCudaContextPreemption /t REG_DWORD /d 1 /f
2⤵
PID:1584

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DisableCudaContextPreemption /t REG_DWORD /d 1 /f
3⤵
PID:2448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DisablePreemptionOnS3S4 /t REG_DWORD /d 1 /f
2⤵
PID:716

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DisablePreemptionOnS3S4 /t REG_DWORD /d 1 /f
3⤵
PID:1220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v MonitorLatencyTolerance /t REG_DWORD /d 0 /f
2⤵
PID:1000

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v MonitorLatencyTolerance /t REG_DWORD /d 0 /f
3⤵
PID:3172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v ExitLatency /t REG_DWORD /d 1 /f
2⤵
PID:208

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v ExitLatency /t REG_DWORD /d 1 /f
3⤵
PID:2844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v ExitLatencyCheckEnabled /t REG_DWORD /d 1 /f
2⤵
PID:3160

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v ExitLatencyCheckEnabled /t REG_DWORD /d 1 /f
3⤵
PID:3980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v Latency /t REG_DWORD /d 1 /f
2⤵
PID:620

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v Latency /t REG_DWORD /d 1 /f
3⤵
PID:2164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v LatencyToleranceDefault /t REG_DWORD /d 1 /f
2⤵
PID:1812

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v LatencyToleranceDefault /t REG_DWORD /d 1 /f
3⤵
PID:3764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v LatencyToleranceFSVP /t REG_DWORD /d 1 /f
2⤵
PID:2224

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v LatencyToleranceFSVP /t REG_DWORD /d 1 /f
3⤵
PID:1528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v LatencyTolerancePerfOverride /t REG_DWORD /d 1 /f
2⤵
PID:1924

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v LatencyTolerancePerfOverride /t REG_DWORD /d 1 /f
3⤵
PID:2116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v LatencyToleranceScreenOffIR /t REG_DWORD /d 1 /f
2⤵
PID:2264

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v LatencyToleranceScreenOffIR /t REG_DWORD /d 1 /f
3⤵
PID:3624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v LatencyToleranceVSyncEnabled /t REG_DWORD /d 1 /f
2⤵
PID:3660

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v LatencyToleranceVSyncEnabled /t REG_DWORD /d 1 /f
3⤵
PID:2704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v RtlCapabilityCheckLatency /t REG_DWORD /d 1 /f
2⤵
PID:1160

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v RtlCapabilityCheckLatency /t REG_DWORD /d 1 /f
3⤵
PID:700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyActivelyUsed /t REG_DWORD /d 1 /f
2⤵
PID:3644

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyActivelyUsed /t REG_DWORD /d 1 /f
3⤵
PID:3200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyIdleLongTime /t REG_DWORD /d 1 /f
2⤵
PID:376

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyIdleLongTime /t REG_DWORD /d 1 /f
3⤵
PID:2504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyIdleMonitorOff /t REG_DWORD /d 1 /f
2⤵
PID:1612

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyIdleMonitorOff /t REG_DWORD /d 1 /f
3⤵
PID:2556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyIdleNoContext /t REG_DWORD /d 1 /f
2⤵
PID:352

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyIdleNoContext /t REG_DWORD /d 1 /f
3⤵
PID:2488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyIdleShortTime /t REG_DWORD /d 1 /f
2⤵
PID:2652

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyIdleShortTime /t REG_DWORD /d 1 /f
3⤵
PID:2020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyIdleVeryLongTime /t REG_DWORD /d 1 /f
2⤵
PID:3744

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultD3TransitionLatencyIdleVeryLongTime /t REG_DWORD /d 1 /f
3⤵
PID:2024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceIdle0 /t REG_DWORD /d 1 /f
2⤵
PID:1468

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceIdle0 /t REG_DWORD /d 1 /f
3⤵
PID:640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceIdle0MonitorOff /t REG_DWORD /d 1 /f
2⤵
PID:3512

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceIdle0MonitorOff /t REG_DWORD /d 1 /f
3⤵
PID:3796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceIdle1 /t REG_DWORD /d 1 /f
2⤵
PID:668

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceIdle1 /t REG_DWORD /d 1 /f
3⤵
PID:1588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceIdle1MonitorOff /t REG_DWORD /d 1 /f
2⤵
PID:3052

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceIdle1MonitorOff /t REG_DWORD /d 1 /f
3⤵
PID:1748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceMemory /t REG_DWORD /d 1 /f
2⤵
PID:3440

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceMemory /t REG_DWORD /d 1 /f
3⤵
PID:3836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceNoContext /t REG_DWORD /d 1 /f
2⤵
PID:1316

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceNoContext /t REG_DWORD /d 1 /f
3⤵
PID:1416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceNoContextMonitorOff /t REG_DWORD /d 1 /f
2⤵
PID:604

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceNoContextMonitorOff /t REG_DWORD /d 1 /f
3⤵
PID:872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceOther /t REG_DWORD /d 1 /f
2⤵
PID:600

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceOther /t REG_DWORD /d 1 /f
3⤵
PID:1008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceTimerPeriod /t REG_DWORD /d 1 /f
2⤵
PID:3224

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultLatencyToleranceTimerPeriod /t REG_DWORD /d 1 /f
3⤵
PID:2900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultMemoryRefreshLatencyToleranceActivelyUsed /t REG_DWORD /d 1 /f
2⤵
PID:972

