Analysis
-
max time kernel
415s -
max time network
427s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
25-05-2024 14:12
General
-
Target
Azurite Setup 1.1.12.exe
-
Size
111.3MB
-
MD5
4848ad03ab3dd1c09aaf5ace18a55f36
-
SHA1
f8f65216cdff313730ce23cb98d3302aad8b403b
-
SHA256
a570a7c27ab10595ae8d850ff72e02aa473a7f2b858603c963df513ebdf67227
-
SHA512
6d926a9674e0ea3130323e725289ea54c31c9e2be4745a8f407d32fe91cac8ca7ffa97d0c107de3d293c8aa990e44f901e322e342eb01d3e7968b880b2d026c3
-
SSDEEP
3145728:5gFkGgcymcNLCSBsFkGNnSjejR0XL4pPV:KCLCSmZn+V09
Score
9/10
Malware Config
Signatures
-
Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Deletes itself 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 3 IoCs
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 22 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry key 1 TTPs 64 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe"C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe"1⤵
- Drops desktop.ini file(s)
- Deletes itself
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=gpu-process --field-trial-handle=1572,13610510244591050683,10941352388437937473,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1580 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,13610510244591050683,10941352388437937473,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2036 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=renderer --field-trial-handle=1572,13610510244591050683,10941352388437937473,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\Azurite\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RmSvc2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RmSvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RmSvc /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\xinputhid\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\WUDFRd\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\WpdUpFltr\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vwififlt\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vwififlt\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vdrvroot\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vdrvroot\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBXHCI\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBXHCI\Parameters /v DmaRemappingCompatible2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBXHCI\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBHUB3\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBHUB3\Parameters /v DmaRemappingCompatible2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\umbus\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\umbus\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\storahci\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\storahci\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\storahci\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\stornvme\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\stornvme\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\stornvme\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisVirtualBus\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisVirtualBus\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\msisadrv\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\msisadrv\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\mouhid\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\mouhid\Parameters /v DmaRemappingCompatible2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\monitor\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\monitor\Parameters /v DmaRemappingCompatible2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\intelpep\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\intelpep\Parameters /v DmaRemappingCompatible2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\CompositeBus\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\CompositeBus\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicRender\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicRender\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicDisplay\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicDisplay\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpipagr\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpi\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpi\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\partmgr\Parameters2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\partmgr\Parameters /v DmaRemappingCompatible2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\xinputhid\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\pci\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\pci\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\pci\Parameters /v DmaRemappingCompatible2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\HDAudBus\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\HDAudBus\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisWan\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisWan\Parameters /v DmaRemappingCompatible2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbhid\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbdclass\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbdclass\Parameters /v DmaRemappingCompatible2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\intellppm\Parameters2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v DontSendAdditionalData2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v LoggingDisabled2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultOverrideBehavior2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultConsent2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultConsent2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\FindMyDevice2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\FindMyDevice2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo /v Enabled2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo /v Enabled2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v MaintenanceDisabled2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v MaintenanceDisabled2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\GraphicsDrivers2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\GraphicsDrivers /v HwSchedMode2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications /v GlobalUserDisabled2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Search2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Search /v BackgroundAppGlobalToggle2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack /v ShowedToastAtLevel2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack /v ShowedToastAtLevel2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v AllowTelemetry2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v MaxTelemetryAllowed2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInstrumentation2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications /v NoTileApplicationNotification2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications /v NoTileApplicationNotification2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\Power\PowerThrottling2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced /v Start_TrackProgs2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced /v Start_TrackProgs2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\International\User Profile"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\International\User Profile" /v HttpAcceptLanguageOptOut2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Personalization2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Speech2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\Explorer2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\Explorer /v NoRemoteDestinations2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy /v TailoredExperiencesWithDiagnosticDataEnabled2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy /v TailoredExperiencesWithDiagnosticDataEnabled2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Search2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\InputPersonalization2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\InputPersonalization2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\DataCollection2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\DataCollection /v LimitEnhancedDiagnosticDataWindowsAnalytics2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Maps2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Maps2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\TabletPC2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\TabletPC /v PreventHandwritingDataSharing2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\TabletPC /v PreventHandwritingDataSharing2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows\Windows Search"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v ConnectedSearchUseWeb2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows\Windows Search"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v DisableWebSearch2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v DoNotShowFeedbackNotifications2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppPrivacy2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v DisableExceptionChainValidation2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v KernelSEHOPEnabled2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NoLazyMode2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v NoLazyMode2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Internet Explorer\SQM"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableCfg2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePageCombining2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnablePrefetcher2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableSuperfetch2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\FTH2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\FTH /v Enabled2⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\FTH /v Enabled2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AJRouter2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AJRouter /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AJRouter /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppReadiness2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppReadiness /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppReadiness /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppVClient2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppVClient /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppVClient /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagsvc2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagsvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagsvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\embeddedmode2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\embeddedmode /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\embeddedmode /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\EntAppSvc2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\EntAppSvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\EntAppSvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.02⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\NaturalAuthentication2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\NaturalAuthentication /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\NaturalAuthentication /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ScDeviceEnum2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ScDeviceEnum /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ScDeviceEnum /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SEMgrSvc2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SEMgrSvc /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SEMgrSvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorDataService2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorDataService /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorDataService /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorService2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorService /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorService /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv /v Start2⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SgrmBroker2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SgrmBroker /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SgrmBroker /v Start2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\tzautoupdate2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\tzautoupdate /v Start2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\tzautoupdate /v Start2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop" /v AutoEndTasks2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop" /v AutoEndTasks2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM /v Composition2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM /v Composition2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Latency Sensitive"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Background Only"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Background Only"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\mouclass\Parameters2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize2⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Psched2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\Tcpip\QoS2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Before Azurite Optimization' -RestorePointType 'MODIFY_SETTINGS'""2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Before Azurite Optimization' -RestorePointType 'MODIFY_SETTINGS'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RmSvc /v Start /t REG_DWORD /d 3 