6273033dde31d56147096d50f235da716b49878064b94a338f0b8c9d9bd67546

Analysis

max time kernel
138s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29-06-2024 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tools/CoutX.bat
Size

61KB
MD5

9d9de233b39212edd52f376bdabc2b9c
SHA1

0f0ae692ec22867fbf4ee600efa7a9169f52ea28
SHA256

f783d2390ba2b2755c6b2467630d1d2703920cb4d42d34fb789fac9789e7bd18
SHA512

71c5e21745cc30f9cc6720cc9049415a8c8495487f7a9d26717ef6b56b49028f7d80ae1f175762e1ed3382fb6df6ae43f843d7cd1d164dbb7a4a25b677205293
SSDEEP

768:xGLTOwOkZ6DWMpLcKwtNh60aLIKoPw5PuE3MfFzL2IuGQIGQObWszHPjHv7gBOBF:YacKwXsIKoCuEFC0WszHPbv72+

Score

9^/10

defense_evasion evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1028	bcdedit.exe
920	bcdedit.exe
2740	bcdedit.exe
2352	bcdedit.exe
4652	bcdedit.exe
5092	bcdedit.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe\AuditLevel = "8"	reg.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Boot or Logon Autostart Execution: LSASS Driver 1 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence

LSASS Driver

T1547.008

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "1"	reg.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Power Settings 1 TTPs 30 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1212	powercfg.exe
2016	powercfg.exe
4248	powercfg.exe
1192	reg.exe
816	powercfg.exe
164	powercfg.exe
4112	powercfg.exe
4816	powercfg.exe
920	powercfg.exe
2788	powercfg.exe
3068	powercfg.exe
4300	powercfg.exe
1588	powercfg.exe
4880	powercfg.exe
1224	powercfg.exe
788	powercfg.exe
5064	powercfg.exe
4272	powercfg.exe
684	powercfg.exe
2536	powercfg.exe
1808	powercfg.exe
2208	powercfg.exe
3240	powercfg.exe
4140	powercfg.exe
3192	powercfg.exe
2744	powercfg.exe
1560	powercfg.exe
3584	powercfg.exe
824	powercfg.exe
4432	powercfg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	explorer.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\4032412167\4002656488.pri	explorer.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
872	powershell.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1688	sc.exe
3068	sc.exe
4652	sc.exe
1688	sc.exe
4784	sc.exe
1772	sc.exe
3288	sc.exe
2408	sc.exe
516	sc.exe
3588	sc.exe
2124	sc.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
1212	reg.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 39 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1896	ipconfig.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
372	taskkill.exe
2912	taskkill.exe
4824	taskkill.exe
1128	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\System\GameConfigStore\Children	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\System\GameConfigStore\Parents	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\System\GameConfigStore	reg.exe

Modifies registry class 33 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80706004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c00000000000000000000000052cef548eec9da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80706004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000b8bce248eec9da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc7600000000000000000000000021f776218a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567065728993929"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"	SearchUI.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-msdt\shell\open	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe

Modifies registry key 1 TTPs 29 IoCs

Modify Registry

T1112

pid	Process
2016	reg.exe
2788	reg.exe
1572	reg.exe
3040	reg.exe
4612	reg.exe
3384	reg.exe
3120	reg.exe
3600	reg.exe
1892	reg.exe
4200	reg.exe
3148	reg.exe
1400	reg.exe
780	reg.exe
780	reg.exe
392	reg.exe
4612	reg.exe
404	reg.exe
2428	reg.exe
224	reg.exe
2724	reg.exe
1560	reg.exe
3080	reg.exe
1264	reg.exe
3040	reg.exe
2716	reg.exe
4064	reg.exe
3100	reg.exe
3176	reg.exe
4420	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
872	powershell.exe
872	powershell.exe
872	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4628	WMIC.exe
Token: SeSecurityPrivilege	4628	WMIC.exe
Token: SeTakeOwnershipPrivilege	4628	WMIC.exe
Token: SeLoadDriverPrivilege	4628	WMIC.exe
Token: SeSystemProfilePrivilege	4628	WMIC.exe
Token: SeSystemtimePrivilege	4628	WMIC.exe
Token: SeProfSingleProcessPrivilege	4628	WMIC.exe
Token: SeIncBasePriorityPrivilege	4628	WMIC.exe
Token: SeCreatePagefilePrivilege	4628	WMIC.exe
Token: SeBackupPrivilege	4628	WMIC.exe
Token: SeRestorePrivilege	4628	WMIC.exe
Token: SeShutdownPrivilege	4628	WMIC.exe
Token: SeDebugPrivilege	4628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4628	WMIC.exe
Token: SeRemoteShutdownPrivilege	4628	WMIC.exe
Token: SeUndockPrivilege	4628	WMIC.exe
Token: SeManageVolumePrivilege	4628	WMIC.exe
Token: 33	4628	WMIC.exe
Token: 34	4628	WMIC.exe
Token: 35	4628	WMIC.exe
Token: 36	4628	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4628	WMIC.exe
Token: SeSecurityPrivilege	4628	WMIC.exe
Token: SeTakeOwnershipPrivilege	4628	WMIC.exe
Token: SeLoadDriverPrivilege	4628	WMIC.exe
Token: SeSystemProfilePrivilege	4628	WMIC.exe
Token: SeSystemtimePrivilege	4628	WMIC.exe
Token: SeProfSingleProcessPrivilege	4628	WMIC.exe
Token: SeIncBasePriorityPrivilege	4628	WMIC.exe
Token: SeCreatePagefilePrivilege	4628	WMIC.exe
Token: SeBackupPrivilege	4628	WMIC.exe
Token: SeRestorePrivilege	4628	WMIC.exe
Token: SeShutdownPrivilege	4628	WMIC.exe
Token: SeDebugPrivilege	4628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4628	WMIC.exe
Token: SeRemoteShutdownPrivilege	4628	WMIC.exe
Token: SeUndockPrivilege	4628	WMIC.exe
Token: SeManageVolumePrivilege	4628	WMIC.exe
Token: 33	4628	WMIC.exe
Token: 34	4628	WMIC.exe
Token: 35	4628	WMIC.exe
Token: 36	4628	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2456	WMIC.exe
Token: SeSecurityPrivilege	2456	WMIC.exe
Token: SeTakeOwnershipPrivilege	2456	WMIC.exe
Token: SeLoadDriverPrivilege	2456	WMIC.exe
Token: SeSystemProfilePrivilege	2456	WMIC.exe
Token: SeSystemtimePrivilege	2456	WMIC.exe
Token: SeProfSingleProcessPrivilege	2456	WMIC.exe
Token: SeIncBasePriorityPrivilege	2456	WMIC.exe
Token: SeCreatePagefilePrivilege	2456	WMIC.exe
Token: SeBackupPrivilege	2456	WMIC.exe
Token: SeRestorePrivilege	2456	WMIC.exe
Token: SeShutdownPrivilege	2456	WMIC.exe
Token: SeDebugPrivilege	2456	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2456	WMIC.exe
Token: SeRemoteShutdownPrivilege	2456	WMIC.exe
Token: SeUndockPrivilege	2456	WMIC.exe
Token: SeManageVolumePrivilege	2456	WMIC.exe
Token: 33	2456	WMIC.exe
Token: 34	2456	WMIC.exe
Token: 35	2456	WMIC.exe
Token: 36	2456	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2456	WMIC.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe