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultMemoryRefreshLatencyToleranceActivelyUsed /t REG_DWORD /d 1 /f
3⤵
PID:1052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultMemoryRefreshLatencyToleranceMonitorOff /t REG_DWORD /d 1 /f
2⤵
PID:1156

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DefaultMemoryRefreshLatencyToleranceMonitorOff /t REG_DWORD /d 1 /f
3⤵
PID:3092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v Latency /t REG_DWORD /d 1 /f
2⤵
PID:2552

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v Latency /t REG_DWORD /d 1 /f
3⤵
PID:1280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v MaxIAverageGraphicsLatencyInOneBucket /t REG_DWORD /d 1 /f
2⤵
PID:988

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v MaxIAverageGraphicsLatencyInOneBucket /t REG_DWORD /d 1 /f
3⤵
PID:2672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v MiracastPerfTrackGraphicsLatency /t REG_DWORD /d 1 /f
2⤵
PID:2564

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v MiracastPerfTrackGraphicsLatency /t REG_DWORD /d 1 /f
3⤵
PID:1672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v MonitorLatencyTolerance /t REG_DWORD /d 1 /f
2⤵
PID:656

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v MonitorLatencyTolerance /t REG_DWORD /d 1 /f
3⤵
PID:1908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v MonitorRefreshLatencyTolerance /t REG_DWORD /d 1 /f
2⤵
PID:1896

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v MonitorRefreshLatencyTolerance /t REG_DWORD /d 1 /f
3⤵
PID:1756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v TransitionLatency /t REG_DWORD /d 1 /f
2⤵
PID:800

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v TransitionLatency /t REG_DWORD /d 1 /f
3⤵
PID:2696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v RMDisablePostL2Compression /t REG_DWORD /d 1 /f
2⤵
PID:3480

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v RMDisablePostL2Compression /t REG_DWORD /d 1 /f
3⤵
PID:2888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v RmDisableRegistryCaching /t REG_DWORD /d 1 /f
2⤵
PID:2428

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v RmDisableRegistryCaching /t REG_DWORD /d 1 /f
3⤵
PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v RmGpsPsEnablePerCpuCoreDpc /t REG_DWORD /d 1 /f
2⤵
PID:2628

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v RmGpsPsEnablePerCpuCoreDpc /t REG_DWORD /d 1 /f
3⤵
PID:3064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v DisableWriteCombining /t REG_DWORD /d 1 /f
2⤵
PID:3728

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v DisableWriteCombining /t REG_DWORD /d 1 /f
3⤵
PID:3784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnablePreemption /t REG_DWORD /d 0 /f
2⤵
PID:1636

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnablePreemption /t REG_DWORD /d 0 /f
3⤵
PID:628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v GPUPreemptionLevel /t REG_DWORD /d 0 /f
2⤵
PID:364

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v GPUPreemptionLevel /t REG_DWORD /d 0 /f
3⤵
PID:1096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v ComputePreemption /t REG_DWORD /d 0 /f
2⤵
PID:3292

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v ComputePreemption /t REG_DWORD /d 0 /f
3⤵
PID:2108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableMidGfxPreemptionVGPU /t REG_DWORD /d 0 /f
2⤵
PID:1184

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableMidGfxPreemptionVGPU /t REG_DWORD /d 0 /f
3⤵
PID:3228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableMidBufferPreemptionForHighTdrTimeout /t REG_DWORD /d 0 /f
2⤵
PID:3152

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableMidBufferPreemptionForHighTdrTimeout /t REG_DWORD /d 0 /f
3⤵
PID:3028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableAsyncMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:204

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableAsyncMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:4068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableSCGMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:916

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableSCGMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:3164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v PerfAnalyzeMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:3476

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v PerfAnalyzeMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableMidGfxPreemption /t REG_DWORD /d 0 /f
2⤵
PID:3500

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableMidGfxPreemption /t REG_DWORD /d 0 /f
3⤵
PID:2744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:1628

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:2392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableCEPreemption /t REG_DWORD /d 0 /f
2⤵
PID:2096

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v EnableCEPreemption /t REG_DWORD /d 0 /f
3⤵
PID:4020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v MonitorRefreshLatencyTolerance /t REG_DWORD /d 0 /f
2⤵
PID:3168

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v MonitorRefreshLatencyTolerance /t REG_DWORD /d 0 /f
3⤵
PID:2176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v RMDisablePostL2Compression /t REG_DWORD /d 1 /f
2⤵
PID:3212

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v RMDisablePostL2Compression /t REG_DWORD /d 1 /f
3⤵
PID:2788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v RmDisableRegistryCaching /t REG_DWORD /d 1 /f
2⤵
PID:3672

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v RmDisableRegistryCaching /t REG_DWORD /d 1 /f
3⤵
PID:2584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v RmGpsPsEnablePerCpuCoreDpc /t REG_DWORD /d 1 /f
2⤵
PID:1504

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v RmGpsPsEnablePerCpuCoreDpc /t REG_DWORD /d 1 /f
3⤵
PID:2312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v DisableWriteCombining /t REG_DWORD /d 1 /f
2⤵
PID:2344

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v DisableWriteCombining /t REG_DWORD /d 1 /f
3⤵
PID:2580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnablePreemption /t REG_DWORD /d 0 /f
2⤵
PID:4012

