6273033dde31d56147096d50f235da716b49878064b94a338f0b8c9d9bd67546

Analysis

max time kernel
134s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/06/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tools/CoutX.bat
Size

61KB
MD5

9d9de233b39212edd52f376bdabc2b9c
SHA1

0f0ae692ec22867fbf4ee600efa7a9169f52ea28
SHA256

f783d2390ba2b2755c6b2467630d1d2703920cb4d42d34fb789fac9789e7bd18
SHA512

71c5e21745cc30f9cc6720cc9049415a8c8495487f7a9d26717ef6b56b49028f7d80ae1f175762e1ed3382fb6df6ae43f843d7cd1d164dbb7a4a25b677205293
SSDEEP

768:xGLTOwOkZ6DWMpLcKwtNh60aLIKoPw5PuE3MfFzL2IuGQIGQObWszHPjHv7gBOBF:YacKwXsIKoCuEFC0WszHPbv72+

Score

9^/10

defense_evasion evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4732	bcdedit.exe
1400	bcdedit.exe
1248	bcdedit.exe
588	bcdedit.exe
4412	bcdedit.exe
1020	bcdedit.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe\AuditLevel = "8"	reg.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Boot or Logon Autostart Execution: LSASS Driver 1 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence

LSASS Driver

T1547.008

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "1"	reg.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe

Power Settings 1 TTPs 30 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2196	powercfg.exe
5108	powercfg.exe
1276	powercfg.exe
5020	powercfg.exe
428	powercfg.exe
2172	powercfg.exe
8	powercfg.exe
4088	powercfg.exe
376	powercfg.exe
4600	powercfg.exe
4112	powercfg.exe
4496	powercfg.exe
816	powercfg.exe
3224	powercfg.exe
976	powercfg.exe
512	powercfg.exe
3320	powercfg.exe
4736	powercfg.exe
2504	powercfg.exe
4944	powercfg.exe
4952	powercfg.exe
4636	powercfg.exe
3852	reg.exe
1984	powercfg.exe
4528	powercfg.exe
1428	powercfg.exe
4184	powercfg.exe
5016	powercfg.exe
3044	powercfg.exe
4172	powercfg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	explorer.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\4032412167\4002656488.pri	explorer.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1948	powershell.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2992	sc.exe
3440	sc.exe
5068	sc.exe
2384	sc.exe
1896	sc.exe
3356	sc.exe
2380	sc.exe
3964	sc.exe
976	sc.exe
2556	sc.exe
4592	sc.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
4108	reg.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 39 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4860	ipconfig.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
1872	taskkill.exe
1180	taskkill.exe
2336	taskkill.exe
2632	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\System\GameConfigStore	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\System\GameConfigStore\Children	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\System\GameConfigStore\Parents	reg.exe

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt\shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80706004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000dc072747eec9da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80706004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c00000000000000000000000060baf946eec9da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000003631b1288a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt\shell\open\command	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567065867241975"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchUI.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe

Modifies registry key 1 TTPs 29 IoCs

Modify Registry

T1112

pid	Process
4180	reg.exe
2556	reg.exe
4948	reg.exe
3364	reg.exe
4928	reg.exe
2312	reg.exe
4188	reg.exe
5076	reg.exe
4940	reg.exe
4700	reg.exe
2068	reg.exe
4956	reg.exe
4528	reg.exe
4600	reg.exe
1796	reg.exe
3800	reg.exe
4400	reg.exe
4256	reg.exe
4240	reg.exe
692	reg.exe
3312	reg.exe
4264	reg.exe
824	reg.exe
5056	reg.exe
1084	reg.exe
4652	reg.exe
2928	reg.exe
2348	reg.exe
2504	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1948	WMIC.exe
Token: SeSecurityPrivilege	1948	WMIC.exe
Token: SeTakeOwnershipPrivilege	1948	WMIC.exe
Token: SeLoadDriverPrivilege	1948	WMIC.exe
Token: SeSystemProfilePrivilege	1948	WMIC.exe
Token: SeSystemtimePrivilege	1948	WMIC.exe
Token: SeProfSingleProcessPrivilege	1948	WMIC.exe
Token: SeIncBasePriorityPrivilege	1948	WMIC.exe
Token: SeCreatePagefilePrivilege	1948	WMIC.exe
Token: SeBackupPrivilege	1948	WMIC.exe
Token: SeRestorePrivilege	1948	WMIC.exe
Token: SeShutdownPrivilege	1948	WMIC.exe
Token: SeDebugPrivilege	1948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1948	WMIC.exe
Token: SeRemoteShutdownPrivilege	1948	WMIC.exe
Token: SeUndockPrivilege	1948	WMIC.exe
Token: SeManageVolumePrivilege	1948	WMIC.exe
Token: 33	1948	WMIC.exe
Token: 34	1948	WMIC.exe
Token: 35	1948	WMIC.exe
Token: 36	1948	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1948	WMIC.exe
Token: SeSecurityPrivilege	1948	WMIC.exe
Token: SeTakeOwnershipPrivilege	1948	WMIC.exe
Token: SeLoadDriverPrivilege	1948	WMIC.exe
Token: SeSystemProfilePrivilege	1948	WMIC.exe
Token: SeSystemtimePrivilege	1948	WMIC.exe
Token: SeProfSingleProcessPrivilege	1948	WMIC.exe
Token: SeIncBasePriorityPrivilege	1948	WMIC.exe
Token: SeCreatePagefilePrivilege	1948	WMIC.exe
Token: SeBackupPrivilege	1948	WMIC.exe
Token: SeRestorePrivilege	1948	WMIC.exe
Token: SeShutdownPrivilege	1948	WMIC.exe
Token: SeDebugPrivilege	1948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1948	WMIC.exe
Token: SeRemoteShutdownPrivilege	1948	WMIC.exe
Token: SeUndockPrivilege	1948	WMIC.exe
Token: SeManageVolumePrivilege	1948	WMIC.exe
Token: 33	1948	WMIC.exe
Token: 34	1948	WMIC.exe
Token: 35	1948	WMIC.exe
Token: 36	1948	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3968	WMIC.exe
Token: SeSecurityPrivilege	3968	WMIC.exe
Token: SeTakeOwnershipPrivilege	3968	WMIC.exe
Token: SeLoadDriverPrivilege	3968	WMIC.exe
Token: SeSystemProfilePrivilege	3968	WMIC.exe
Token: SeSystemtimePrivilege	3968	WMIC.exe
Token: SeProfSingleProcessPrivilege	3968	WMIC.exe
Token: SeIncBasePriorityPrivilege	3968	WMIC.exe
Token: SeCreatePagefilePrivilege	3968	WMIC.exe
Token: SeBackupPrivilege	3968	WMIC.exe
Token: SeRestorePrivilege	3968	WMIC.exe
Token: SeShutdownPrivilege	3968	WMIC.exe
Token: SeDebugPrivilege	3968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3968	WMIC.exe
Token: SeRemoteShutdownPrivilege	3968	WMIC.exe
Token: SeUndockPrivilege	3968	WMIC.exe
Token: SeManageVolumePrivilege	3968	WMIC.exe
Token: 33	3968	WMIC.exe
Token: 34	3968	WMIC.exe
Token: 35	3968	WMIC.exe
Token: 36	3968	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3968	WMIC.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe