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\xinputhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\WUDFRd\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\WpdUpFltr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\vwififlt\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\vdrvroot\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\USBXHCI\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\USBHUB3\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\umbus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\storahci\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\stornvme\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\NdisVirtualBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\msisadrv\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\mouhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\monitor\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\intelpep\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\CompositeBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\BasicRender\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\BasicDisplay\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\acpipagr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\acpi\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\partmgr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\xinputhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\pci\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\HDAudBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\NdisWan\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\kbhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\kbdclass\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\intellppm\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v DontSendAdditionalData /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v LoggingDisabled /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultOverrideBehavior /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultConsent /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main /v AllowPrelaunch /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\FindMyDevice /v AllowFindMyDevice /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\FindMyDevice /v LocationSyncEnabled /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo /v Enabled /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v MaintenanceDisabled /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\GraphicsDrivers /v HwSchedMode /t REG_DWORD /d 2 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications /v GlobalUserDisabled /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Search /v BackgroundAppGlobalToggle /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack /v ShowedToastAtLevel /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v AllowTelemetry /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v MaxTelemetryAllowed /t REG_DWORD /d 0 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInstrumentation /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications /v NoTileApplicationNotification /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\Power\PowerThrottling /v PowerThrottlingOff /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced /v Start_TrackProgs /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Control Panel\International\User Profile" /v HttpAcceptLanguageOptOut /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Personalization /v NoLockScreenCamera /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v DisableInventory /t REG_DWORD /d 1 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v DisableUAR /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Speech /v AllowSpeechModelUpdate /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Policies\Microsoft\Windows\Explorer /v NoRemoteDestinations /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy /v TailoredExperiencesWithDiagnosticDataEnabled /t REG_DWORD /d 0 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Search /v BingSearchEnabled /t REG_DWORD /d 0 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\InputPersonalization /v RestrictImplicitInkCollection /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\InputPersonalization /v RestrictImplicitTextCollection /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo /v DisabledByGroupPolicy /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\DataCollection /v LimitEnhancedDiagnosticDataWindowsAnalytics /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Maps /v AutoDownloadAndUpdateMapData /t REG_DWORD /d 0 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Maps /v AllowUntriggeredNetworkTrafficOnSettingsPage /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\TabletPC /v PreventHandwritingDataSharing /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v AITEnable /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v ConnectedSearchUseWeb /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v DisableWebSearch /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation /t REG_DWORD /d 38 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppPrivacy /v LetAppsRunInBackground /t REG_DWORD /d 2 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v KernelSEHOPEnabled /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex /t REG_DWORD /d 10 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness /t REG_DWORD /d 10 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NoLazyMode /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v NoLazyMode /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Internet Explorer\SQM" /v DisableCustomerImprovementProgram /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableCfg /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePageCombining /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnablePrefetcher /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableSuperfetch /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\FTH /v Enabled /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AJRouter /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ALG /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppMgmt /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppReadiness /v Start /t REG_DWORD /d 3 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppVClient /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\defragsvc /v Start /t REG_DWORD /d 4 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\diagsvc /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\embeddedmode /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\EntAppSvc /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\FontCache /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\LanmanServer /v Start /t REG_DWORD /d 4 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\NaturalAuthentication /v Start /t REG_DWORD /d 4 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start /t REG_DWORD /d 4 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\p2psvc /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\PcaSvc /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\QWAVE /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RpcLocator /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SCardSvr /v Start /t REG_DWORD /d 4 /f2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ScDeviceEnum /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SEMgrSvc /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensorDataService /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensorService /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensrSvc /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SessionEnv /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SgrmBroker /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SharedAccess /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\tzautoupdate /v Start /t REG_DWORD /d 4 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout /t REG_SZ /d 2000 /f2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Control Panel\Desktop" /v AutoEndTasks /t REG_SZ /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\DWM /v Composition /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Latency Sensitive" /t REG_SZ /d True /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Background Only" /t REG_SZ /d False /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\mouclass\Parameters /v MouseDataQueueSize /t REG_DWORD /d 50 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize /t REG_DWORD /d 50 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Psched /v TimerResolution /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\Tcpip\QoS /v "Do not use NLA" /t REG_DWORD /d 1 /f2⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v EnableMulticast /t REG_DWORD /d 0 /f2⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set useplatformtick yes2⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue useplatformclock >nul 2>nul2⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set disabledynamictick Yes2⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set hypervisorlaunchtype off2⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set bootmenupolicy Legacy2⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\59301783.bat2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get TotalVisibleMemorySize /format:value3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic os get TotalVisibleMemorySize /format:value4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d "5217772" /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum" /s /f "StorPort"| findstr "StorPort"3⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum" /s /f "StorPort"4⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\findstr.exefindstr "StorPort"4⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\PCI\VEN_8086&DEV_2922&SUBSYS_11001AF4&REV_02\3&11583659&0&10\Device Parameters\StorPort" /v "EnableIdlePowerManagement" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\PCI\VEN_8086&DEV_2922&SUBSYS_11001AF4&REV_02\3&11583659&0&FA\Device Parameters\StorPort" /v "EnableIdlePowerManagement" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\{8e7bd593-6e6c-4c52-86a6-77175494dd8e}\MsVhdHba\1&3030e83&0&01\Device Parameters\StorPort" /v "EnableIdlePowerManagement" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic PATH Win32_PnPEntity GET DeviceID | findstr "USB\VID_"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_PnPEntity GET DeviceID4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\findstr.exefindstr "USB\VID_"4⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "EnhancedPowerManagementEnabled" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "AllowIdleIrpInD3" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "EnableSelectiveSuspend" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "DeviceSelectiveSuspended" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "SelectiveSuspendEnabled" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "SelectiveSuspendOn" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "D3ColdSupported" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path win32_networkadapter get GUID | findstr "{"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_networkadapter get GUID4⤵
-
C:\Windows\system32\findstr.exefindstr "{"4⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{0389DF46-D495-4DB7-AF8D-FBD3D0A863AB}" /v "TcpAckFrequency" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{0389DF46-D495-4DB7-AF8D-FBD3D0A863AB}" /v "TcpDelAckTicks" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{0389DF46-D495-4DB7-AF8D-FBD3D0A863AB}" /v "TCPNoDelay" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\netsh.exenetsh int tcp set heuristics disabled3⤵
-
C:\Windows\system32\netsh.exenetsh int tcp set supplemental Internet congestionprovider=ctcp3⤵
-
C:\Windows\system32\netsh.exenetsh int tcp set global timestamps=disabled3⤵
-
C:\Windows\system32\netsh.exenetsh int tcp set global rsc=disabled3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible | find /i "Services\"3⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible4⤵
- Maps connected drives based on registry
-
C:\Windows\system32\find.exefind /i "Services\"4⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ACPI\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpipagr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BasicDisplay\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BasicRender\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CompositeBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HDAudBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intellppm\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intelpep\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\monitor\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msisadrv\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisVirtualBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\partmgr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storahci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\umbus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Usb4HostRouter\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBHUB3\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBXHCI\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdrvroot\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwififlt\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpdUpFltr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WUDFRd\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xinputhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f3⤵
-
C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=gpu-process --field-trial-handle=1572,13610510244591050683,10941352388437937473,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3240 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\powercfg.exepowercfg /import C:\Users\Admin\AppData\Local\Temp\80034925.pow 33333333-3333-3333-3333-3333333333332⤵
-
C:\Windows\system32\powercfg.exepowercfg /setactive 33333333-3333-3333-3333-3333333333332⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}1⤵
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Programs\Azurite\D3DCompiler_47.dllFilesize
4.3MB
MD57641e39b7da4077084d2afe7c31032e0
SHA12256644f69435ff2fee76deb04d918083960d1eb
SHA25644422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA5128010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