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnablePreemption /t REG_DWORD /d 0 /f
3⤵
PID:2492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v GPUPreemptionLevel /t REG_DWORD /d 0 /f
2⤵
PID:920

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v GPUPreemptionLevel /t REG_DWORD /d 0 /f
3⤵
PID:3848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v ComputePreemption /t REG_DWORD /d 0 /f
2⤵
PID:3872

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v ComputePreemption /t REG_DWORD /d 0 /f
3⤵
PID:1516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableMidGfxPreemptionVGPU /t REG_DWORD /d 0 /f
2⤵
PID:1428

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableMidGfxPreemptionVGPU /t REG_DWORD /d 0 /f
3⤵
PID:648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableMidBufferPreemptionForHighTdrTimeout /t REG_DWORD /d 0 /f
2⤵
PID:2828

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableMidBufferPreemptionForHighTdrTimeout /t REG_DWORD /d 0 /f
3⤵
PID:1272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableAsyncMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:3132

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableAsyncMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:3852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableSCGMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:3984

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableSCGMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v PerfAnalyzeMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:3832

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v PerfAnalyzeMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:1760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableMidGfxPreemption /t REG_DWORD /d 0 /f
2⤵
PID:908

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableMidGfxPreemption /t REG_DWORD /d 0 /f
3⤵
PID:1356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:2220

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:1080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableCEPreemption /t REG_DWORD /d 0 /f
2⤵
PID:1188

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v EnableCEPreemption /t REG_DWORD /d 0 /f
3⤵
PID:3156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v DisableCudaContextPreemption /t REG_DWORD /d 1 /f
2⤵
PID:832

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v DisableCudaContextPreemption /t REG_DWORD /d 1 /f
3⤵
PID:2600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v DisablePreemptionOnS3S4 /t REG_DWORD /d 1 /f
2⤵
PID:1152

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v DisablePreemptionOnS3S4 /t REG_DWORD /d 1 /f
3⤵
PID:896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v MonitorLatencyTolerance /t REG_DWORD /d 1 /f
2⤵
PID:340

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v MonitorLatencyTolerance /t REG_DWORD /d 1 /f
3⤵
PID:3232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v MonitorRefreshLatencyTolerance /t REG_DWORD /d 1 /f
2⤵
PID:2860

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler" /v MonitorRefreshLatencyTolerance /t REG_DWORD /d 1 /f
3⤵
PID:2836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePagingExecutive /t REG_DWORD /d 1 /f
2⤵
PID:912

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePagingExecutive /t REG_DWORD /d 1 /f
3⤵
PID:1512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v LargeSystemCache /t REG_DWORD /d 1 /f
2⤵
PID:2636

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v LargeSystemCache /t REG_DWORD /d 1 /f
3⤵
PID:2660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" /v ProtectionMode /t REG_DWORD /d 0 /f
2⤵
PID:1500

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" /v ProtectionMode /t REG_DWORD /d 0 /f
3⤵
PID:1312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability" /v TimeStampInterval /t REG_DWORD /d 1 /f
2⤵
PID:696

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability" /v TimeStampInterval /t REG_DWORD /d 1 /f
3⤵
PID:3244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DpiMapIommuContiguous /t REG_DWORD /d 1 /f
2⤵
PID:3012

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DpiMapIommuContiguous /t REG_DWORD /d 1 /f
3⤵
PID:2252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v DisableCudaContextPreemption /t REG_DWORD /d 1 /f
2⤵
PID:424

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v DisableCudaContextPreemption /t REG_DWORD /d 1 /f
3⤵
PID:1952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v DisablePreemptionOnS3S4 /t REG_DWORD /d 1 /f
2⤵
PID:2236

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v DisablePreemptionOnS3S4 /t REG_DWORD /d 1 /f
3⤵
PID:2040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v MonitorLatencyTolerance /t REG_DWORD /d 1 /f
2⤵
PID:368

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v MonitorLatencyTolerance /t REG_DWORD /d 1 /f
3⤵
PID:388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v D3PCLatency /t REG_DWORD /d 1 /f
2⤵
PID:2972

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v D3PCLatency /t REG_DWORD /d 1 /f
3⤵
PID:1048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v F1TransitionLatency /t REG_DWORD /d 1 /f
2⤵
PID:2288

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v F1TransitionLatency /t REG_DWORD /d 1 /f
3⤵
PID:1472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v LOWLATENCY /t REG_DWORD /d 1 /f
2⤵
PID:2648

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v LOWLATENCY /t REG_DWORD /d 1 /f
3⤵
PID:684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v Node3DLowLatency /t REG_DWORD /d 1 /f
2⤵
PID:1496

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v Node3DLowLatency /t REG_DWORD /d 1 /f
3⤵
PID:3264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v PciLatencyTimerControl /t REG_DWORD /d 32 /f
2⤵
PID:1584

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v PciLatencyTimerControl /t REG_DWORD /d 32 /f
3⤵
PID:2112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMDeepL1EntryLatencyUsec /t REG_DWORD /d 1 /f
2⤵
PID:716

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMDeepL1EntryLatencyUsec /t REG_DWORD /d 1 /f
3⤵
PID:3184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RmGspcMaxFtuS /t REG_DWORD /d 1 /f
2⤵
PID:1000

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RmGspcMaxFtuS /t REG_DWORD /d 1 /f
3⤵
PID:4064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RmGspcMinFtuS /t REG_DWORD /d 1 /f
2⤵
PID:208