Suspicious use of SendNotifyMessage 23 IoCs

pid	Process
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe
360	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4236	SearchUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 4596	2324	cmd.exe	74
PID 2324 wrote to memory of 4596	2324	cmd.exe	74
PID 2324 wrote to memory of 1772	2324	cmd.exe	75
PID 2324 wrote to memory of 1772	2324	cmd.exe	75
PID 1772 wrote to memory of 1948	1772	cmd.exe	76
PID 1772 wrote to memory of 1948	1772	cmd.exe	76
PID 2324 wrote to memory of 1020	2324	cmd.exe	78
PID 2324 wrote to memory of 1020	2324	cmd.exe	78
PID 2324 wrote to memory of 1940	2324	cmd.exe	79
PID 2324 wrote to memory of 1940	2324	cmd.exe	79
PID 2324 wrote to memory of 4472	2324	cmd.exe	80
PID 2324 wrote to memory of 4472	2324	cmd.exe	80
PID 2324 wrote to memory of 5080	2324	cmd.exe	81
PID 2324 wrote to memory of 5080	2324	cmd.exe	81
PID 2324 wrote to memory of 216	2324	cmd.exe	82
PID 2324 wrote to memory of 216	2324	cmd.exe	82
PID 2324 wrote to memory of 648	2324	cmd.exe	83
PID 2324 wrote to memory of 648	2324	cmd.exe	83
PID 2324 wrote to memory of 1416	2324	cmd.exe	84
PID 2324 wrote to memory of 1416	2324	cmd.exe	84
PID 2324 wrote to memory of 2912	2324	cmd.exe	85
PID 2324 wrote to memory of 2912	2324	cmd.exe	85
PID 2324 wrote to memory of 2580	2324	cmd.exe	86
PID 2324 wrote to memory of 2580	2324	cmd.exe	86
PID 2324 wrote to memory of 3008	2324	cmd.exe	87
PID 2324 wrote to memory of 3008	2324	cmd.exe	87
PID 2324 wrote to memory of 4088	2324	cmd.exe	88
PID 2324 wrote to memory of 4088	2324	cmd.exe	88
PID 2324 wrote to memory of 3564	2324	cmd.exe	89
PID 2324 wrote to memory of 3564	2324	cmd.exe	89
PID 2324 wrote to memory of 3508	2324	cmd.exe	90
PID 2324 wrote to memory of 3508	2324	cmd.exe	90
PID 2324 wrote to memory of 3492	2324	cmd.exe	91
PID 2324 wrote to memory of 3492	2324	cmd.exe	91
PID 2324 wrote to memory of 2660	2324	cmd.exe	92
PID 2324 wrote to memory of 2660	2324	cmd.exe	92
PID 2324 wrote to memory of 2004	2324	cmd.exe	93
PID 2324 wrote to memory of 2004	2324	cmd.exe	93
PID 2324 wrote to memory of 1596	2324	cmd.exe	94
PID 2324 wrote to memory of 1596	2324	cmd.exe	94
PID 2324 wrote to memory of 3312	2324	cmd.exe	95
PID 2324 wrote to memory of 3312	2324	cmd.exe	95
PID 2324 wrote to memory of 2556	2324	cmd.exe	96
PID 2324 wrote to memory of 2556	2324	cmd.exe	96
PID 2324 wrote to memory of 4400	2324	cmd.exe	97
PID 2324 wrote to memory of 4400	2324	cmd.exe	97
PID 2324 wrote to memory of 2928	2324	cmd.exe	98
PID 2324 wrote to memory of 2928	2324	cmd.exe	98
PID 2324 wrote to memory of 4948	2324	cmd.exe	99
PID 2324 wrote to memory of 4948	2324	cmd.exe	99
PID 2324 wrote to memory of 4600	2324	cmd.exe	100
PID 2324 wrote to memory of 4600	2324	cmd.exe	100
PID 2324 wrote to memory of 2068	2324	cmd.exe	101
PID 2324 wrote to memory of 2068	2324	cmd.exe	101
PID 2324 wrote to memory of 4264	2324	cmd.exe	102
PID 2324 wrote to memory of 4264	2324	cmd.exe	102
PID 2324 wrote to memory of 3364	2324	cmd.exe	103
PID 2324 wrote to memory of 3364	2324	cmd.exe	103
PID 2324 wrote to memory of 4188	2324	cmd.exe	104
PID 2324 wrote to memory of 4188	2324	cmd.exe	104
PID 2324 wrote to memory of 4256	2324	cmd.exe	105
PID 2324 wrote to memory of 4256	2324	cmd.exe	105
PID 2324 wrote to memory of 4180	2324	cmd.exe	106
PID 2324 wrote to memory of 4180	2324	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tools\CoutX.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\system32\Dism.exe
  dism
  2⤵
  - Drops file in Windows directory
  PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_VideoController get VideoProcessor /value
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_VideoController get VideoProcessor /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo SeaBIOS VBE(C) 2011 "
  2⤵
  PID:1020
- C:\Windows\system32\find.exe
  find /I "GeForce"
  2⤵
  PID:1940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo SeaBIOS VBE(C) 2011 "
  2⤵
  PID:4472
- C:\Windows\system32\find.exe
  find /I "NVIDIA"
  2⤵
  PID:5080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo SeaBIOS VBE(C) 2011 "
  2⤵
  PID:216
- C:\Windows\system32\find.exe
  find /I "RTX"
  2⤵
  PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo SeaBIOS VBE(C) 2011 "
  2⤵
  PID:1416
- C:\Windows\system32\find.exe
  find /I "GTX"
  2⤵
  PID:2912
- C:\Windows\system32\reg.exe
  Reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "DisplayParameters" /t REG_DWORD /d "1" /f
  2⤵
  PID:2580
- C:\Windows\system32\reg.exe
  Reg delete "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /v "__COMPAT_LAYER" /f
  2⤵
  PID:3008
- C:\Windows\system32\reg.exe
  Reg delete "HKCU\System\GameConfigStore" /v "GameDVR_FSEBehavior" /f
  2⤵
  PID:4088
- C:\Windows\system32\reg.exe
  Reg delete "HKCU\System\GameConfigStore" /v "GameDVR_DSEBehavior" /f
  2⤵
  PID:3564
- C:\Windows\system32\reg.exe
  Reg delete "HKLM\System\GameConfigStore" /f
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  Reg delete "HKU\.Default\System\GameConfigStore" /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:3492
- C:\Windows\system32\reg.exe
  Reg delete "HKU\S-1-5-19\System\GameConfigStore" /f
  2⤵
  PID:2660
- C:\Windows\system32\reg.exe
  Reg delete "HKU\S-1-5-20\System\GameConfigStore" /f
  2⤵
  PID:2004
- C:\Windows\system32\reg.exe
  Reg delete "HKCU\Software\Classes\System\GameConfigStore" /f
  2⤵
  PID:1596
- C:\Windows\system32\reg.exe
  Reg add HKCU\System\GameConfigStore /v GameDVR_Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:3312
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Policies\Microsoft\Windows\GameDVR /v AllowGameDVR /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:2556
- C:\Windows\system32\reg.exe
  Reg add HKLM\Software\Microsoft\PolicyManager\default\ApplicationManagement\AllowGameDVR /v value /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4400
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v AppCaptureEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:2928
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v AudioCaptureEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4948
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v CursorCaptureEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4600
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v MicrophoneCaptureEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:2068
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v HistoricalCaptureEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4264
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\GameBar /v UseNexusForGameBarEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:3364
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\GameBar /v GamepadDoublePressIntervalMs /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4188
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\GameBar /v ShowStartupPanel /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4256
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\GameBar /v GamePanelStartupTipIndex /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4180
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter" /v "ActivationType" /t REG_DWORD /d "0" /f
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  Reg add HKCU\System\GameConfigStore /v GameDVR_FSEBehaviorMode /t REG_DWORD /d 2 /f
  2⤵
  - Modifies registry key
  PID:4240
- C:\Windows\system32\reg.exe
  Reg add HKCU\System\GameConfigStore /v GameDVR_EFSEFeatureFlags /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:2348
- C:\Windows\system32\reg.exe
  Reg add HKCU\System\GameConfigStore /v GameDVR_DXGIHonorFSEWindowsCompatible /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:5076
- C:\Windows\system32\reg.exe
  Reg add HKCU\System\GameConfigStore /v GameDVR_HonorUserFSEBehaviorMode /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings" 2>nul | Find "REG_SZ"
  2⤵
  PID:352
- - C:\Windows\system32\reg.exe
    Reg query "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings"
    3⤵
    PID:3888
- - C:\Windows\system32\find.exe
    Find "REG_SZ"
    3⤵
    PID:4652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "
  2⤵
  PID:2312
- C:\Windows\system32\find.exe
  Find /I "VRROptimizeEnable"
  2⤵
  PID:2352