Suspicious use of SendNotifyMessage 23 IoCs

pid	Process
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4156	SearchUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3692	4268	cmd.exe	73
PID 4268 wrote to memory of 3692	4268	cmd.exe	73
PID 4268 wrote to memory of 5084	4268	cmd.exe	74
PID 4268 wrote to memory of 5084	4268	cmd.exe	74
PID 5084 wrote to memory of 4628	5084	cmd.exe	75
PID 5084 wrote to memory of 4628	5084	cmd.exe	75
PID 4268 wrote to memory of 1452	4268	cmd.exe	77
PID 4268 wrote to memory of 1452	4268	cmd.exe	77
PID 4268 wrote to memory of 3596	4268	cmd.exe	78
PID 4268 wrote to memory of 3596	4268	cmd.exe	78
PID 4268 wrote to memory of 3020	4268	cmd.exe	79
PID 4268 wrote to memory of 3020	4268	cmd.exe	79
PID 4268 wrote to memory of 2980	4268	cmd.exe	80
PID 4268 wrote to memory of 2980	4268	cmd.exe	80
PID 4268 wrote to memory of 824	4268	cmd.exe	81
PID 4268 wrote to memory of 824	4268	cmd.exe	81
PID 4268 wrote to memory of 4624	4268	cmd.exe	82
PID 4268 wrote to memory of 4624	4268	cmd.exe	82
PID 4268 wrote to memory of 4156	4268	cmd.exe	83
PID 4268 wrote to memory of 4156	4268	cmd.exe	83
PID 4268 wrote to memory of 192	4268	cmd.exe	84
PID 4268 wrote to memory of 192	4268	cmd.exe	84
PID 4268 wrote to memory of 212	4268	cmd.exe	85
PID 4268 wrote to memory of 212	4268	cmd.exe	85
PID 4268 wrote to memory of 752	4268	cmd.exe	86
PID 4268 wrote to memory of 752	4268	cmd.exe	86
PID 4268 wrote to memory of 32	4268	cmd.exe	87
PID 4268 wrote to memory of 32	4268	cmd.exe	87
PID 4268 wrote to memory of 616	4268	cmd.exe	88
PID 4268 wrote to memory of 616	4268	cmd.exe	88
PID 4268 wrote to memory of 3176	4268	cmd.exe	89
PID 4268 wrote to memory of 3176	4268	cmd.exe	89
PID 4268 wrote to memory of 4616	4268	cmd.exe	90
PID 4268 wrote to memory of 4616	4268	cmd.exe	90
PID 4268 wrote to memory of 4600	4268	cmd.exe	91
PID 4268 wrote to memory of 4600	4268	cmd.exe	91
PID 4268 wrote to memory of 4020	4268	cmd.exe	92
PID 4268 wrote to memory of 4020	4268	cmd.exe	92
PID 4268 wrote to memory of 4732	4268	cmd.exe	93
PID 4268 wrote to memory of 4732	4268	cmd.exe	93
PID 4268 wrote to memory of 3600	4268	cmd.exe	94
PID 4268 wrote to memory of 3600	4268	cmd.exe	94
PID 4268 wrote to memory of 780	4268	cmd.exe	95
PID 4268 wrote to memory of 780	4268	cmd.exe	95
PID 4268 wrote to memory of 1892	4268	cmd.exe	96
PID 4268 wrote to memory of 1892	4268	cmd.exe	96
PID 4268 wrote to memory of 3080	4268	cmd.exe	97
PID 4268 wrote to memory of 3080	4268	cmd.exe	97
PID 4268 wrote to memory of 4420	4268	cmd.exe	98
PID 4268 wrote to memory of 4420	4268	cmd.exe	98
PID 4268 wrote to memory of 2716	4268	cmd.exe	99
PID 4268 wrote to memory of 2716	4268	cmd.exe	99
PID 4268 wrote to memory of 1264	4268	cmd.exe	100
PID 4268 wrote to memory of 1264	4268	cmd.exe	100
PID 4268 wrote to memory of 224	4268	cmd.exe	101
PID 4268 wrote to memory of 224	4268	cmd.exe	101
PID 4268 wrote to memory of 3120	4268	cmd.exe	102
PID 4268 wrote to memory of 3120	4268	cmd.exe	102
PID 4268 wrote to memory of 2016	4268	cmd.exe	103
PID 4268 wrote to memory of 2016	4268	cmd.exe	103
PID 4268 wrote to memory of 4064	4268	cmd.exe	104
PID 4268 wrote to memory of 4064	4268	cmd.exe	104
PID 4268 wrote to memory of 3040	4268	cmd.exe	105
PID 4268 wrote to memory of 3040	4268	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tools\CoutX.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\system32\Dism.exe
  dism
  2⤵
  - Drops file in Windows directory
  PID:3692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_VideoController get VideoProcessor /value
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_VideoController get VideoProcessor /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo SeaBIOS VBE(C) 2011 "
  2⤵
  PID:1452
- C:\Windows\system32\find.exe
  find /I "GeForce"
  2⤵
  PID:3596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo SeaBIOS VBE(C) 2011 "
  2⤵
  PID:3020
- C:\Windows\system32\find.exe
  find /I "NVIDIA"
  2⤵
  PID:2980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo SeaBIOS VBE(C) 2011 "
  2⤵
  PID:824
- C:\Windows\system32\find.exe
  find /I "RTX"
  2⤵
  PID:4624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo SeaBIOS VBE(C) 2011 "
  2⤵
  PID:4156
- C:\Windows\system32\find.exe
  find /I "GTX"
  2⤵
  PID:192
- C:\Windows\system32\reg.exe
  Reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v "DisplayParameters" /t REG_DWORD /d "1" /f
  2⤵
  PID:212
- C:\Windows\system32\reg.exe
  Reg delete "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /v "__COMPAT_LAYER" /f
  2⤵
  PID:752
- C:\Windows\system32\reg.exe
  Reg delete "HKCU\System\GameConfigStore" /v "GameDVR_FSEBehavior" /f
  2⤵
  PID:32
- C:\Windows\system32\reg.exe
  Reg delete "HKCU\System\GameConfigStore" /v "GameDVR_DSEBehavior" /f
  2⤵
  PID:616
- C:\Windows\system32\reg.exe
  Reg delete "HKLM\System\GameConfigStore" /f
  2⤵
  PID:3176
- C:\Windows\system32\reg.exe
  Reg delete "HKU\.Default\System\GameConfigStore" /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:4616
- C:\Windows\system32\reg.exe
  Reg delete "HKU\S-1-5-19\System\GameConfigStore" /f
  2⤵
  PID:4600
- C:\Windows\system32\reg.exe
  Reg delete "HKU\S-1-5-20\System\GameConfigStore" /f
  2⤵
  PID:4020
- C:\Windows\system32\reg.exe
  Reg delete "HKCU\Software\Classes\System\GameConfigStore" /f
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  Reg add HKCU\System\GameConfigStore /v GameDVR_Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:3600
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Policies\Microsoft\Windows\GameDVR /v AllowGameDVR /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:780
- C:\Windows\system32\reg.exe
  Reg add HKLM\Software\Microsoft\PolicyManager\default\ApplicationManagement\AllowGameDVR /v value /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:1892
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v AppCaptureEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:3080
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v AudioCaptureEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4420
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v CursorCaptureEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:2716
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v MicrophoneCaptureEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:1264
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v HistoricalCaptureEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:224
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\GameBar /v UseNexusForGameBarEnabled /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:3120
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\GameBar /v GamepadDoublePressIntervalMs /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:2016
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\GameBar /v ShowStartupPanel /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4064
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\GameBar /v GamePanelStartupTipIndex /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:3040
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Gaming.GameBar.PresenceServer.Internal.PresenceWriter" /v "ActivationType" /t REG_DWORD /d "0" /f
  2⤵
  PID:2288
- C:\Windows\system32\reg.exe
  Reg add HKCU\System\GameConfigStore /v GameDVR_FSEBehaviorMode /t REG_DWORD /d 2 /f
  2⤵
  - Modifies registry key
  PID:4612
- C:\Windows\system32\reg.exe
  Reg add HKCU\System\GameConfigStore /v GameDVR_EFSEFeatureFlags /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4200
- C:\Windows\system32\reg.exe
  Reg add HKCU\System\GameConfigStore /v GameDVR_DXGIHonorFSEWindowsCompatible /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:2724
- C:\Windows\system32\reg.exe
  Reg add HKCU\System\GameConfigStore /v GameDVR_HonorUserFSEBehaviorMode /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings" 2>nul | Find "REG_SZ"
  2⤵
  PID:2608
- - C:\Windows\system32\reg.exe
    Reg query "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings"
    3⤵
    PID:4604
- - C:\Windows\system32\find.exe
    Find "REG_SZ"
    3⤵
    PID:3580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo "
  2⤵
  PID:5112
- C:\Windows\system32\find.exe
  Find /I "VRROptimizeEnable"
  2⤵
  PID:424
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings" /t REG_SZ /d "VRROptimizeEnable=1;" /f
  2⤵
  PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings" 2>nul | Find "REG_SZ"
  2⤵
  PID:1004
- - C:\Windows\system32\reg.exe
    Reg query "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings"
    3⤵
    PID:1284
- - C:\Windows\system32\find.exe
    Find "REG_SZ"
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo VRROptimizeEnable=1; "
  2⤵
  PID:1488
- C:\Windows\system32\find.exe
  Find /I "SwapEffectUpgradeEnable"
  2⤵
  PID:2912
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings" /t REG_SZ /d "VRROptimizeEnable=1;SwapEffectUpgradeEnable=1;" /f
  2⤵
  PID:3036
- C:\Windows\system32\reg.exe
  Reg add HKCU\Software\Microsoft\DirectX\GraphicsSettings /v SwapEffectUpgradeCache /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKLM\System\CurrentControlSet\Control\Class" /v "VgaCompatible" /s 2>nul | findstr "HKEY"
  2⤵
  PID:2696
- - C:\Windows\system32\reg.exe
    Reg query "HKLM\System\CurrentControlSet\Control\Class" /v "VgaCompatible" /s
    3⤵
    PID:1952
- - C:\Windows\system32\findstr.exe
    findstr "HKEY"
    3⤵
    PID:512
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\GraphicsDrivers" /v "HwSchMode" /t REG_DWORD /d "2" /f
  2⤵
  PID:3052
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\GraphicsDrivers" /v "HwSchMode" /t REG_DWORD /d "2" /f
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\GraphicsDrivers" /v "HwSchMode" /t REG_DWORD /d "2" /f
  2⤵
  PID:4928
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /t REG_DWORD /d "3" /f
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /f /v "UserPreferencesMask" /t REG_BINARY /d "9012078012000000"
  2⤵
  PID:3532
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "DragFullWindows" /t REG_SZ /d "1" /f
  2⤵
  PID:4208
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "FontSmoothing" /t REG_SZ /d "2" /f
  2⤵
  PID:2256
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop\WindowMetrics" /v "MinAnimate" /t REG_SZ /d "0" /f
  2⤵
  PID:3440
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\DWM" /v "EnableAeroPeek" /t REG_DWORD /d "0" /f
  2⤵
  PID:4276
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\DWM" /v "AlwaysHibernateThumbnails" /t REG_DWORD /d "0" /f
  2⤵
  PID:4812
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\DWM" /v "ListviewShadow" /t REG_DWORD /d "0" /f
  2⤵
  PID:2644
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "IconsOnly" /t REG_DWORD /d "0" /f
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewAlphaSelect" /t REG_DWORD /d "0" /f
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d "0" /f
  2⤵
  PID:1372
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewShadow" /t REG_DWORD /d "0" /f
  2⤵
  PID:1788
- C:\Windows\system32\reg.exe
  Reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DelayedDesktopSwitchTimeout" /t REG_DWORD /d "0" /f
  2⤵
  PID:1832
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v "StartupDelayInMSec" /t REG_SZ /d "0" /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  Reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "RunStartupScriptSync" /t REG_DWORD /d "0" /f
  2⤵
  PID:2080
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootuxdisabled on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1028
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:920
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2740
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "WaitToKillAppTimeout" /t REG_SZ /d "2000" /f
  2⤵
  PID:1668
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "2000" /f
  2⤵
  PID:1168
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "AutoEndTasks" /t REG_SZ /d "1" /f
  2⤵
  PID:2548
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "HungAppTimeout" /t REG_SZ /d "1000" /f
  2⤵
  PID:4796
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "20" /f
  2⤵
  PID:948
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\Setup\LabConfig" /v "BypassTPMCheck" /t REG_DWORD /d "1" /f
  2⤵
  PID:1740
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\Setup\LabConfig" /v "BypassRAMCheck" /t REG_DWORD /d "1" /f
  2⤵
  PID:4952
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\Setup\LabConfig" /v "BypassSecureBootCheck" /t REG_DWORD /d "1" /f
  2⤵
  PID:5076
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\Setup\MoSetup" /v "AllowUpgradesWithUnsupportedTPMOrCPU" /t REG_DWORD /d "1" /f
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v "BranchReadinessLevel" /t REG_DWORD /d 2 /f
  2⤵
  PID:1768
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\AppCompat" /v "DisableInventory" /t REG_DWORD /d "1" /f
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:2452
- C:\Windows\system32\sc.exe
  sc config WerSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:1688
- C:\Windows\system32\sc.exe
  sc config WecSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3068
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\AppCompat" /v "AITEnable" /t REG_DWORD /d "0" /f
  2⤵
  PID:2536
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\SQM" /v "DisableCustomerImprovementProgram" /t REG_DWORD /d 0 /f
  2⤵
  PID:4232
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\SQMClient\Windows" /v "CEIPEnable" /t REG_DWORD /d "0" /f
  2⤵
  PID:4136
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\AppV\CEIP" /v "CEIPEnable" /t REG_DWORD /d "0" /f
  2⤵
  PID:2352
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Messenger\Client" /v "CEIP" /t REG_DWORD /d "2" /f
  2⤵
  PID:872
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\MSDeploy\3" /v "EnableTelemetry" /t REG_DWORD /d "1" /f
  2⤵
  PID:2916
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:4104
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "MaxTelemetryAllowed" /t REG_DWORD /d "0" /f
  2⤵
  PID:2268
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "DisableTelemetryOptInChangeNotification" /t REG_DWORD /d "1" /f
  2⤵
  PID:1396
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "DisableTelemetryOptInSettingsUx" /t REG_DWORD /d "1" /f
  2⤵
  PID:3596
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "AllowCommercialDataPipeline" /t REG_DWORD /d 0 /f
  2⤵
  PID:3020
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "AllowDeviceNameInTelemetry" /t REG_DWORD /d 0 /f
  2⤵
  PID:3584
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "DisableEnterpriseAuthProxy" /t REG_DWORD /d 1 /f
  2⤵
  PID:824
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "AllowDesktopAnalyticsProcessing" /t REG_DWORD /d 0 /f
  2⤵
  PID:96
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "MicrosoftEdgeDataOptIn" /t REG_DWORD /d 0 /f
  2⤵
  PID:164
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" /v "ShowedToastAtLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:2196
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" /v "DiagTrackAuthorization" /t REG_DWORD /d "775" /f
  2⤵
  PID:4880
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" /v "DiagTrackStatus" /t REG_DWORD /d "2" /f
  2⤵
  PID:3264
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" /v "UploadPermissionReceived" /t REG_DWORD /d "1" /f
  2⤵
  PID:4112
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\TraceManager" /v "MiniTraceSlotContentPermitted" /t REG_DWORD /d "1" /f
  2⤵
  PID:4776
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\TraceManager" /v "MiniTraceSlotEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2756
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy" /v "TailoredExperiencesWithDiagnosticDataEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:980
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Policies\Microsoft\Windows\CloudContent" /v "disabletailoredexperiencesWithDiagnosticData" /t REG_DWORD /d "1" /f
  2⤵
  PID:3808
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\DataCollection" /v "DisableDiagnosticDataViewer" /T REG_DWORD /d "1" /f
  2⤵
  PID:3108
- C:\Windows\system32\sc.exe
  sc config DiagTrack start=disabled
  2⤵
  - Launches sc.exe
  PID:3288
- C:\Windows\system32\sc.exe
  sc config DiagSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:2408
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Input\TIPC" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:3792
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\InputPersonalization" /v "RestrictImplicitTextCollection" /t REG_DWORD /d "1" /f