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RmGspcMinFtuS /t REG_DWORD /d 1 /f
3⤵
PID:1956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RmGspcPerioduS /t REG_DWORD /d 1 /f
2⤵
PID:3980

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RmGspcPerioduS /t REG_DWORD /d 1 /f
3⤵
PID:1792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMLpwrEiIdleThresholdUs /t REG_DWORD /d 1 /f
2⤵
PID:620

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMLpwrEiIdleThresholdUs /t REG_DWORD /d 1 /f
3⤵
PID:1796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMLpwrGrIdleThresholdUs /t REG_DWORD /d 1 /f
2⤵
PID:1812

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMLpwrGrIdleThresholdUs /t REG_DWORD /d 1 /f
3⤵
PID:2924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMLpwrGrRgIdleThresholdUs /t REG_DWORD /d 1 /f
2⤵
PID:2224

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMLpwrGrRgIdleThresholdUs /t REG_DWORD /d 1 /f
3⤵
PID:3204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMLpwrMsIdleThresholdUs /t REG_DWORD /d 1 /f
2⤵
PID:3124

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMLpwrMsIdleThresholdUs /t REG_DWORD /d 1 /f
3⤵
PID:2812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v VRDirectFlipDPCDelayUs /t REG_DWORD /d 1 /f
2⤵
PID:2264

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v VRDirectFlipDPCDelayUs /t REG_DWORD /d 1 /f
3⤵
PID:3652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v VRDirectFlipTimingMarginUs /t REG_DWORD /d 1 /f
2⤵
PID:3676

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v VRDirectFlipTimingMarginUs /t REG_DWORD /d 1 /f
3⤵
PID:3200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v VRDirectJITFlipMsHybridFlipDelayUs /t REG_DWORD /d 1 /f
2⤵
PID:3668

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v VRDirectJITFlipMsHybridFlipDelayUs /t REG_DWORD /d 1 /f
3⤵
PID:3640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v vrrCursorMarginUs /t REG_DWORD /d 1 /f
2⤵
PID:3644

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v vrrCursorMarginUs /t REG_DWORD /d 1 /f
3⤵
PID:3664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v vrrDeflickerMarginUs /t REG_DWORD /d 1 /f
2⤵
PID:376

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v vrrDeflickerMarginUs /t REG_DWORD /d 1 /f
3⤵
PID:2284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v vrrDeflickerMaxUs /t REG_DWORD /d 1 /f
2⤵
PID:1612

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v vrrDeflickerMaxUs /t REG_DWORD /d 1 /f
3⤵
PID:1456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMDisablePostL2Compression /t REG_DWORD /d 1 /f
2⤵
PID:352

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RMDisablePostL2Compression /t REG_DWORD /d 1 /f
3⤵
PID:2088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RmDisableRegistryCaching /t REG_DWORD /d 1 /f
2⤵
PID:2020

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RmDisableRegistryCaching /t REG_DWORD /d 1 /f
3⤵
PID:2784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RmGpsPsEnablePerCpuCoreDpc /t REG_DWORD /d 1 /f
2⤵
PID:3744

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v RmGpsPsEnablePerCpuCoreDpc /t REG_DWORD /d 1 /f
3⤵
PID:2700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v DisableWriteCombining /t REG_DWORD /d 1 /f
2⤵
PID:1468

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v DisableWriteCombining /t REG_DWORD /d 1 /f
3⤵
PID:3856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v GPUPreemptionLevel /t REG_DWORD /d 0 /f
2⤵
PID:3512

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v GPUPreemptionLevel /t REG_DWORD /d 0 /f
3⤵
PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v ComputePreemption /t REG_DWORD /d 0 /f
2⤵
PID:668

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v ComputePreemption /t REG_DWORD /d 0 /f
3⤵
PID:3736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableMidGfxPreemptionVGPU /t REG_DWORD /d 0 /f
2⤵
PID:3052

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableMidGfxPreemptionVGPU /t REG_DWORD /d 0 /f
3⤵
PID:1676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableMidBufferPreemptionForHighTdrTimeout /t REG_DWORD /d 0 /f
2⤵
PID:3440

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableMidBufferPreemptionForHighTdrTimeout /t REG_DWORD /d 0 /f
3⤵
PID:2656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableAsyncMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:1316

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableAsyncMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableSCGMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:604

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableSCGMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v PerfAnalyzeMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:600

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v PerfAnalyzeMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:1252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableMidGfxPreemption /t REG_DWORD /d 0 /f
2⤵
PID:3224

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableMidGfxPreemption /t REG_DWORD /d 0 /f
3⤵
PID:3864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableMidBufferPreemption /t REG_DWORD /d 0 /f
2⤵
PID:972

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableMidBufferPreemption /t REG_DWORD /d 0 /f
3⤵
PID:3772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableCEPreemption /t REG_DWORD /d 0 /f
2⤵
PID:1996

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v EnableCEPreemption /t REG_DWORD /d 0 /f
3⤵
PID:1192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v DisableCudaContextPreemption /t REG_DWORD /d 1 /f
2⤵
PID:2552

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v DisableCudaContextPreemption /t REG_DWORD /d 1 /f
3⤵
PID:1328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v DisablePreemptionOnS3S4 /t REG_DWORD /d 1 /f
2⤵
PID:988