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings" /t REG_SZ /d "VRROptimizeEnable=1;" /f
  2⤵
  PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings" 2>nul | Find "REG_SZ"
  2⤵
  PID:1012
- - C:\Windows\system32\reg.exe
    Reg query "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings"
    3⤵
    PID:4700
- - C:\Windows\system32\find.exe
    Find "REG_SZ"
    3⤵
    PID:3976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo VRROptimizeEnable=1; "
  2⤵
  PID:3724
- C:\Windows\system32\find.exe
  Find /I "SwapEffectUpgradeEnable"
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings" /t REG_SZ /d "VRROptimizeEnable=1;SwapEffectUpgradeEnable=1;" /f
  2⤵
  PID:2852
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\DirectX\GraphicsSettings /v SwapEffectUpgradeCache /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKLM\System\CurrentControlSet\Control\Class" /v "VgaCompatible" /s 2>nul | findstr "HKEY"
  2⤵
  PID:2828
- - C:\Windows\system32\reg.exe
    Reg query "HKLM\System\CurrentControlSet\Control\Class" /v "VgaCompatible" /s
    3⤵
    PID:4356
- - C:\Windows\system32\findstr.exe
    findstr "HKEY"
    3⤵
    PID:4920
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\GraphicsDrivers" /v "HwSchMode" /t REG_DWORD /d "2" /f
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\GraphicsDrivers" /v "HwSchMode" /t REG_DWORD /d "2" /f
  2⤵
  PID:1388
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\GraphicsDrivers" /v "HwSchMode" /t REG_DWORD /d "2" /f
  2⤵
  PID:3856
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /t REG_DWORD /d "3" /f
  2⤵
  PID:4276
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /f /v "UserPreferencesMask" /t REG_BINARY /d "9012078012000000"
  2⤵
  PID:2632
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "DragFullWindows" /t REG_SZ /d "1" /f
  2⤵
  PID:2640
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "FontSmoothing" /t REG_SZ /d "2" /f
  2⤵
  PID:1872
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop\WindowMetrics" /v "MinAnimate" /t REG_SZ /d "0" /f
  2⤵
  PID:4972
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\DWM" /v "EnableAeroPeek" /t REG_DWORD /d "0" /f
  2⤵
  PID:1100
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\DWM" /v "AlwaysHibernateThumbnails" /t REG_DWORD /d "0" /f
  2⤵
  PID:1876
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\DWM" /v "ListviewShadow" /t REG_DWORD /d "0" /f
  2⤵
  PID:4804
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "IconsOnly" /t REG_DWORD /d "0" /f
  2⤵
  PID:3216
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewAlphaSelect" /t REG_DWORD /d "0" /f
  2⤵
  PID:2896
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d "0" /f
  2⤵
  PID:380
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewShadow" /t REG_DWORD /d "0" /f
  2⤵
  PID:1524
- C:\Windows\system32\reg.exe
  Reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DelayedDesktopSwitchTimeout" /t REG_DWORD /d "0" /f
  2⤵
  PID:2056
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v "StartupDelayInMSec" /t REG_SZ /d "0" /f
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  Reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "RunStartupScriptSync" /t REG_DWORD /d "0" /f
  2⤵
  PID:1724
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootuxdisabled on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4732
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1400
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1248
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "WaitToKillAppTimeout" /t REG_SZ /d "2000" /f
  2⤵
  PID:4936
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "2000" /f
  2⤵
  PID:3224
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "AutoEndTasks" /t REG_SZ /d "1" /f
  2⤵
  PID:2796
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "HungAppTimeout" /t REG_SZ /d "1000" /f
  2⤵
  PID:4124
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "20" /f
  2⤵
  PID:5104
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\Setup\LabConfig" /v "BypassTPMCheck" /t REG_DWORD /d "1" /f
  2⤵
  PID:5048
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\Setup\LabConfig" /v "BypassRAMCheck" /t REG_DWORD /d "1" /f
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\Setup\LabConfig" /v "BypassSecureBootCheck" /t REG_DWORD /d "1" /f
  2⤵
  PID:2604
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\Setup\MoSetup" /v "AllowUpgradesWithUnsupportedTPMOrCPU" /t REG_DWORD /d "1" /f
  2⤵
  PID:5112
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v "BranchReadinessLevel" /t REG_DWORD /d 2 /f
  2⤵
  PID:4296
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\AppCompat" /v "DisableInventory" /t REG_DWORD /d "1" /f
  2⤵
  PID:3968
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:4224
- C:\Windows\system32\sc.exe
  sc config WerSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:976
- C:\Windows\system32\sc.exe
  sc config WecSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:1896
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\AppCompat" /v "AITEnable" /t REG_DWORD /d "0" /f
  2⤵
  PID:4244
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\SQM" /v "DisableCustomerImprovementProgram" /t REG_DWORD /d 0 /f
  2⤵
  PID:512
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\SQMClient\Windows" /v "CEIPEnable" /t REG_DWORD /d "0" /f
  2⤵
  PID:3264
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\AppV\CEIP" /v "CEIPEnable" /t REG_DWORD /d "0" /f
  2⤵
  PID:856
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Messenger\Client" /v "CEIP" /t REG_DWORD /d "2" /f
  2⤵
  PID:1556
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\MSDeploy\3" /v "EnableTelemetry" /t REG_DWORD /d "1" /f
  2⤵
  PID:1056
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:5064
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:4456
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "MaxTelemetryAllowed" /t REG_DWORD /d "0" /f
  2⤵
  PID:1940
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "DisableTelemetryOptInChangeNotification" /t REG_DWORD /d "1" /f
  2⤵
  PID:4672
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "DisableTelemetryOptInSettingsUx" /t REG_DWORD /d "1" /f
  2⤵
  PID:2692
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "AllowCommercialDataPipeline" /t REG_DWORD /d 0 /f
  2⤵
  PID:2848
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "AllowDeviceNameInTelemetry" /t REG_DWORD /d 0 /f
  2⤵
  PID:4072
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "DisableEnterpriseAuthProxy" /t REG_DWORD /d 1 /f
  2⤵
  PID:920
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "AllowDesktopAnalyticsProcessing" /t REG_DWORD /d 0 /f
  2⤵
  PID:4544
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "MicrosoftEdgeDataOptIn" /t REG_DWORD /d 0 /f
  2⤵
  PID:64
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" /v "ShowedToastAtLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:1732
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" /v "DiagTrackAuthorization" /t REG_DWORD /d "775" /f
  2⤵
  PID:4088
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" /v "DiagTrackStatus" /t REG_DWORD /d "2" /f
  2⤵
  PID:3564
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" /v "UploadPermissionReceived" /t REG_DWORD /d "1" /f
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\TraceManager" /v "MiniTraceSlotContentPermitted" /t REG_DWORD /d "1" /f
  2⤵
  PID:3492
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\TraceManager" /v "MiniTraceSlotEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2660
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy" /v "TailoredExperiencesWithDiagnosticDataEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2004
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Policies\Microsoft\Windows\CloudContent" /v "disabletailoredexperiencesWithDiagnosticData" /t REG_DWORD /d "1" /f
  2⤵
  PID:1596
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "DisableDiagnosticDataViewer" /T REG_DWORD /d "1" /f
  2⤵
  PID:3312
- C:\Windows\system32\sc.exe
  sc config DiagTrack start=disabled
  2⤵
  - Launches sc.exe
  PID:2556
- C:\Windows\system32\sc.exe
  sc config DiagSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3356