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\InputPersonalization" /v "RestrictImplicitInkCollection" /t REG_DWORD /d "1" /f
  2⤵
  PID:2460
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\TabletPC" /v "PreventHandwritingDataSharing" /t REG_DWORD /d "1" /f
  2⤵
  PID:2444
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\HandwritingErrorReports" /v "PreventHandwritingErrorReports" /t REG_DWORD /d "1" /f
  2⤵
  PID:4192
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Personalization\Settings" /v AcceptedPrivacyPolicy /t REG_DWORD /d "0" /f
  2⤵
  PID:1400
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\TextInput" /v "AllowLinguisticDataCollection" /t REG_DWORD /d "0" /f
  2⤵
  PID:4820
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\InputPersonalization\TrainedDataStore" /v "HarvestContacts" /t REG_DWORD /d "0" /f
  2⤵
  PID:4032
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\InputPersonalization\TrainedDataStore" /v "InsightsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2648
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo" /v "DisabledByGroupPolicy" /t REG_DWORD /d "1" /f
  2⤵
  PID:2332
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Power\EnergyEstimation\TaggedEnergy" /v "DisableTaggedEnergyLogging" /t REG_DWORD /d "1" /f
  2⤵
  PID:704
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Power\EnergyEstimation\TaggedEnergy" /v "TelemetryMaxApplication" /t REG_DWORD /d "0" /f
  2⤵
  PID:2564
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Power\EnergyEstimation\TaggedEnergy" /v "TelemetryMaxTagPerApplication" /t REG_DWORD /d "0" /f
  2⤵
  PID:3384
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4740
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\Maps" /v "AutoDownloadAndUpdateMapData" /t REG_DWORD /d "0" /f
  2⤵
  PID:404
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\Maps" /v "AllowUntriggeredNetworkTrafficOnSettingsPage" /t REG_DWORD /d "0" /f
  2⤵
  PID:2188
- C:\Windows\system32\sc.exe
  sc config MapsBroker start=disabled
  2⤵
  - Launches sc.exe
  PID:516
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "CortanaEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5116
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "CortanaConsent" /t REG_DWORD /d "0" /f
  2⤵
  PID:868
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "AllowCortana" /t REG_DWORD /d "0" /f
  2⤵
  PID:4216
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Biometrics" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4656
- C:\Windows\system32\sc.exe
  sc config WbioSrvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3588
- C:\Windows\system32\setx.exe
  setx DOTNET_CLI_TELEMETRY_OPTOUT 1
  2⤵
  PID:1004
- C:\Windows\system32\setx.exe
  setx POWERSHELL_TELEMETRY_OPTOUT 1
  2⤵
  PID:1488
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Diagnostics\Performance" /v "DisableDiagnosticTracing" /t REG_DWORD /d "1" /f
  2⤵
  PID:1872
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\Diagnostics\Performance" /v "DisableDiagnosticTracing" /t REG_DWORD /d "1" /f
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\Diagnostics\Performance" /v "DisableDiagnosticTracing" /t REG_DWORD /d "1" /f
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v "NoGenTicket" /t REG_DWORD /d "1" /f
  2⤵
  PID:1952
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClient" /disable
  2⤵
  PID:1840
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters" /v "SMB1" /t REG_DWORD /d "0" /f
  2⤵
  PID:4540
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters" /v "SMB2" /t REG_DWORD /d "0" /f
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RestrictAnonymous" /t REG_DWORD /d "1" /f
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RestrictAnonymousSAM" /t REG_DWORD /d "1" /f
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\NetBT\Parameters\Interfaces" /v "NetbiosOptions" /t REG_DWORD /d "2" /f
  2⤵
  PID:68
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Services\NetBT\Parameters\Interfaces" /v "NetbiosOptions" /t REG_DWORD /d "2" /f
  2⤵
  PID:356
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Services\NetBT\Parameters\Interfaces" /v "NetbiosOptions" /t REG_DWORD /d "2" /f
  2⤵
  PID:1712
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\NetBT\Parameters" /v "NodeType" /t REG_DWORD /d "2" /f
  2⤵
  PID:2192
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Services\NetBT\Parameters" /v "NodeType" /t REG_DWORD /d "2" /f
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Services\NetBT\Parameters" /v "NodeType" /t REG_DWORD /d "2" /f
  2⤵
  PID:4644
- C:\Windows\system32\sc.exe
  sc stop LanmanWorkstation
  2⤵
  - Launches sc.exe
  PID:4652
- C:\Windows\system32\sc.exe
  sc config LanmanWorkstation start=disabled
  2⤵
  - Launches sc.exe
  PID:2124
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" /v "RestrictNullSessAccess" /t REG_DWORD /d "1" /f
  2⤵
  PID:1564
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\LanManServer\Parameters" /v "DisableCompression" /t REG_DWORD /d "1" /f
  2⤵
  PID:2992
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe" /v "AuditLevel" /t REG_DWORD /d "8" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:2128
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\CredentialsDelegation" /v "AllowProtectedCreds" /t REG_DWORD /d "1" /f
  2⤵
  PID:4592
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "DisableRestrictedAdminOutboundCreds" /t REG_DWORD /d "1" /f
  2⤵
  PID:4816
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "DisableRestrictedAdmin" /t REG_DWORD /d "0" /f
  2⤵
  PID:1040
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Lsa" /v "RunAsPPL" /t REG_DWORD /d "1" /f
  2⤵
  - Boot or Logon Autostart Execution: LSASS Driver
  - Access Token Manipulation: Create Process with Token
  PID:1212
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest" /v "Negotiate" /t REG_DWORD /d "0" /f
  2⤵
  PID:1268
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest" /v "UseLogonCredential" /t REG_DWORD /d "0" /f
  2⤵
  PID:3928
- C:\Windows\system32\net.exe
  net user defaultuser0 /delete
  2⤵
  PID:1172
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user defaultuser0 /delete
    3⤵
    PID:4428
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Remote Assistance" /v "fAllowFullControl" /t REG_DWORD /d "0" /f
  2⤵
  PID:4344
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d "0" /f
  2⤵
  PID:4708
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\.NetFramework\v4.0.30319" /v "SchUseStrongCrypto" /t REG_DWORD /d "1" /f
  2⤵
  PID:4316
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\WOW6432Node\Microsoft\.NETFramework\v4.0.30319" /v "SchUseStrongCrypto" /t REG_DWORD /d "1" /f
  2⤵
  PID:3456
- C:\Windows\system32\reg.exe
  Reg delete HKEY_CLASSES_ROOT\ms-msdt /f
  2⤵
  - Modifies registry class
  PID:4376
- C:\Windows\system32\reg.exe
  Reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "InstallationType"
  2⤵
  PID:2120
- C:\Windows\system32\find.exe
  find /I "Server Core"
  2⤵
  PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get TotalVisibleMemorySize /format:value
  2⤵
  PID:4448
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get TotalVisibleMemorySize /format:value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2456
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d "4193772" /f
  2⤵
  PID:1652
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d "4193772" /f
  2⤵
  PID:3744
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d "4193772" /f
  2⤵
  PID:2536
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v "IOPageLockLimit" /t REG_DWORD /d "4193772" /f
  2⤵
  PID:4232
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Session Manager" /v "HeapDeCommitFreeBlockThreshold" /t REG_DWORD /d "262144" /f
  2⤵
  PID:4136
- C:\Windows\system32\bcdedit.exe
  bcdedit /set pae ForceEnable
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command $ErrorActionPreference = 'SilentlyContinue';Disable-NetAdapterPowerManagement -Name "*";Set-NetOffloadGlobalSetting -PacketCoalescingFilter Disabled -Chimney Disabled;Set-NetTCPSetting -SettingName "Internet" -MemoryPressureProtection Disabled
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip show interface | findstr /I "connected"
  2⤵
  PID:5004
- - C:\Windows\system32\netsh.exe
    netsh interface ip show interface