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v DisablePreemptionOnS3S4 /t REG_DWORD /d 1 /f
3⤵
PID:1736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v MonitorLatencyTolerance /t REG_DWORD /d 1 /f
2⤵
PID:2564

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v MonitorLatencyTolerance /t REG_DWORD /d 1 /f
3⤵
PID:1268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v MonitorRefreshLatencyTolerance /t REG_DWORD /d 1 /f
2⤵
PID:656

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v MonitorRefreshLatencyTolerance /t REG_DWORD /d 1 /f
3⤵
PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
2⤵
PID:1896

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
3⤵
PID:3516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\PriorityControl" /v IRQ8Priority /t REG_DWORD /d 1 /f
2⤵
PID:2696

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\PriorityControl" /v IRQ8Priority /t REG_DWORD /d 1 /f
3⤵
PID:2144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v HibernateEnabledDefault /t REG_DWORD /d 0 /f
2⤵
PID:3088

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v HibernateEnabledDefault /t REG_DWORD /d 0 /f
3⤵
PID:3064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh winsock set autotuning on > nul
2⤵
PID:2876

C:\Windows\system32\netsh.exe
netsh winsock set autotuning on
3⤵
PID:1208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global fastopen=enable > nul
2⤵
PID:1284

C:\Windows\system32\netsh.exe
netsh int tcp set global fastopen=enable
3⤵
PID:3728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh interface ipv4 set dns name="Wi-Fi" static 1.1.1.1 > nul
2⤵
PID:4036

C:\Windows\system32\netsh.exe
netsh interface ipv4 set dns name="Wi-Fi" static 1.1.1.1
3⤵
PID:2108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh interface ipv4 add dns name="Wi-Fi" 1.0.0.1 index=2 > nul
2⤵
PID:1260

C:\Windows\system32\netsh.exe
netsh interface ipv4 add dns name="Wi-Fi" 1.0.0.1 index=2
3⤵
PID:2920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v DefaultReceiveWindow /t REG_DWORD /d 10000 /f
2⤵
PID:2228

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v DefaultReceiveWindow /t REG_DWORD /d 10000 /f
3⤵
PID:3152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v DefaultSendWindow /t REG_DWORD /d 10000 /f
2⤵
PID:2164

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v DefaultSendWindow /t REG_DWORD /d 10000 /f
3⤵
PID:1956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v DynamicSendBufferDisable /t REG_DWORD /d 1 /f
2⤵
PID:3764

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v DynamicSendBufferDisable /t REG_DWORD /d 1 /f
3⤵
PID:1792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v EnableDynamicBacklog /t REG_DWORD /d 1 /f
2⤵
PID:1528

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v EnableDynamicBacklog /t REG_DWORD /d 1 /f
3⤵
PID:1796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v MinimumDynamicBacklog /t REG_DWORD /d 20 /f
2⤵
PID:2116

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v MinimumDynamicBacklog /t REG_DWORD /d 20 /f
3⤵
PID:2924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v MaximumDynamicBacklog /t REG_DWORD /d 1000 /f
2⤵
PID:3624

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v MaximumDynamicBacklog /t REG_DWORD /d 1000 /f
3⤵
PID:1628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v DynamicBacklogGrowthDelta /t REG_DWORD /d 10 /f
2⤵
PID:3204

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v DynamicBacklogGrowthDelta /t REG_DWORD /d 10 /f
3⤵
PID:2812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v KeepAliveInterval /t REG_DWORD /d 1 /f
2⤵
PID:700

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v KeepAliveInterval /t REG_DWORD /d 1 /f
3⤵
PID:3652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DefaultTTL /t REG_DWORD /d 128 /f
2⤵
PID:3372

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v DefaultTTL /t REG_DWORD /d 128 /f
3⤵
PID:3200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f
2⤵
PID:2504

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f
3⤵
PID:3640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpTimedWaitDelay /t REG_DWORD /d 20 /f
2⤵
PID:2556

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpTimedWaitDelay /t REG_DWORD /d 20 /f
3⤵
PID:3664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxDataRetransmissions /t REG_DWORD /d 5 /f
2⤵
PID:2488

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v TcpMaxDataRetransmissions /t REG_DWORD /d 5 /f
3⤵
PID:2284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" /v TcpAckFrequency /t REG_DWORD /d 1 /f
2⤵
PID:3392

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" /v TcpAckFrequency /t REG_DWORD /d 1 /f
3⤵
PID:1456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" /v TCPNoDelay /t REG_DWORD /d 1 /f
2⤵
PID:2024

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" /v TCPNoDelay /t REG_DWORD /d 1 /f
3⤵
PID:920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c @echo off
2⤵
PID:1272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c color 0F
2⤵
PID:1428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c echo Loading...
2⤵
PID:4028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set supplemental Internet congestionprovider=ctcp
2⤵
PID:3856

C:\Windows\system32\netsh.exe
netsh int tcp set supplemental Internet congestionprovider=ctcp
3⤵
PID:1468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global autotuninglevel=normal
2⤵
PID:1760

C:\Windows\system32\netsh.exe
netsh int tcp set global autotuninglevel=normal
3⤵
PID:644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global chimney=disabled
2⤵
PID:3052

C:\Windows\system32\netsh.exe
netsh int tcp set global chimney=disabled
3⤵
PID:1080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set heuristics disabled
2⤵
PID:2600