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Input\TIPC" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:700
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\InputPersonalization" /v "RestrictImplicitTextCollection" /t REG_DWORD /d "1" /f
  2⤵
  PID:3500
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\InputPersonalization" /v "RestrictImplicitInkCollection" /t REG_DWORD /d "1" /f
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\TabletPC" /v "PreventHandwritingDataSharing" /t REG_DWORD /d "1" /f
  2⤵
  PID:812
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\HandwritingErrorReports" /v "PreventHandwritingErrorReports" /t REG_DWORD /d "1" /f
  2⤵
  PID:692
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Personalization\Settings" /v AcceptedPrivacyPolicy /t REG_DWORD /d "0" /f
  2⤵
  PID:5060
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\TextInput" /v "AllowLinguisticDataCollection" /t REG_DWORD /d "0" /f
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\InputPersonalization\TrainedDataStore" /v "HarvestContacts" /t REG_DWORD /d "0" /f
  2⤵
  PID:4116
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\InputPersonalization\TrainedDataStore" /v "InsightsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2400
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo" /v "DisabledByGroupPolicy" /t REG_DWORD /d "1" /f
  2⤵
  PID:768
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3624
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Power\EnergyEstimation\TaggedEnergy" /v "DisableTaggedEnergyLogging" /t REG_DWORD /d "1" /f
  2⤵
  PID:1084
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Power\EnergyEstimation\TaggedEnergy" /v "TelemetryMaxApplication" /t REG_DWORD /d "0" /f
  2⤵
  PID:872
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Power\EnergyEstimation\TaggedEnergy" /v "TelemetryMaxTagPerApplication" /t REG_DWORD /d "0" /f
  2⤵
  PID:1852
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1336
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\Maps" /v "AutoDownloadAndUpdateMapData" /t REG_DWORD /d "0" /f
  2⤵
  PID:5100
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\Maps" /v "AllowUntriggeredNetworkTrafficOnSettingsPage" /t REG_DWORD /d "0" /f
  2⤵
  PID:3860
- C:\Windows\system32\sc.exe
  sc config MapsBroker start=disabled
  2⤵
  - Launches sc.exe
  PID:2380
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "CortanaEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2352
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "CortanaConsent" /t REG_DWORD /d "0" /f
  2⤵
  PID:2496
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "AllowCortana" /t REG_DWORD /d "0" /f
  2⤵
  PID:2344
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Biometrics" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4444
- C:\Windows\system32\sc.exe
  sc config WbioSrvc start=disabled
  2⤵
  - Launches sc.exe
  PID:2992
- C:\Windows\system32\setx.exe
  setx DOTNET_CLI_TELEMETRY_OPTOUT 1
  2⤵
  PID:3724
- C:\Windows\system32\setx.exe
  setx POWERSHELL_TELEMETRY_OPTOUT 1
  2⤵
  PID:1180
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Diagnostics\Performance" /v "DisableDiagnosticTracing" /t REG_DWORD /d "1" /f
  2⤵
  PID:2192
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\Diagnostics\Performance" /v "DisableDiagnosticTracing" /t REG_DWORD /d "1" /f
  2⤵
  PID:2336
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\Diagnostics\Performance" /v "DisableDiagnosticTracing" /t REG_DWORD /d "1" /f
  2⤵
  PID:4356
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v "NoGenTicket" /t REG_DWORD /d "1" /f
  2⤵
  PID:392
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClient" /disable
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters" /v "SMB1" /t REG_DWORD /d "0" /f
  2⤵
  PID:4404
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters" /v "SMB2" /t REG_DWORD /d "0" /f
  2⤵
  PID:1176
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RestrictAnonymous" /t REG_DWORD /d "1" /f
  2⤵
  PID:2736
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RestrictAnonymousSAM" /t REG_DWORD /d "1" /f
  2⤵
  PID:2244
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\NetBT\Parameters\Interfaces" /v "NetbiosOptions" /t REG_DWORD /d "2" /f
  2⤵
  PID:2844
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Services\NetBT\Parameters\Interfaces" /v "NetbiosOptions" /t REG_DWORD /d "2" /f
  2⤵
  PID:744
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Services\NetBT\Parameters\Interfaces" /v "NetbiosOptions" /t REG_DWORD /d "2" /f
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\NetBT\Parameters" /v "NodeType" /t REG_DWORD /d "2" /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Services\NetBT\Parameters" /v "NodeType" /t REG_DWORD /d "2" /f
  2⤵
  PID:4268
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Services\NetBT\Parameters" /v "NodeType" /t REG_DWORD /d "2" /f
  2⤵
  PID:4492
- C:\Windows\system32\sc.exe
  sc stop LanmanWorkstation
  2⤵
  - Launches sc.exe
  PID:3440
- C:\Windows\system32\sc.exe
  sc config LanmanWorkstation start=disabled
  2⤵
  - Launches sc.exe
  PID:4592
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" /v "RestrictNullSessAccess" /t REG_DWORD /d "1" /f
  2⤵
  PID:3044
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" /v "DisableCompression" /t REG_DWORD /d "1" /f
  2⤵
  PID:1516
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe" /v "AuditLevel" /t REG_DWORD /d "8" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:4084
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation" /v "AllowProtectedCreds" /t REG_DWORD /d "1" /f
  2⤵
  PID:2092
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "DisableRestrictedAdminOutboundCreds" /t REG_DWORD /d "1" /f
  2⤵
  PID:2404
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "DisableRestrictedAdmin" /t REG_DWORD /d "0" /f
  2⤵
  PID:2196
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RunAsPPL" /t REG_DWORD /d "1" /f
  2⤵
  - Boot or Logon Autostart Execution: LSASS Driver
  - Access Token Manipulation: Create Process with Token
  PID:4108
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest" /v "Negotiate" /t REG_DWORD /d "0" /f
  2⤵
  PID:4496
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest" /v "UseLogonCredential" /t REG_DWORD /d "0" /f
  2⤵
  PID:4428
- C:\Windows\system32\net.exe
  net user defaultuser0 /delete
  2⤵
  PID:3560
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user defaultuser0 /delete
    3⤵
    PID:4736
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Remote Assistance" /v "fAllowFullControl" /t REG_DWORD /d "0" /f
  2⤵
  PID:4248
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d "0" /f
  2⤵
  PID:4172
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\.NetFramework\v4.0.30319" /v "SchUseStrongCrypto" /t REG_DWORD /d "1" /f
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" /v "SchUseStrongCrypto" /t REG_DWORD /d "1" /f
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  Reg delete HKEY_CLASSES_ROOT\ms-msdt /f
  2⤵
  - Modifies registry class
  PID:2616
- C:\Windows\system32\reg.exe
  Reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "InstallationType"
  2⤵
  PID:4656
- C:\Windows\system32\find.exe
  find /I "Server Core"
  2⤵
  PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get TotalVisibleMemorySize /format:value
  2⤵
  PID:2464
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get TotalVisibleMemorySize /format:value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d "4193772" /f
  2⤵
  PID:1352
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d "4193772" /f
  2⤵
  PID:424
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d "4193772" /f
  2⤵
  PID:524
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v "IOPageLockLimit" /t REG_DWORD /d "4193772" /f
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Session Manager" /v "HeapDeCommitFreeBlockThreshold" /t REG_DWORD /d "262144" /f
  2⤵
  PID:4516
- C:\Windows\system32\bcdedit.exe
  bcdedit /set pae ForceEnable
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command $ErrorActionPreference = 'SilentlyContinue';Disable-NetAdapterPowerManagement -Name "*";Set-NetOffloadGlobalSetting -PacketCoalescingFilter Disabled -Chimney Disabled;Set-NetTCPSetting -SettingName "Internet" -MemoryPressureProtection Disabled