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1564
- - C:\Windows\system32\findstr.exe
    findstr /I "connected"
    3⤵
    PID:2296
- C:\Windows\system32\netsh.exe
  netsh interface ipv6 set interface 1 weakhostreceive=enabled weakhostsend=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4272
- C:\Windows\system32\netsh.exe
  netsh interface ipv4 set interface 1 weakhostreceive=enabled weakhostsend=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1028
- C:\Windows\system32\netsh.exe
  netsh interface ipv6 set interface 2 weakhostreceive=enabled weakhostsend=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3928
- C:\Windows\system32\netsh.exe
  netsh interface ipv4 set interface 2 weakhostreceive=enabled weakhostsend=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3240
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings" /v "DownloadMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:4324
- C:\Windows\system32\netsh.exe
  netsh int tcp set global ecncapability=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp show supplemental | findstr /I "template"
  2⤵
  PID:4124
- - C:\Windows\system32\netsh.exe
    netsh int tcp show supplemental
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2788
- - C:\Windows\system32\findstr.exe
    findstr /I "template"
    3⤵
    PID:5076
- C:\Windows\system32\netsh.exe
  netsh int tcp set supplemental internet CongestionProvider=bbr2
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1768
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\MSMQ\Parameters" /v "TCPNoDelay" /t REG_DWORD /d "1" /f
  2⤵
  PID:3396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" /f "ServiceName" /s |findstr /i /l "ServiceName"
  2⤵
  PID:924
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards" /f "ServiceName" /s
    3⤵
    PID:4916
- - C:\Windows\system32\findstr.exe
    findstr /i /l "ServiceName"
    3⤵
    PID:2028
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{43BFA3A2-555C-47A1-A0B5-442C8020DD48}" /v "TCPNoDelay" /t REG_DWORD /d "1" /f
  2⤵
  PID:2272
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{43BFA3A2-555C-47A1-A0B5-442C8020DD48}" /v "TcpAckFrequency" /t REG_DWORD /d "1" /f
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{43BFA3A2-555C-47A1-A0B5-442C8020DD48}" /v "TcpDelAckTicks" /t REG_DWORD /d "0" /f
  2⤵
  PID:5064
- C:\Windows\system32\netsh.exe
  netsh winsock set autotuning on
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get numberOfCores /format:value
  2⤵
  PID:824
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get numberOfCores /format:value
    3⤵
    PID:96
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" /k /v /f "Description" /s /e | findstr /ri "REG_SZ"
  2⤵
  PID:4140
- - C:\Windows\system32\reg.exe
    Reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" /k /v /f "Description" /s /e
    3⤵
    PID:1692
- - C:\Windows\system32\findstr.exe
    findstr /ri "REG_SZ"
    3⤵
    PID:820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKLM\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}" /s /f "RTL8139C+ Fast Ethernet NIC" /d | findstr /C:"HKEY"
  2⤵
  PID:5096
- - C:\Windows\system32\reg.exe
    Reg query "HKLM\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}" /s /f "RTL8139C+ Fast Ethernet NIC" /d
    3⤵
    PID:3176
- - C:\Windows\system32\findstr.exe
    findstr /C:"HKEY"
    3⤵
    PID:1696
- C:\Windows\system32\reg.exe
  Reg export "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" "C:\Backup\(Default) RTL8139C+ Fast Ethernet NIC.reg" /y
  2⤵
  PID:4600
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*WakeOnMagicPacket" /t REG_SZ /d "0" /f
  2⤵
  PID:3792
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*WakeOnPattern" /t REG_SZ /d "0" /f
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "WakeOnLink" /t REG_SZ /d "0" /f
  2⤵
  PID:2460
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "S5WakeOnLan" /t REG_SZ /d "0" /f
  2⤵
  PID:1572
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "WolShutdownLinkSpeed" /t REG_SZ /d "2" /f
  2⤵
  PID:4192
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*ModernStandbyWoLMagicPacket " /t REG_SZ /d "0" /f
  2⤵
  PID:1400
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*DeviceSleepOnDisconnect" /t REG_SZ /d "0" /f
  2⤵
  PID:4820
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*NicAutoPowerSaver" /t REG_SZ /d "0" /f
  2⤵
  PID:4032
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*FlowControl" /t REG_SZ /d "0" /f
  2⤵
  PID:2648
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*EEE" /t REG_SZ /d "0" /f
  2⤵
  PID:2332
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnablePME" /t REG_SZ /d "0" /f
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EEELinkAdvertisement" /t REG_SZ /d "0" /f
  2⤵
  PID:704
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ReduceSpeedOnPowerDown" /t REG_SZ /d "0" /f
  2⤵
  PID:4200
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "PowerSavingMode" /t REG_SZ /d "0" /f
  2⤵
  PID:1580
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnableGreenEthernet" /t REG_SZ /d "0" /f
  2⤵
  PID:5080
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ULPMode" /t REG_SZ /d "0" /f
  2⤵
  PID:2056
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "GigaLite" /t REG_SZ /d "0" /f
  2⤵
  PID:380
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnableSavePowerNow" /t REG_SZ /d "0" /f
  2⤵
  PID:2580
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnablePowerManagement" /t REG_SZ /d "0" /f
  2⤵
  PID:5116
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnableDynamicPowerGating" /t REG_SZ /d "0" /f
  2⤵
  PID:868
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "EnableConnectedPowerGating" /t REG_SZ /d "0" /f
  2⤵
  PID:4216
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "AutoPowerSaveModeEnabled" /t REG_SZ /d "0" /f
  2⤵
  PID:4656
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "AutoDisableGigabit" /t REG_SZ /d "0" /f
  2⤵
  PID:3288
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "AdvancedEEE" /t REG_SZ /d "0" /f
  2⤵
  PID:3124
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "PowerDownPll" /t REG_SZ /d "0" /f
  2⤵
  PID:2676
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "S5NicKeepOverrideMacAddrV2" /t REG_SZ /d "0" /f
  2⤵
  PID:1464
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "MIMOPowerSaveMode" /t REG_SZ /d "3" /f
  2⤵
  PID:3424
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "AlternateSemaphoreDelay" /t REG_SZ /d "0" /f
  2⤵
  PID:588
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*interruptmoderation" /t REG_SZ /d "0" /f
  2⤵
  PID:364
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "JumboPacket" /t REG_SZ /d "0" /f
  2⤵
  PID:592
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ITR" /t REG_SZ /d "125" /f
  2⤵
  PID:3052
- C:\Windows\system32\reg.exe
  Reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ReceiveBuffers" /f
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  Reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "TransmitBuffers" /f
  2⤵
  PID:2988
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "ThroughputBoosterEnabled" /t REG_SZ /d "1" /f
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "PnPCapabilities" /t REG_DWORD /d "24" /f
  2⤵
  PID:68
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "LsoV1IPv4" /t REG_SZ /d "1" /f
  2⤵
  PID:1104
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "LsoV2IPv4" /t REG_SZ /d "1" /f
  2⤵
  PID:2256
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "LsoV2IPv6" /t REG_SZ /d "1" /f
  2⤵
  PID:2024
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "TCPUDPChecksumOffloadIPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "TCPUDPChecksumOffloadIPv6" /t REG_SZ /d "3" /f
  2⤵
  PID:4644
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "UDPChecksumOffloadIPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "UDPChecksumOffloadIPv6" /t REG_SZ /d "3" /f
  2⤵
  PID:4104
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "TCPChecksumOffloadIPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:2916
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "TCPChecksumOffloadIPv6" /t REG_SZ /d "3" /f
  2⤵
  PID:5084
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "IPChecksumOffloadIPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:3596