C:\Windows\system32\netsh.exe
netsh int tcp set heuristics disabled
3⤵
PID:1188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global rss=enabled
2⤵
PID:420

C:\Windows\system32\netsh.exe
netsh int tcp set global rss=enabled
3⤵
PID:340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh int tcp set global timestamps=disabled
2⤵
PID:2004

C:\Windows\system32\netsh.exe
netsh int tcp set global timestamps=disabled
3⤵
PID:492

C:\Windows\system32\sc.exe
sc stop "SensorDataService"
3⤵
PID:1500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cd %temp%
2⤵
PID:1500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Psched" /v "NonBestEffortLimit" /t REG_DWORD /d "0" /f
2⤵
PID:3760

C:\Windows\system32\reg.exe
Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Psched" /v "NonBestEffortLimit" /t REG_DWORD /d "0" /f
3⤵
PID:2808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "lfsvc"
2⤵
PID:3516

C:\Windows\system32\sc.exe
sc stop "lfsvc"
3⤵
PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "Dnscache"
2⤵
PID:800

C:\Windows\system32\sc.exe
sc stop "Dnscache"
3⤵
PID:2428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "BITS"
2⤵
PID:2236

C:\Windows\system32\sc.exe
sc stop "BITS"
3⤵
PID:2628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "TermService"
2⤵
PID:2972

C:\Windows\system32\sc.exe
sc stop "TermService"
3⤵
PID:2040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "FontCache3.0.0.0"
2⤵
PID:1096

C:\Windows\system32\sc.exe
sc stop "FontCache3.0.0.0"
3⤵
PID:2288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "CscService"
2⤵
PID:3728

C:\Windows\system32\sc.exe
sc stop "CscService"
3⤵
PID:1284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "DPS"
2⤵
PID:364

C:\Windows\system32\sc.exe
sc stop "DPS"
3⤵
PID:3264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "RemoteRegistry"
2⤵
PID:2648

C:\Windows\system32\sc.exe
sc stop "RemoteRegistry"
3⤵
PID:3184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "seclogon"
2⤵
PID:1584

C:\Windows\system32\sc.exe
sc stop "seclogon"
3⤵
PID:2920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "wscsvc"
2⤵
PID:4092

C:\Windows\system32\sc.exe
sc stop "wscsvc"
3⤵
PID:3152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "WbioSrvc"
2⤵
PID:2228

C:\Windows\system32\sc.exe
sc stop "WbioSrvc"
3⤵
PID:3936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "workfolderssvc"
2⤵
PID:3164

C:\Windows\system32\sc.exe
sc stop "workfolderssvc"
3⤵
PID:3980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "TabletInputService"
2⤵
PID:2664

C:\Windows\system32\sc.exe
sc stop "TabletInputService"
3⤵
PID:3476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "Imhosts"
2⤵
PID:1796

C:\Windows\system32\sc.exe
sc stop "Imhosts"
3⤵
PID:1528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c $sc stop "WerSvc"
2⤵
PID:1668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "ALG"
2⤵
PID:2392

C:\Windows\system32\sc.exe
sc stop "ALG"
3⤵
PID:2704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "AJRouter"
2⤵
PID:3196

C:\Windows\system32\sc.exe
sc stop "AJRouter"
3⤵
PID:4020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "bthserv"
2⤵
PID:2812

C:\Windows\system32\sc.exe
sc stop "bthserv"
3⤵
PID:3204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "AppIDSvc"
2⤵
PID:3332

C:\Windows\system32\sc.exe
sc stop "AppIDSvc"
3⤵
PID:700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "BthHFSrv"
2⤵
PID:3676

C:\Windows\system32\sc.exe
sc stop "BthHFSrv"
3⤵
PID:2584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "BDESVC"
2⤵
PID:3668

C:\Windows\system32\sc.exe
sc stop "BDESVC"
3⤵
PID:2752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "PeerDistSvc"
2⤵
PID:1504

C:\Windows\system32\sc.exe
sc stop "PeerDistSvc"
3⤵
PID:3664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "CertPropSvc"
2⤵
PID:2344

C:\Windows\system32\sc.exe
sc stop "CertPropSvc"
3⤵
PID:2284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "VaultSvc"
2⤵
PID:4012

C:\Windows\system32\sc.exe
sc stop "VaultSvc"
3⤵
PID:1456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "CryptSvc"
2⤵
PID:3392

C:\Windows\system32\sc.exe
sc stop "CryptSvc"
3⤵
PID:352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "ClipSVC"
2⤵
PID:1808

C:\Windows\system32\sc.exe
sc stop "ClipSVC"
3⤵
PID:1684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "TrkWks"
2⤵
PID:1272

C:\Windows\system32\sc.exe
sc stop "TrkWks"
3⤵
PID:1428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "DiagTrack"
2⤵
PID:4028

C:\Windows\system32\sc.exe
sc stop "DiagTrack"
3⤵
PID:3836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "HomeGroupListener"
2⤵
PID:1588

C:\Windows\system32\sc.exe
sc stop "HomeGroupListener"
3⤵
PID:1468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "HomeGroupProvider"
2⤵
PID:3856

C:\Windows\system32\sc.exe
sc stop "HomeGroupProvider"
3⤵
PID:2724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "vmicvss"
2⤵
PID:3832

C:\Windows\system32\sc.exe
sc stop "vmicvss"
3⤵
PID:3736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "vmictimesync"
2⤵
PID:2220