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip show interface | findstr /I "connected"
  2⤵
  PID:3044
- - C:\Windows\system32\netsh.exe
    netsh interface ip show interface
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4556
- - C:\Windows\system32\findstr.exe
    findstr /I "connected"
    3⤵
    PID:1392
- C:\Windows\system32\netsh.exe
  netsh interface ipv6 set interface 1 weakhostreceive=enabled weakhostsend=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2404
- C:\Windows\system32\netsh.exe
  netsh interface ipv4 set interface 1 weakhostreceive=enabled weakhostsend=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1248
- C:\Windows\system32\netsh.exe
  netsh interface ipv6 set interface 3 weakhostreceive=enabled weakhostsend=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4168
- C:\Windows\system32\netsh.exe
  netsh interface ipv4 set interface 3 weakhostreceive=enabled weakhostsend=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4124
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings" /v "DownloadMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:5048
- C:\Windows\system32\netsh.exe
  netsh int tcp set global ecncapability=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp show supplemental | findstr /I "template"
  2⤵
  PID:4300
- - C:\Windows\system32\netsh.exe
    netsh int tcp show supplemental
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2316
- - C:\Windows\system32\findstr.exe
    findstr /I "template"
    3⤵
    PID:4528
- C:\Windows\system32\netsh.exe
  netsh int tcp set supplemental internet CongestionProvider=bbr2
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2472
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\MSMQ\Parameters" /v "TCPNoDelay" /t REG_DWORD /d "1" /f
  2⤵
  PID:424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" /f "ServiceName" /s |findstr /i /l "ServiceName"
  2⤵
  PID:4580
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" /f "ServiceName" /s
    3⤵
    PID:1428
- - C:\Windows\system32\findstr.exe
    findstr /i /l "ServiceName"
    3⤵
    PID:5020
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{AD78E13A-39B3-44FB-82FC-64E8283FE9F9}" /v "TCPNoDelay" /t REG_DWORD /d "1" /f
  2⤵
  PID:588
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{AD78E13A-39B3-44FB-82FC-64E8283FE9F9}" /v "TcpAckFrequency" /t REG_DWORD /d "1" /f
  2⤵
  PID:1384
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{AD78E13A-39B3-44FB-82FC-64E8283FE9F9}" /v "TcpDelAckTicks" /t REG_DWORD /d "0" /f
  2⤵
  PID:5092
- C:\Windows\system32\netsh.exe
  netsh winsock set autotuning on
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get numberOfCores /format:value
  2⤵
  PID:200
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get numberOfCores /format:value
    3⤵
    PID:816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" /k /v /f "Description" /s /e | findstr /ri "REG_SZ"
  2⤵
  PID:4468
- - C:\Windows\system32\reg.exe
    Reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" /k /v /f "Description" /s /e
    3⤵
    PID:8
- - C:\Windows\system32\findstr.exe
    findstr /ri "REG_SZ"
    3⤵
    PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKLM\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}" /s /f "RTL8139C+ Fast Ethernet NIC" /d | findstr /C:"HKEY"
  2⤵
  PID:3320
- - C:\Windows\system32\reg.exe
    Reg query "HKLM\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}" /s /f "RTL8139C+ Fast Ethernet NIC" /d
    3⤵
    PID:4144
- - C:\Windows\system32\findstr.exe
    findstr /C:"HKEY"
    3⤵
    PID:952
- C:\Windows\system32\reg.exe
  Reg export "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" "C:\Backup\(Default) RTL8139C+ Fast Ethernet NIC.reg" /y
  2⤵
  PID:1908
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*WakeOnMagicPacket" /t REG_SZ /d "0" /f
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*WakeOnPattern" /t REG_SZ /d "0" /f
  2⤵
  PID:4484
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "WakeOnLink" /t REG_SZ /d "0" /f
  2⤵
  PID:812
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "S5WakeOnLan" /t REG_SZ /d "0" /f
  2⤵
  PID:692
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "WolShutdownLinkSpeed" /t REG_SZ /d "2" /f
  2⤵
  PID:5060
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*ModernStandbyWoLMagicPacket " /t REG_SZ /d "0" /f
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*DeviceSleepOnDisconnect" /t REG_SZ /d "0" /f
  2⤵
  PID:4116
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*NicAutoPowerSaver" /t REG_SZ /d "0" /f
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*FlowControl" /t REG_SZ /d "0" /f
  2⤵
  PID:4712
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*EEE" /t REG_SZ /d "0" /f
  2⤵
  PID:3624
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnablePME" /t REG_SZ /d "0" /f
  2⤵
  PID:1084
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EEELinkAdvertisement" /t REG_SZ /d "0" /f
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ReduceSpeedOnPowerDown" /t REG_SZ /d "0" /f
  2⤵
  PID:2352
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "PowerSavingMode" /t REG_SZ /d "0" /f
  2⤵
  PID:2380
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnableGreenEthernet" /t REG_SZ /d "0" /f
  2⤵
  PID:3860
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ULPMode" /t REG_SZ /d "0" /f
  2⤵
  PID:352
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "GigaLite" /t REG_SZ /d "0" /f
  2⤵
  PID:5000
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnableSavePowerNow" /t REG_SZ /d "0" /f
  2⤵
  PID:1852
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnablePowerManagement" /t REG_SZ /d "0" /f
  2⤵
  PID:4700
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnableDynamicPowerGating" /t REG_SZ /d "0" /f
  2⤵
  PID:3976
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnableConnectedPowerGating" /t REG_SZ /d "0" /f
  2⤵
  PID:4808
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "AutoPowerSaveModeEnabled" /t REG_SZ /d "0" /f
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "AutoDisableGigabit" /t REG_SZ /d "0" /f
  2⤵
  PID:2852
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "AdvancedEEE" /t REG_SZ /d "0" /f
  2⤵
  PID:3032
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "PowerDownPll" /t REG_SZ /d "0" /f
  2⤵
  PID:3292
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "S5NicKeepOverrideMacAddrV2" /t REG_SZ /d "0" /f
  2⤵
  PID:2828
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "MIMOPowerSaveMode" /t REG_SZ /d "3" /f
  2⤵
  PID:1700
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "AlternateSemaphoreDelay" /t REG_SZ /d "0" /f
  2⤵
  PID:772
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*interruptmoderation" /t REG_SZ /d "0" /f
  2⤵
  PID:4280
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "JumboPacket" /t REG_SZ /d "0" /f
  2⤵
  PID:2208
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ITR" /t REG_SZ /d "125" /f
  2⤵
  PID:1380
- C:\Windows\system32\reg.exe
  Reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ReceiveBuffers" /f
  2⤵
  PID:1396
- C:\Windows\system32\reg.exe
  Reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "TransmitBuffers" /f
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ThroughputBoosterEnabled" /t REG_SZ /d "1" /f
  2⤵
  PID:996
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "PnPCapabilities" /t REG_DWORD /d "24" /f
  2⤵
  PID:3308
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "LsoV1IPv4" /t REG_SZ /d "1" /f
  2⤵
  PID:1568
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "LsoV2IPv4" /t REG_SZ /d "1" /f
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "LsoV2IPv6" /t REG_SZ /d "1" /f
  2⤵
  PID:4624
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "TCPUDPChecksumOffloadIPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:2920
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "TCPUDPChecksumOffloadIPv6" /t REG_SZ /d "3" /f
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "UDPChecksumOffloadIPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:1940
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "UDPChecksumOffloadIPv6" /t REG_SZ /d "3" /f
  2⤵
  PID:1056