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "IPsecOffloadV1IPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:4628
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "IPsecOffloadV2" /t REG_SZ /d "3" /f
  2⤵
  PID:4276
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*IPsecOffloadV2IPv4" /t REG_SZ /d "3" /f
  2⤵
  PID:2992
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*PMARPOffload" /t REG_SZ /d "1" /f
  2⤵
  PID:1832
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*PMNSOffload" /t REG_SZ /d "1" /f
  2⤵
  PID:1788
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*PMWiFiRekeyOffload" /t REG_SZ /d "1" /f
  2⤵
  PID:5004
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "RSS" /t REG_SZ /d "1" /f
  2⤵
  PID:4256
- C:\Windows\system32\reg.exe
  Reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*NumRssQueues" /t REG_SZ /d "2" /f
  2⤵
  PID:3728
- C:\Windows\system32\reg.exe
  Reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*RssBaseProcNumber" /f
  2⤵
  PID:2740
- C:\Windows\system32\reg.exe
  Reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001" /v "*RssMaxProcNumber" /f
  2⤵
  PID:1060
- C:\Windows\system32\netsh.exe
  netsh int tcp set global rss=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1668
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport udp start=1025 num=64511
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1540
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4316
- C:\Windows\system32\netsh.exe
  Netsh int ip set global taskoffload=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:684
- C:\Windows\system32\reg.exe
  Reg add HKLM\System\CurrentControlSet\Services\TCPIP\Parameters /v DisableTaskOffload /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:1560
- C:\Windows\system32\reg.exe
  Reg add HKLM\System\CurrentControlSet\Services\Ipsec /v EnabledOffload /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2788
- C:\Windows\system32\sc.exe
  sc query MMCSS
  2⤵
  - Launches sc.exe
  PID:1688
- C:\Windows\system32\find.exe
  find "STOPPED"
  2⤵
  PID:3684
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Latency Sensitive" /t REG_SZ /d "True" /f
  2⤵
  PID:3396
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Scheduling Category" /t REG_SZ /d "High" /f
  2⤵
  PID:3088
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "SFIO Priority" /t REG_SZ /d "High" /f
  2⤵
  PID:504
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Priority" /t REG_DWORD /d "8" /f
  2⤵
  PID:2352
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Control\GraphicsDrivers" /v "IOMMUFlags" /t REG_DWORD /d 0 /f
  2⤵
  PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_VideoController get PNPDeviceID | find "PCI\VEN_"
  2⤵
  PID:2656
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_VideoController get PNPDeviceID
    3⤵
    PID:5064
- - C:\Windows\system32\find.exe
    find "PCI\VEN_"
    3⤵
    PID:1588
- C:\Windows\system32\reg.exe
  reg query "HKLM\System\CurrentControlSet\Enum\PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\3&11583659&0&08\Device Parameters\Interrupt Management\MessageSignaledInterruptProperties" /v "MSISupported"
  2⤵
  PID:192
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications" /v "GlobalUserDisabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:204
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\Policies\Microsoft\Windows\AppPrivacy" /v "LetAppsRunInBackground" /t REG_DWORD /d "2" /f
  2⤵
  PID:32
- C:\Windows\system32\reg.exe
  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "BackgroundAppGlobalToggle" /t REG_DWORD /d "0" /f
  2⤵
  PID:616
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:820
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4556
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2756
- C:\Windows\system32\powercfg.exe
  powercfg /h off
  2⤵
  - Power Settings
  PID:4112
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn "\microsoft\windows\power efficiency diagnostics\analyzesystem" /disable
  2⤵
  PID:2408
- C:\Windows\system32\wevtutil.exe
  wevtutil set-log "Microsoft-Windows-SleepStudy/Diagnostic" /e:False
  2⤵
  PID:4408
- C:\Windows\system32\wevtutil.exe
  wevtutil set-log "Microsoft-Windows-Kernel-Processor-Power/Diagnostic" /e:False
  2⤵
  PID:408
- C:\Windows\system32\wevtutil.exe
  wevtutil set-log "Microsoft-Windows-UserModePowerService/Diagnostic" /e:False
  2⤵
  PID:2684
- C:\Windows\system32\reg.exe
  Reg query "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "Win32PrioritySeparation"
  2⤵
  PID:1804
- C:\Windows\system32\find.exe
  find "0x18"
  2⤵
  PID:2716
- C:\Windows\system32\reg.exe
  Reg query "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "Win32PrioritySeparation"
  2⤵
  PID:1700
- C:\Windows\system32\find.exe
  find "0x26"
  2⤵
  PID:224
- C:\Windows\system32\fsutil.exe
  fsutil behavior set memoryusage 2
  2⤵
  PID:3640
- C:\Windows\system32\fsutil.exe
  fsutil behavior set mftzone 2
  2⤵
  PID:5072
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disabledeletenotify 0
  2⤵
  PID:3040
- C:\Windows\system32\fsutil.exe
  fsutil behavior set encryptpagingfile 0
  2⤵
  PID:2288
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disable8dot3 1
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d "1" /f
  2⤵
  PID:2564
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d "1" /f
  2⤵
  PID:3384
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d "1" /f
  2⤵
  PID:4904
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disablecompression 1
  2⤵
  PID:404
- C:\Windows\System32\Wbem\WMIC.exe
  wmic logicaldisk where "DriveType='3' and DeviceID='C:'" get DeviceID
  2⤵
  PID:2188
- C:\Windows\system32\find.exe
  find "C:"
  2⤵
  PID:2056
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disableLastAccess 0
  2⤵
  PID:3092
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\FileSystem" /v "NtfsDisableLastAccessUpdate" /t REG_DWORD /d "2147483648" /f
  2⤵
  PID:3892
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\FileSystem" /v "NtfsDisableLastAccessUpdate" /t REG_DWORD /d "2147483648" /f
  2⤵
  PID:2936
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\FileSystem" /v "NtfsDisableLastAccessUpdate" /t REG_DWORD /d "2147483648" /f
  2⤵
  PID:3444
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\NvTelemetryContainer" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3112
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Services\NvTelemetryContainer" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4672
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Services\NvTelemetryContainer" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3036
- C:\Windows\system32\sc.exe
  sc stop NvTelemetyContainer
  2⤵
  - Launches sc.exe
  PID:4784
- C:\Windows\system32\sc.exe
  sc config NvTelemetyContainer start=disabled
  2⤵
  - Launches sc.exe
  PID:1772
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\NVIDIA Corporation\NvControlPanel2\Client" /v "OptInOrOutPreference" /t REG_DWORD /d 0 /f
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Services\nvlddmkm\Global\Startup" /v "SendTelemetryData" /t REG_DWORD /d "0" /f
  2⤵
  PID:2696
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\NVIDIA Corporation\Global\FTS" /v "EnableRID44231" /t REG_DWORD /d 0 /f
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\NVIDIA Corporation\Global\FTS" /v "EnableRID64640" /t REG_DWORD /d 0 /f
  2⤵
  PID:4540
- C:\Windows\system32\reg.exe
  Reg add "HKLM\Software\NVIDIA Corporation\Global\FTS" /v "EnableRID66610" /t REG_DWORD /d 0 /f
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  Reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "NvBackend" /f
  2⤵
  PID:4664
- C:\Windows\system32\schtasks.exe
  schtasks /change /disable /tn "NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}"
  2⤵
  PID:1604
- C:\Windows\system32\schtasks.exe
  schtasks /change /disable /tn "NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}"
  2⤵
  PID:4208
- C:\Windows\system32\schtasks.exe
  schtasks /change /disable /tn "NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}"
  2⤵
  PID:356
- C:\Windows\system32\schtasks.exe
  schtasks /change /disable /tn "NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}"
  2⤵
  PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query "HKLM\System\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /t REG_SZ /s /e /f "NVIDIA" | findstr "HKEY"
  2⤵
  PID:2192
- - C:\Windows\system32\reg.exe
    Reg query "HKLM\System\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" /t REG_SZ /s /e /f "NVIDIA"
    3⤵
    PID:2024
- - C:\Windows\system32\findstr.exe
    findstr "HKEY"
    3⤵
    PID:4812
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue useplatformclock
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4652
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5092
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\Control Panel\PowerCfg\GlobalPowerPolicy" /v "Policies" /t REG_BINARY /d "01000000020000000100000000000000020000000000000000000000000000002c0100003232030304000000040000000000000000000000840300002c01000000000000840300000001646464640000" /f
  2⤵
  - Power Settings
  PID:1192
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\System\Services\NetBT\Parameters" /v "CsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1396
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\System\Services\NetBT\Parameters" /v "CsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3132
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\System\Services\NetBT\Parameters" /v "CsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3636
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\System\Services\NetBT\Parameters" /v "PlatformAoAcOverride" /t REG_DWORD /d "0" /f
  2⤵
  PID:4592
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\System\Services\NetBT\Parameters" /v "PlatformAoAcOverride" /t REG_DWORD /d "0" /f
  2⤵
  PID:484
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\System\Services\NetBT\Parameters" /v "PlatformAoAcOverride" /t REG_DWORD /d "0" /f
  2⤵
  PID:2128
- C:\Windows\system32\powercfg.exe
  powercfg /duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61 bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb
  2⤵
  - Power Settings
  PID:4432
- C:\Windows\system32\powercfg.exe
  powercfg /setactive bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb
  2⤵
  - Power Settings
  PID:1224
- C:\Windows\system32\powercfg.exe
  powercfg /delete eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee
  2⤵
  - Power Settings
  PID:4816
- C:\Windows\system32\powercfg.exe
  powercfg /duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61 eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee
  2⤵
  - Power Settings
  PID:4272
- C:\Windows\system32\powercfg.exe
  powercfg /setactive eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee
  2⤵
  - Power Settings
  PID:920
- C:\Windows\system32\powercfg.exe
  powercfg /delete bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb
  2⤵
  - Power Settings
  PID:1212
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor THROTTLING 0
  2⤵
  - Power Settings
  PID:2016
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_none DEVICEIDLE 0
  2⤵
  - Power Settings
  PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo AMD64 Family 6 Model 13 Stepping 2, AuthenticAMD "
  2⤵
  PID:1172
- C:\Windows\system32\find.exe
  find /I "Intel"
  2⤵
  PID:4796
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\CurrentControlSet\Control\Power\PowerSettings\48df9d60-4f68-11dc-8314-0800200c9a66\07029cd8-4664-4698-95d8-43b2e9666596" /v "ACSettingIndex" /t REG_DWORD /d "0" /f
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet001\Control\Power\PowerSettings\48df9d60-4f68-11dc-8314-0800200c9a66\07029cd8-4664-4698-95d8-43b2e9666596" /v "ACSettingIndex" /t REG_DWORD /d "0" /f
  2⤵
  PID:352
- C:\Windows\system32\reg.exe
  Reg add "HKLM\System\ControlSet002\Control\Power\PowerSettings\48df9d60-4f68-11dc-8314-0800200c9a66\07029cd8-4664-4698-95d8-43b2e9666596" /v "ACSettingIndex" /t REG_DWORD /d "0" /f
  2⤵
  PID:4328
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFAUTONOMOUS 1
  2⤵
  - Power Settings
  PID:3240
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFAUTONOMOUSWINDOW 1000
  2⤵
  - Power Settings
  PID:4248
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFEPP 0
  2⤵
  - Power Settings
  PID:684
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFBOOSTMODE 1
  2⤵
  - Power Settings
  PID:1560
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PERFBOOSTPOL 100
  2⤵
  - Power Settings
  PID:2788
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP AWAYMODE 0
  2⤵
  - Power Settings
  PID:3068
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP ALLOWSTANDBY 0
  2⤵
  - Power Settings
  PID:816
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP HYBRIDSLEEP 0
  2⤵
  - Power Settings
  PID:2536
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_SLEEP UNATTENDSLEEP 0
  2⤵
  - Power Settings
  PID:788
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_IR DEEPSLEEP 0
  2⤵
  - Power Settings
  PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo AMD64 Family 6 Model 13 Stepping 2, AuthenticAMD "
  2⤵
  PID:924
- C:\Windows\system32\find.exe
  find /I "Intel"
  2⤵
  PID:504
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_INTSTEER UNPARKTIME 0
  2⤵
  - Power Settings
  PID:4300
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_INTSTEER PERPROCLOAD 10000
  2⤵
  - Power Settings
  PID:2208
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor PROCTHROTTLEMIN 100
  2⤵
  - Power Settings
  PID:3584
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor SHORTSCHEDPOLICY 2
  2⤵
  - Power Settings
  PID:5064
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor SCHEDPOLICY 2
  2⤵
  - Power Settings
  PID:1588
- C:\Windows\system32\powercfg.exe
  powercfg /change standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:164
- C:\Windows\system32\powercfg.exe
  powercfg /change monitor-timeout-ac 0
  2⤵
  - Power Settings
  PID:824
- C:\Windows\system32\powercfg.exe
  powercfg /change hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:4880
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  PID:3192
- C:\Windows\system32\powercfg.exe
  powercfg -changename scheme_current "CoutX Ultimate Performance" "For CoutX Optimizer 2.1.1 (dsc.gg/CoutX) By UnLovedCookie"
  2⤵
  - Power Settings
  PID:4140
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableDeviceThrottling
  2⤵
  - Modifies registry key
  PID:3176
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:4556
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableDeviceThrottlingRan
  2⤵
  - Modifies registry key
  PID:780
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:4112
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableMitigations
  2⤵
  - Modifies registry key
  PID:392
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableMitigationsgRan
  2⤵
  - Modifies registry key
  PID:2428
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:2684
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableGPUThrottling
  2⤵
  - Modifies registry key
  PID:1572
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:2716
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableGPUThrottlingRan
  2⤵
  - Modifies registry key
  PID:1400
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:224
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableCPUThrottling
  2⤵
  - Modifies registry key
  PID:3040
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:2332
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v DisableCPUThrottlingRan
  2⤵
  - Modifies registry key
  PID:4612
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:2948
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v ExTweaks
  2⤵
  - Modifies registry key
  PID:3384
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:4604
- C:\Windows\system32\reg.exe
  Reg query HKCU\Software\CoutX /v ExTweaksRan
  2⤵
  - Modifies registry key
  PID:404
- C:\Windows\system32\find.exe
  find "0x1"
  2⤵
  PID:2580
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:1896
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  PID:372
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3128
- C:\Windows\system32\taskkill.exe
  taskkill /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2912
- C:\Windows\system32\taskkill.exe
  taskkill /f /im MinSudo.exe
  2⤵
  - Kills process with taskkill
  PID:4824
- C:\Windows\system32\taskkill.exe
  taskkill /f /im fsutil.exe
  2⤵
  - Kills process with taskkill
  PID:1128