C:\Windows\system32\sc.exe
sc stop "vmictimesync"
3⤵
PID:908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "vmicrdv"
2⤵
PID:2656

C:\Windows\system32\sc.exe
sc stop "vmicrdv"
3⤵
PID:1676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "vmicheartbeat"
2⤵
PID:1252

C:\Windows\system32\sc.exe
sc stop "vmicheartbeat"
3⤵
PID:896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "vmicshutdown"
2⤵
PID:832

C:\Windows\system32\sc.exe
sc stop "vmicshutdown"
3⤵
PID:940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "vmicguestinterface"
2⤵
PID:1192

C:\Windows\system32\sc.exe
sc stop "vmicguestinterface"
3⤵
PID:3772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "vmickvpexchange"
2⤵
PID:972

C:\Windows\system32\sc.exe
sc stop "vmickvpexchange"
3⤵
PID:1156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "SharedAccess"
2⤵
PID:1328

C:\Windows\system32\sc.exe
sc stop "SharedAccess"
3⤵
PID:2636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "SensrSvc"
2⤵
PID:2552

C:\Windows\system32\sc.exe
sc stop "SensrSvc"
3⤵
PID:492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "SensorDataService"
2⤵
PID:2004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "SensorService"
2⤵
PID:1980

C:\Windows\system32\sc.exe
sc stop "SensorService"
3⤵
PID:656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "SharedAccess"
2⤵
PID:3796

C:\Windows\system32\sc.exe
sc stop "SharedAccess"
3⤵
PID:648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "Spooler"
2⤵
PID:1996

C:\Windows\system32\sc.exe
sc stop "Spooler"
3⤵
PID:1512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "seclogon"
2⤵
PID:1152

C:\Windows\system32\sc.exe
sc stop "seclogon"
3⤵
PID:2888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "IEEtwCollectorService"
2⤵
PID:2044

C:\Windows\system32\sc.exe
sc stop "IEEtwCollectorService"
3⤵
PID:3516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "iphlpsvc"
2⤵
PID:388

C:\Windows\system32\sc.exe
sc stop "iphlpsvc"
3⤵
PID:3388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "MSiSCSI"
2⤵
PID:1900

C:\Windows\system32\sc.exe
sc stop "MSiSCSI"
3⤵
PID:2696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "NetTcpPortSharing"
2⤵
PID:532

C:\Windows\system32\sc.exe
sc stop "NetTcpPortSharing"
3⤵
PID:3420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "Netlogon"
2⤵
PID:888

C:\Windows\system32\sc.exe
sc stop "Netlogon"
3⤵
PID:2040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "napagent"
2⤵
PID:2972

C:\Windows\system32\sc.exe
sc stop "napagent"
3⤵
PID:2288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "Fax"
2⤵
PID:1096

C:\Windows\system32\sc.exe
sc stop "Fax"
3⤵
PID:2644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "CscService"
2⤵
PID:3228

C:\Windows\system32\sc.exe
sc stop "CscService"
3⤵
PID:1284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "PNRPsvc"
2⤵
PID:3728

C:\Windows\system32\sc.exe
sc stop "PNRPsvc"
3⤵
PID:3264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "p2pimsvc"
2⤵
PID:3028

C:\Windows\system32\sc.exe
sc stop "p2pimsvc"
3⤵
PID:3184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "RemoteAccess"
2⤵
PID:2648

C:\Windows\system32\sc.exe
sc stop "RemoteAccess"
3⤵
PID:2112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "RemoteRegistry"
2⤵
PID:828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop "oxNetApiSvc"
2⤵
PID:4064

C:\Windows\system32\sc.exe
sc stop "oxNetApiSvc"
3⤵
PID:3820

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x31c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\system32\netsh.exe
netsh int tcp set global dca=default
1⤵
PID:1020

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\c00c855d1b464fa7a103a8a0b57eac46 /t 2952 /p 1324
1⤵
PID:3948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
MD5
da129d33b86b4c065c0af72984a1a094

SHA1
0c3756eb023d8a112f4dd5654bab3f6bd8a7c9b3

SHA256
cae139c05a1a6ee6d023628e0ec2fdbbef73aa733dc57fd4a00d3c199c514925

SHA512
0e46e38cdaf37dfdc591400e923a2c0da8d9aa0294176eb2bf603fc9942c83530e5df08aeabfea16b26b1964aa5b695bcf165b952d3cd6bbad39f2f26d383d99

Download Submit
C:\Users\Admin\Desktop\Wizard Loader\Wizard Loader.exe
MD5
da129d33b86b4c065c0af72984a1a094

SHA1
0c3756eb023d8a112f4dd5654bab3f6bd8a7c9b3

SHA256
cae139c05a1a6ee6d023628e0ec2fdbbef73aa733dc57fd4a00d3c199c514925

SHA512
0e46e38cdaf37dfdc591400e923a2c0da8d9aa0294176eb2bf603fc9942c83530e5df08aeabfea16b26b1964aa5b695bcf165b952d3cd6bbad39f2f26d383d99

Download Submit
C:\Users\Admin\Desktop\Wizard Loader\libcurl.dll
MD5
7202856c8940b3dc999835fc497a5c83

SHA1
6c2bb4deb414f6dd0c263178d4a6c4c8605b6f5e

SHA256
7043a68f794aa0cca82fd8541c8ed6e27066050c3e13546534ebf69b071ff215

SHA512
4d6ccc549d971821d0fd6eeb9fa99f7bf2f11c54c1d90a1abdd7dd849719f0fa6a5e67bd07d24f51fe7962ee88b345a9a3e81f8aecb7289be60dce8a50999b6a