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "TCPChecksumOffloadIPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:5080
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "TCPChecksumOffloadIPv6" /t REG_SZ /d "3" /f
  2⤵
  PID:216
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "IPChecksumOffloadIPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:3008
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "IPsecOffloadV1IPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:1948
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "IPsecOffloadV2" /t REG_SZ /d "3" /f
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*IPsecOffloadV2IPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:2056
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*PMARPOffload" /t REG_SZ /d "1" /f
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*PMNSOffload" /t REG_SZ /d "1" /f
  2⤵
  PID:3044
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*PMWiFiRekeyOffload" /t REG_SZ /d "1" /f
  2⤵
  PID:2196
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "RSS" /t REG_SZ /d "1" /f
  2⤵
  PID:2008
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*NumRssQueues" /t REG_SZ /d "2" /f
  2⤵
  PID:2796
- C:\Windows\system32\reg.exe
  Reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*RssBaseProcNumber" /f
  2⤵
  PID:1992
- C:\Windows\system32\reg.exe
  Reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*RssMaxProcNumber" /f
  2⤵
  PID:5028
- C:\Windows\system32\netsh.exe
  netsh int tcp set global rss=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5024
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport udp start=1025 num=64511
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4124
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3512
- C:\Windows\system32\netsh.exe
  Netsh int ip set global taskoffload=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1276
- C:\Windows\system32\reg.exe
  Reg add HKLM\System\CurrentControlSet\Services\TCPIP\Parameters /v DisableTaskOffload /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4528
- C:\Windows\system32\reg.exe
  Reg add HKLM\System\CurrentControlSet\Services\Ipsec /v EnabledOffload /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2504
- C:\Windows\system32\sc.exe
  sc query MMCSS
  2⤵
  - Launches sc.exe
  PID:5068
- C:\Windows\system32\find.exe
  find "STOPPED"
  2⤵
  PID:424
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Latency Sensitive" /t REG_SZ /d "True" /f
  2⤵
  PID:1556
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Scheduling Category" /t REG_SZ /d "High" /f
  2⤵
  PID:4596
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "SFIO Priority" /t REG_SZ /d "High" /f
  2⤵
  PID:5064
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Priority" /t REG_DWORD /d "8" /f
  2⤵
  PID:2692
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Control\GraphicsDrivers" /v "IOMMUFlags" /t REG_DWORD /d 0 /f
  2⤵
  PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_VideoController get PNPDeviceID | find "PCI\VEN_"
  2⤵
  PID:2580
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_VideoController get PNPDeviceID
    3⤵
    PID:920
- - C:\Windows\system32\find.exe
    find "PCI\VEN_"
    3⤵
    PID:4952
- C:\Windows\system32\reg.exe
  reg query "HKLM\System\CurrentControlSet\Enum\PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\3&11583659&0&08\Device Parameters\Interrupt Management\MessageSignaledInterruptProperties" /v "MSISupported"
  2⤵
  PID:4648
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications" /v "GlobalUserDisabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsRunInBackground" /t REG_DWORD /d "2" /f
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "BackgroundAppGlobalToggle" /t REG_DWORD /d "0" /f
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2660
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:952
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2928
- C:\Windows\system32\powercfg.exe
  powercfg /h off
  2⤵
  - Power Settings
  PID:4600
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn "\microsoft\windows\power efficiency diagnostics\analyzesystem" /disable
  2⤵
  PID:1104
- C:\Windows\system32\wevtutil.exe
  wevtutil set-log "Microsoft-Windows-SleepStudy/Diagnostic" /e:False
  2⤵
  PID:3500
- C:\Windows\system32\wevtutil.exe
  wevtutil set-log "Microsoft-Windows-Kernel-Processor-Power/Diagnostic" /e:False
  2⤵
  PID:700
- C:\Windows\system32\wevtutil.exe
  wevtutil set-log "Microsoft-Windows-UserModePowerService/Diagnostic" /e:False
  2⤵
  PID:4376
- C:\Windows\system32\reg.exe
  Reg query "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "Win32PrioritySeparation"
  2⤵
  PID:3364
- C:\Windows\system32\find.exe
  find "0x18"
  2⤵
  PID:3180
- C:\Windows\system32\reg.exe
  Reg query "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "Win32PrioritySeparation"
  2⤵
  PID:2396
- C:\Windows\system32\find.exe
  find "0x26"
  2⤵
  PID:4180
- C:\Windows\system32\fsutil.exe
  fsutil behavior set memoryusage 2
  2⤵
  PID:2492
- C:\Windows\system32\fsutil.exe
  fsutil behavior set mftzone 2
  2⤵
  PID:4240
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disabledeletenotify 0
  2⤵
  PID:3076
- C:\Windows\system32\fsutil.exe
  fsutil behavior set encryptpagingfile 0
  2⤵
  PID:3484
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disable8dot3 1
  2⤵
  PID:2408
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d "1" /f
  2⤵
  PID:2532
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d "1" /f
  2⤵
  PID:2468
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d "1" /f
  2⤵
  PID:1884
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disablecompression 1
  2⤵
  PID:2824
- C:\Windows\System32\Wbem\WMIC.exe
  wmic logicaldisk where "DriveType='3' and DeviceID='C:'" get DeviceID
  2⤵
  PID:2584
- C:\Windows\system32\find.exe
  find "C:"
  2⤵
  PID:5072
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disableLastAccess 0
  2⤵
  PID:5012
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\FileSystem" /v "NtfsDisableLastAccessUpdate" /t REG_DWORD /d "2147483648" /f
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\FileSystem" /v "NtfsDisableLastAccessUpdate" /t REG_DWORD /d "2147483648" /f
  2⤵
  PID:3724
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\FileSystem" /v "NtfsDisableLastAccessUpdate" /t REG_DWORD /d "2147483648" /f
  2⤵
  PID:3604
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\NvTelemetryContainer" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2892
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Services\NvTelemetryContainer" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2336
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Services\NvTelemetryContainer" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4920
- C:\Windows\system32\sc.exe
  sc stop NvTelemetyContainer
  2⤵
  - Launches sc.exe
  PID:3964
- C:\Windows\system32\sc.exe
  sc config NvTelemetyContainer start=disabled
  2⤵
  - Launches sc.exe
  PID:2384
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\NVIDIA Corporation\NvControlPanel2\Client" /v "OptInOrOutPreference" /t REG_DWORD /d 0 /f
  2⤵
  PID:772
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\nvlddmkm\Global\Startup" /v "SendTelemetryData" /t REG_DWORD /d "0" /f
  2⤵
  PID:4280
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\NVIDIA Corporation\Global\FTS" /v "EnableRID44231" /t REG_DWORD /d 0 /f
  2⤵
  PID:2208
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\NVIDIA Corporation\Global\FTS" /v "EnableRID64640" /t REG_DWORD /d 0 /f
  2⤵
  PID:2736
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\NVIDIA Corporation\Global\FTS" /v "EnableRID66610" /t REG_DWORD /d 0 /f
  2⤵
  PID:2244
- C:\Windows\system32\reg.exe
  Reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "NvBackend" /f
  2⤵
  PID:2844
- C:\Windows\system32\schtasks.exe
  schtasks /change /disable /tn "NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}"
  2⤵
  PID:2176
- C:\Windows\system32\schtasks.exe
  schtasks /change /disable /tn "NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}"
  2⤵
  PID:2076
- C:\Windows\system32\schtasks.exe
  schtasks /change /disable /tn "NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}"
  2⤵
  PID:4720
- C:\Windows\system32\schtasks.exe