-
C:\Users\Admin\AppData\Local\Programs\Azurite\chrome_100_percent.pakFilesize
138KB
MD503aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA256c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
SHA512c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9
-
C:\Users\Admin\AppData\Local\Programs\Azurite\chrome_200_percent.pakFilesize
202KB
MD57d4f330a5443eadf32e041c63e7e70ad
SHA126ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA256b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
SHA512f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d
-
C:\Users\Admin\AppData\Local\Programs\Azurite\ffmpeg.dllFilesize
2.6MB
MD5af6d3e25c626882b0c6be5a1e662a88d
SHA1a00b6b71d94ed200ffa44d730efe48cd63148153
SHA2563615f62c7495308038c2659c266fb144c813fbd44a535111ce10ae47b0996ada
SHA51254da008ccaf5646479f16a302e0e8d0346ef750ea39565b5b453f205e49ec10f91eb43fc1e826d278519ac48ead943925906e5015b817d235307a6c5a716274e
-
C:\Users\Admin\AppData\Local\Programs\Azurite\icudtl.datFilesize
9.9MB
MD580a7528515595d8b0bf99a477a7eff0d
SHA1fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA2566e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
SHA512c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459
-
C:\Users\Admin\AppData\Local\Programs\Azurite\locales\en-US.pakFilesize
88KB
MD5af5c77e1d94dc4f772cb641bd310bc87
SHA10ceeb456e2601e22d873250bcc713bab573f2247
SHA256781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
SHA5128c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c
-
C:\Users\Admin\AppData\Local\Programs\Azurite\resources.pakFilesize
4.9MB
MD5d22a5445f36b9ffaafc235e56ae90456
SHA1c6acefdf31e440c71ff830eb9150efe69775ec63
SHA2567b94d96c56df3635cd72eac4f970fe3b2df97749427a4e7986612d86aae4b6a8
SHA512dec6c599ed1045c962a4bd52904eace69c0d323ee68e4ed67b56185ea36712fa4ccf138e7f9552f6483c9c62d5d63e98cbd61b1a0c84a4e6f5f625bc58463673
-
C:\Users\Admin\AppData\Local\Programs\Azurite\resources\app-update.ymlFilesize
131B
MD5a454c573d0c72b4122d074a4048f8a22
SHA1ce06018b60adf940f42401c8e311fc5d27619d90
SHA256d82261f6161e06ac8b48bfd619acc1a0eaefc63270d4e4a1155a255d2b0e6eff
SHA51256a06b34547a19be4d569c780770eb43d19f5a2ef55c62f98a00d372e7c02865265ccb35a1c5f5a82b48c279516c55c07b0b4b6ea2d858be7f131391dd76d495
-
C:\Users\Admin\AppData\Local\Programs\Azurite\resources\app.asarFilesize
4.9MB
MD5f0283a70e4e77c72999016a2cc033172
SHA148f2207f9363faf63d3a6f2ac16ed2cf8022f8ab
SHA256e0f0acdba0caa085dac0c2432a97670f88c4deaeded715e2e9452b03400d592f
SHA5125f73110a134f02e71c84d6d8da4c9aa5c572adec5bbe40255b30b9a37d2818064261c8a57b76c8da7efbfbced061066d53437a66197c9caaa0dcd90c1b60bddc
-
C:\Users\Admin\AppData\Local\Programs\Azurite\swiftshader\libEGL.dllFilesize
448KB
MD508d67d57bdb9efa1c6652bab4f68a7fb
SHA19b8f156a069f4f40e0fdded92aa1c6f3606101b3
SHA25633adfdf885f4a64e5792d591bb35ddf5f8b15feeacbcf1539c50a614d168abf5
SHA512b9972e81eb5a7b4dba758686d6d2962639ad0e7b0c3c6df328f0eb5d1e4b06f4fcf0135c01908bf2d583be4606cdd028485977853c62285e216f07e695e601e9
-
C:\Users\Admin\AppData\Local\Programs\Azurite\swiftshader\libGLESv2.dllFilesize
3.1MB
MD59089a52d103849175b1ed9b5a469a782
SHA190eb9c2536f801920551c4b2c70fd318223308d1
SHA25647092d9bfd855fcfb613741580ac742ce521567509929daab5574a71f83a2801
SHA512553d85f8ffbccd10c324d58d1b3f5479f039cb50cfda49a891f35c13462a59160c29c96a43aa48725c6e5fa6773f84fa684f9e4add4d250fd14c09d451ff19fa
-
C:\Users\Admin\AppData\Local\Programs\Azurite\v8_context_snapshot.binFilesize
161KB
MD5e082a9ffd52e98b00e501e934a7e9d8d
SHA121746f70466633f881581d9bee651619d8b4b109
SHA25608058ff9086099965041d0e85e8847704c624baf689ec3bb6a041e7776332520
SHA5125b6a6f58a9037c260b1b76bb7605746c251641e20153b5e75d99f4b4afb1367a7a44ba255034c9090e7c48748402a6e0bad13da2c4c3e8b7b88bd1d80898fd3b
-
C:\Users\Admin\AppData\Local\Temp\0ccc040d-e8d3-405a-9b80-ec8621d1df03.tmp.powFilesize
24KB
MD5f81191582f273b07e50ea9ac1818dfdd
SHA1e9d762bed0cfe1219854c2b1d5948f050458d426
SHA25615828be7fca345b210fe3cde9eded3a2e12238580335e927952f85bae480db28
SHA512954eb770bb4425cea2e24b56ced7acd70d5df7b219d5597ee101630f071fbc9a976b30e9ef8bcc375f2306dea7ad441dd5f4e15f450ddd313e6561963ac68271
-
C:\Users\Admin\AppData\Local\Temp\59301783.batFilesize
2KB
MD5b96aac30465cba9e3cc089c3ef5c7df6
SHA16858ce127c45a1eddb6ccbffcb290b6c650016a8
SHA2561afa7f9a0ea79a193e10a096f5eafffb687e07ecbe5cabdc716b700ff6c97b63
SHA51256d7d549394cbcfe4edefa914e99c457346737b96e63659271e95ac73b75a00fb9bb6352f335c79ea0c220583dc65c49249e236b646458397108fd2c36eb1202
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xrksmrca.wlj.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\nsg6FA3.tmp\StdUtils.dllFilesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
C:\Users\Admin\AppData\Local\Temp\nsg6FA3.tmp\System.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
C:\Users\Admin\AppData\Local\Temp\nsg6FA3.tmp\UAC.dllFilesize
14KB
MD5adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
C:\Users\Admin\AppData\Local\Temp\nsg6FA3.tmp\WinShell.dllFilesize
3KB
MD51cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
C:\Users\Admin\AppData\Local\Temp\nsg6FA3.tmp\nsDialogs.dllFilesize
9KB
MD5466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1eb607467009074278e4bd50c7eab400e95ae48f7
SHA2561e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
SHA5127508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
-
C:\Users\Admin\AppData\Local\Temp\nsg6FA3.tmp\nsProcess.dllFilesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
C:\Users\Admin\AppData\Local\Temp\nsg6FA3.tmp\nsis7z.dllFilesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\azurite\Network Persistent StateFilesize
183B
MD5529f66a7edc36ae980c6f714dcbf5942
SHA188dee8c1e4ef93cd45372461b091d0f89687bb11
SHA25618bd7a16f541035715e427465e0be82e3622ef0f51360e6ef084da2535a4f7cc
SHA512c9ea591230f4b48e98539eb473f80c171420bf578df806114752e333ea08b82c02c1b7059e83a35ff4b01400912d39704e32895716616db1a440d6e8a64652e5
-
C:\Users\Admin\AppData\Roaming\azurite\Network Persistent State~RFe5bf029.TMPFilesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Roaming\azurite\PreferencesFilesize
57B
MD558127c59cb9e1da127904c341d15372b
SHA162445484661d8036ce9788baeaba31d204e9a5fc
SHA256be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA5128d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
-
C:\Users\Admin\AppData\Roaming\azurite\Preferences~RFe5b076f.TMPFilesize
86B
MD5d11dedf80b85d8d9be3fec6bb292f64b
SHA1aab8783454819cd66ddf7871e887abdba138aef3
SHA2568029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
SHA5126b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0
-
C:\Users\Admin\AppData\Roaming\azurite\logs\main.logFilesize
4KB
MD5475c945ecc824dd8987f7d0245b94a54
SHA1b287f3f6ac32001dd0182cf5f589b65770843a7a
SHA256aaac88c3844f39796d2669e29cd446a22041c5e239a58bf681842af45c3c6ef6
SHA5127a14b469a112ed83d7bb8802cd0c43340fb2e7e13a2411dc2b46aebca9e9203cae3bc0ce85db3cd6e9c4f02a90d325e1b14066c25f6df21821848160df9770bb
-
memory/1448-677-0x000002B027300000-0x000002B027322000-memory.dmpFilesize
136KB
-
memory/1800-239-0x00007FFDF99C0000-0x00007FFDF99C1000-memory.dmpFilesize
4KB