Download Submit
C:\Users\Admin\Desktop\Wizard Loader\zlib1.dll
MD5
b1542e5b5d1f80f860e400410ccfa4d6

SHA1
63cb92b50cfc108c8f4846c6f60f2d9ee7fd2a14

SHA256
07879bd38bc6cbd8634d8009d752363a35a19dae75cccf5ba92a3e8402c35a6c

SHA512
b017d4950e2f08edb541cdcef9f03fcda17f69bbbf28876392110bc4be24b476b03b04824346da57db758151248c14a57011a124f0868d0424618e6fdbd9aa73

Download Submit
C:\ping.txt
MD5
aba21ce32d078365505d1973ebb89287

SHA1
801824f0767f9c9b5fc863fcae627d97f781c5cd

SHA256
13c8fa29243bc3a2260a3d28fd55d473bde17e0bda1a8af321d5de3e9b982400

SHA512
88e5307e13d49da18aacef9d7e51cc66a71f63102452372de01ce237d75c7fea2ba5de8b556f2b52057a2f948a6805d7a363cd38d4aecf5356ad1580b5ed8413

Download Submit
C:\ping.txt
MD5
aba21ce32d078365505d1973ebb89287

SHA1
801824f0767f9c9b5fc863fcae627d97f781c5cd

SHA256
13c8fa29243bc3a2260a3d28fd55d473bde17e0bda1a8af321d5de3e9b982400

SHA512
88e5307e13d49da18aacef9d7e51cc66a71f63102452372de01ce237d75c7fea2ba5de8b556f2b52057a2f948a6805d7a363cd38d4aecf5356ad1580b5ed8413

Download Submit
C:\ping2.txt
MD5
8da479b0b3423cbc5e0b432c2927a76e

SHA1
0f4bbbc45cd65105d93ec46eff4604d9523f4018

SHA256
28c243f9e7a5c33c033746d158e1be00b8fec4137793e674e9fc244d93fb7aed

SHA512
b579ad4e7a514ed1ac09c6989f60cb54061a1d04bb7b17fac3a6d374a4e082f1e232553b4fc42f8661250c4b6c7382257ccbcb60b9b66e508254b30525d5115f

Download Submit
C:\ping2.txt
MD5
8da479b0b3423cbc5e0b432c2927a76e

SHA1
0f4bbbc45cd65105d93ec46eff4604d9523f4018

SHA256
28c243f9e7a5c33c033746d158e1be00b8fec4137793e674e9fc244d93fb7aed

SHA512
b579ad4e7a514ed1ac09c6989f60cb54061a1d04bb7b17fac3a6d374a4e082f1e232553b4fc42f8661250c4b6c7382257ccbcb60b9b66e508254b30525d5115f

Download Submit
\Users\Admin\Desktop\Wizard Loader\libcurl.dll
MD5
7202856c8940b3dc999835fc497a5c83

SHA1
6c2bb4deb414f6dd0c263178d4a6c4c8605b6f5e

SHA256
7043a68f794aa0cca82fd8541c8ed6e27066050c3e13546534ebf69b071ff215

SHA512
4d6ccc549d971821d0fd6eeb9fa99f7bf2f11c54c1d90a1abdd7dd849719f0fa6a5e67bd07d24f51fe7962ee88b345a9a3e81f8aecb7289be60dce8a50999b6a

Download Submit
\Users\Admin\Desktop\Wizard Loader\zlib1.dll
MD5
b1542e5b5d1f80f860e400410ccfa4d6

SHA1
63cb92b50cfc108c8f4846c6f60f2d9ee7fd2a14

SHA256
07879bd38bc6cbd8634d8009d752363a35a19dae75cccf5ba92a3e8402c35a6c

SHA512
b017d4950e2f08edb541cdcef9f03fcda17f69bbbf28876392110bc4be24b476b03b04824346da57db758151248c14a57011a124f0868d0424618e6fdbd9aa73

Download Submit
memory/1324-130-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp

Filesize
18.4MB

Download
memory/1324-131-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp

Filesize
18.4MB

Download
memory/1324-132-0x00007FF78F355000-0x00007FF78F357000-memory.dmp

Filesize
8KB

Download
memory/1324-133-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp

Filesize
18.4MB

Download
memory/1324-134-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp

Filesize
18.4MB

Download
memory/1324-135-0x0000020CF0820000-0x0000020CF0822000-memory.dmp

Filesize
8KB

Download
memory/1324-137-0x0000020CF0824000-0x0000020CF0825000-memory.dmp

Filesize
4KB

Download
memory/1324-136-0x0000020CF0822000-0x0000020CF0824000-memory.dmp

Filesize
8KB

Download
memory/1324-138-0x0000020CF0825000-0x0000020CF0827000-memory.dmp

Filesize
8KB

Download
memory/1324-129-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp

Filesize
18.4MB

Download
memory/1324-128-0x00007FF78F330000-0x00007FF7905A2000-memory.dmp

Filesize
18.4MB

Download
memory/1324-127-0x00007FF880030000-0x00007FF880031000-memory.dmp

Filesize
4KB

Download
memory/1324-126-0x00007FF880000000-0x00007FF880002000-memory.dmp

Filesize
8KB

Download