  schtasks /change /disable /tn "NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}"
  2⤵
  PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKLM\System\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /t REG_SZ /s /e /f "NVIDIA" | findstr "HKEY"
  2⤵
  PID:4492
- - C:\Windows\system32\reg.exe
    Reg query "HKLM\System\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /t REG_SZ /s /e /f "NVIDIA"
    3⤵
    PID:3440
- - C:\Windows\system32\findstr.exe
    findstr "HKEY"
    3⤵
    PID:380
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue useplatformclock
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4412
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1020
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\PowerCfg\GlobalPowerPolicy" /v "Policies" /t REG_BINARY /d "01000000020000000100000000000000020000000000000000000000000000002c0100003232030304000000040000000000000000000000840300002c01000000000000840300000001646464640000" /f
  2⤵
  - Power Settings
  PID:3852
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\System\Services\NetBT\Parameters" /v "CsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2356
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\System\Services\NetBT\Parameters" /v "CsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4456
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\System\Services\NetBT\Parameters" /v "CsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2092
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\System\Services\NetBT\Parameters" /v "PlatformAoAcOverride" /t REG_DWORD /d "0" /f
  2⤵
  PID:2988
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\System\Services\NetBT\Parameters" /v "PlatformAoAcOverride" /t REG_DWORD /d "0" /f
  2⤵
  PID:4556
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\System\Services\NetBT\Parameters" /v "PlatformAoAcOverride" /t REG_DWORD /d "0" /f
  2⤵
  PID:1392
- C:\Windows\system32\powercfg.exe
  powercfg /duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61 bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb
  2⤵
  - Power Settings
  PID:3044
- C:\Windows\system32\powercfg.exe
  powercfg /setactive bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb
  2⤵
  - Power Settings
  PID:2196
- C:\Windows\system32\powercfg.exe
  powercfg /delete eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee
  2⤵
  - Power Settings
  PID:1984
- C:\Windows\system32\powercfg.exe
  powercfg /duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61 eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee
  2⤵
  - Power Settings
  PID:4496
- C:\Windows\system32\powercfg.exe
  powercfg /setactive eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee
  2⤵
  - Power Settings
  PID:3224
- C:\Windows\system32\powercfg.exe
  powercfg /delete bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb
  2⤵
  - Power Settings
  PID:4736
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor THROTTLING 0
  2⤵
  - Power Settings
  PID:5108
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_none DEVICEIDLE 0
  2⤵
  - Power Settings
  PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo AMD64 Family 6 Model 13 Stepping 2, AuthenticAMD "
  2⤵
  PID:5048
- C:\Windows\system32\find.exe
  find /I "Intel"
  2⤵
  PID:1868
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Power\PowerSettings\48df9d60-4f68-11dc-8314-0800200c9a66\07029cd8-4664-4698-95d8-43b2e9666596" /v "ACSettingIndex" /t REG_DWORD /d "0" /f
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\Power\PowerSettings\48df9d60-4f68-11dc-8314-0800200c9a66\07029cd8-4664-4698-95d8-43b2e9666596" /v "ACSettingIndex" /t REG_DWORD /d "0" /f
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\Power\PowerSettings\48df9d60-4f68-11dc-8314-0800200c9a66\07029cd8-4664-4698-95d8-43b2e9666596" /v "ACSettingIndex" /t REG_DWORD /d "0" /f
  2⤵
  PID:3512
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFAUTONOMOUS 1
  2⤵
  - Power Settings
  PID:976
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFAUTONOMOUSWINDOW 1000
  2⤵
  - Power Settings
  PID:1276
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFEPP 0
  2⤵
  - Power Settings
  PID:4528
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFBOOSTMODE 1
  2⤵
  - Power Settings
  PID:2504
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFBOOSTPOL 100
  2⤵
  - Power Settings
  PID:4112
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP AWAYMODE 0
  2⤵
  - Power Settings
  PID:512
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP ALLOWSTANDBY 0
  2⤵
  - Power Settings
  PID:1428
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP HYBRIDSLEEP 0
  2⤵
  - Power Settings
  PID:5020
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP UNATTENDSLEEP 0
  2⤵
  - Power Settings
  PID:4184
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_IR DEEPSLEEP 0
  2⤵
  - Power Settings
  PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo AMD64 Family 6 Model 13 Stepping 2, AuthenticAMD "
  2⤵
  PID:2848
- C:\Windows\system32\find.exe
  find /I "Intel"
  2⤵
  PID:2692
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_INTSTEER UNPARKTIME 0
  2⤵
  - Power Settings
  PID:816
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_INTSTEER PERPROCLOAD 10000
  2⤵
  - Power Settings
  PID:428
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  PID:2172
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor SHORTSCHEDPOLICY 2
  2⤵
  - Power Settings
  PID:4952
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor SCHEDPOLICY 2
  2⤵
  - Power Settings
  PID:4944
- C:\Windows\system32\powercfg.exe
  powercfg /change standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:8
- C:\Windows\system32\powercfg.exe
  powercfg /change monitor-timeout-ac 0
  2⤵
  - Power Settings
  PID:4088
- C:\Windows\system32\powercfg.exe
  powercfg /change hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:376
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  PID:4636
- C:\Windows\system32\powercfg.exe
  powercfg -changename scheme_current "CoutX Ultimate Performance" "For CoutX Optimizer 2.1.1 (dsc.gg/CoutX) By UnLovedCookie"
  2⤵
  - Power Settings
  PID:3320
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableDeviceThrottling
  2⤵
  - Modifies registry key
  PID:4940
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:2928
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableDeviceThrottlingRan
  2⤵
  - Modifies registry key
  PID:824
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:1104
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableMitigations
  2⤵
  - Modifies registry key
  PID:4928
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableMitigationsgRan
  2⤵
  - Modifies registry key
  PID:692
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:4188
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableGPUThrottling
  2⤵
  - Modifies registry key
  PID:5056
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:644
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableGPUThrottlingRan
  2⤵
  - Modifies registry key
  PID:3800
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:4272
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableCPUThrottling
  2⤵
  - Modifies registry key
  PID:1084
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableCPUThrottlingRan
  2⤵
  - Modifies registry key
  PID:2312
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:2380
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v ExTweaks
  2⤵
  - Modifies registry key
  PID:4652
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:352
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v ExTweaksRan
  2⤵
  - Modifies registry key
  PID:4700
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:5000
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:4860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  PID:1180
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:360
- C:\Windows\system32\taskkill.exe
  taskkill /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2336
- C:\Windows\system32\taskkill.exe
  taskkill /f /im MinSudo.exe
  2⤵
  - Kills process with taskkill
  PID:2632
- C:\Windows\system32\taskkill.exe
  taskkill /f /im fsutil.exe
  2⤵
  - Kills process with taskkill
  PID:1872