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

LSASS Driver

T1547.008

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

LSASS Driver

T1547.008

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\REG8EC3.tmp

Filesize
11KB

MD5
97053ab490ed4ac48a439547c1189b04

SHA1
26c659515d83dc7066ebd3df011cd05e8c15b1fa

SHA256
0278b6fc608071ef38e89e0307af3e703f45a7e5243c15f4587389e5a1fd98b2

SHA512
9995fd3c1b4b8e3024e8c23738f4b2dc23781a139074786e59ae340bbd54090b4faa2bd169032bdd70a487cef7f063398e874022369f70f487883f8a2212c6c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u3gqh01j.fpe.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Windows\Logs\DISM\dism.log

Filesize
226KB

MD5
d818e043d65062f26d19ee879682892b

SHA1
1ef65d3e6e1f852b51c803eeefbca69bbc540545

SHA256
124b02e77b7aa0be5389a3347d23de024457d2a14ba091f8d9dbf6240b590445

SHA512
a93a06505e0396224de789098e11e783fc4efb35ccafce8e607ceb7c250aa7bf1e233a514f0cd452b55c8aea8edec659470b4ce295bb91580d0f43a68fccc60c

Download Submit
memory/872-10-0x0000023C2EC30000-0x0000023C2EC52000-memory.dmp

Filesize
136KB

Download
memory/872-13-0x0000023C46F70000-0x0000023C46FE6000-memory.dmp

Filesize
472KB

Download
memory/4156-254-0x000001C814700000-0x000001C814800000-memory.dmp

Filesize
1024KB

Download
memory/4156-259-0x000001C814F00000-0x000001C814F20000-memory.dmp

Filesize
128KB

Download
memory/4156-279-0x000001C815120000-0x000001C815140000-memory.dmp

Filesize
128KB

Download