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

LSASS Driver

T1547.008

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

LSASS Driver

T1547.008

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\REG8B87.tmp

Filesize
11KB

MD5
9636f428724c125014d71601fc6a2a16

SHA1
7246a2e8545eba3ba4fa35442f619a8901deb9dc

SHA256
7266871f7142e94cbefef7cd60d05e78e9f056cc003bb9019c95cefc5632348c

SHA512
5cd278b7e6077c7bda61395219ed53ef271179acd8521e87fd09a39de5edacf0700f04560a6748b1a66a42d089f48faca93311427ed9d76f046c32a50cfc2cdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oobydeqi.wv1.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
226KB

MD5
01e525c496173f774321711523aaa2fb

SHA1
1b2219bec858054aeb5a8e8590b125f3b8568f9f

SHA256
7f6746fb0e55ff98f30f3dd294c4ef5ac10eb752d946e97764baf5bd51f97061

SHA512
6e20317bfed7f46101b324395b64f8c100bcec22591b2b5dc7de99fb65f4ae2c32e71cd74b3f9da933c513e44ceaed052f240182b243c234e436473feeb63319

Download Submit
memory/1948-10-0x000001867E8D0000-0x000001867E8F2000-memory.dmp

Filesize
136KB

Download
memory/1948-13-0x000001867EBB0000-0x000001867EC26000-memory.dmp

Filesize
472KB

Download
memory/4236-255-0x00000210B6000000-0x00000210B6100000-memory.dmp

Filesize
1024KB

Download
memory/4236-254-0x00000210B6000000-0x00000210B6100000-memory.dmp

Filesize
1024KB

Download
memory/4236-259-0x00000210B6500000-0x00000210B6520000-memory.dmp

Filesize
128KB

Download
memory/4236-256-0x00000210B6000000-0x00000210B6100000-memory.dmp

Filesize
1024KB

Download
memory/4236-280-0x00000210B6680000-0x00000210B66A0000-memory.dmp

Filesize
128KB

Download