a32ac8894917da3ea40a4b544b7d0e67b0aaec406589ad0060bfacfbb8099b63

Analysis

max time kernel
213s
max time network
264s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

priv pallet lock.bat
Size

5KB
MD5

28aa4fdc961537cbe5f1049512b2f5e2
SHA1

e14dafcfa5eeee6809df73d92c376da9f16c0464
SHA256

a32ac8894917da3ea40a4b544b7d0e67b0aaec406589ad0060bfacfbb8099b63
SHA512

70bfced1aa6327cbd90214ad0d40870b4870f45db1a0dee4a30ffdddd48448477432f9733bca9eae5536b3ba551e2f82bc9b99d60dae526776633684debb4270
SSDEEP

96:BhHJjdoSELCunlubho+A+FQTYtfbs5xeq3:BhHNunlubho+A+FQTM4xeq3

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Indirect Command Execution 1 TTPs 3 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
5016	forfiles.exe
2612	forfiles.exe
4724	forfiles.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3400	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 3 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4456	powercfg.exe
3504	powercfg.exe
4792	powercfg.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2772	powershell.exe
1068	powershell.exe
3400	powershell.exe
2036	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 60 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4156	netsh.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2220	timeout.exe
4048	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
184	powershell.exe
184	powershell.exe
2772	powershell.exe
2772	powershell.exe
1068	powershell.exe
1068	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	184	powershell.exe
Token: SeIncreaseQuotaPrivilege	184	powershell.exe
Token: SeSecurityPrivilege	184	powershell.exe
Token: SeTakeOwnershipPrivilege	184	powershell.exe
Token: SeLoadDriverPrivilege	184	powershell.exe
Token: SeSystemProfilePrivilege	184	powershell.exe
Token: SeSystemtimePrivilege	184	powershell.exe
Token: SeProfSingleProcessPrivilege	184	powershell.exe
Token: SeIncBasePriorityPrivilege	184	powershell.exe
Token: SeCreatePagefilePrivilege	184	powershell.exe
Token: SeBackupPrivilege	184	powershell.exe
Token: SeRestorePrivilege	184	powershell.exe
Token: SeShutdownPrivilege	184	powershell.exe
Token: SeDebugPrivilege	184	powershell.exe
Token: SeSystemEnvironmentPrivilege	184	powershell.exe
Token: SeRemoteShutdownPrivilege	184	powershell.exe
Token: SeUndockPrivilege	184	powershell.exe
Token: SeManageVolumePrivilege	184	powershell.exe
Token: 33	184	powershell.exe
Token: 34	184	powershell.exe
Token: 35	184	powershell.exe
Token: 36	184	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeIncreaseQuotaPrivilege	2772	powershell.exe
Token: SeSecurityPrivilege	2772	powershell.exe
Token: SeTakeOwnershipPrivilege	2772	powershell.exe
Token: SeLoadDriverPrivilege	2772	powershell.exe
Token: SeSystemProfilePrivilege	2772	powershell.exe
Token: SeSystemtimePrivilege	2772	powershell.exe
Token: SeProfSingleProcessPrivilege	2772	powershell.exe
Token: SeIncBasePriorityPrivilege	2772	powershell.exe
Token: SeCreatePagefilePrivilege	2772	powershell.exe
Token: SeBackupPrivilege	2772	powershell.exe
Token: SeRestorePrivilege	2772	powershell.exe
Token: SeShutdownPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeSystemEnvironmentPrivilege	2772	powershell.exe
Token: SeRemoteShutdownPrivilege	2772	powershell.exe
Token: SeUndockPrivilege	2772	powershell.exe
Token: SeManageVolumePrivilege	2772	powershell.exe
Token: 33	2772	powershell.exe
Token: 34	2772	powershell.exe
Token: 35	2772	powershell.exe
Token: 36	2772	powershell.exe
Token: SeIncreaseQuotaPrivilege	2772	powershell.exe
Token: SeSecurityPrivilege	2772	powershell.exe
Token: SeTakeOwnershipPrivilege	2772	powershell.exe
Token: SeLoadDriverPrivilege	2772	powershell.exe
Token: SeSystemProfilePrivilege	2772	powershell.exe
Token: SeSystemtimePrivilege	2772	powershell.exe
Token: SeProfSingleProcessPrivilege	2772	powershell.exe
Token: SeIncBasePriorityPrivilege	2772	powershell.exe
Token: SeCreatePagefilePrivilege	2772	powershell.exe
Token: SeBackupPrivilege	2772	powershell.exe
Token: SeRestorePrivilege	2772	powershell.exe
Token: SeShutdownPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeSystemEnvironmentPrivilege	2772	powershell.exe
Token: SeRemoteShutdownPrivilege	2772	powershell.exe
Token: SeUndockPrivilege	2772	powershell.exe
Token: SeManageVolumePrivilege	2772	powershell.exe
Token: 33	2772	powershell.exe
Token: 34	2772	powershell.exe
Token: 35	2772	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2220	2368	cmd.exe	112
PID 2368 wrote to memory of 2220	2368	cmd.exe	112
PID 2368 wrote to memory of 1804	2368	cmd.exe	113
PID 2368 wrote to memory of 1804	2368	cmd.exe	113
PID 2368 wrote to memory of 3784	2368	cmd.exe	114
PID 2368 wrote to memory of 3784	2368	cmd.exe	114
PID 2368 wrote to memory of 4156	2368	cmd.exe	115
PID 2368 wrote to memory of 4156	2368	cmd.exe	115
PID 2368 wrote to memory of 3360	2368	cmd.exe	116
PID 2368 wrote to memory of 3360	2368	cmd.exe	116
PID 2368 wrote to memory of 3620	2368	cmd.exe	117
PID 2368 wrote to memory of 3620	2368	cmd.exe	117
PID 2368 wrote to memory of 916	2368	cmd.exe	118
PID 2368 wrote to memory of 916	2368	cmd.exe	118
PID 2368 wrote to memory of 2972	2368	cmd.exe	119
PID 2368 wrote to memory of 2972	2368	cmd.exe	119
PID 2368 wrote to memory of 4036	2368	cmd.exe	120
PID 2368 wrote to memory of 4036	2368	cmd.exe	120
PID 2368 wrote to memory of 5100	2368	cmd.exe	121
PID 2368 wrote to memory of 5100	2368	cmd.exe	121
PID 2368 wrote to memory of 4784	2368	cmd.exe	122
PID 2368 wrote to memory of 4784	2368	cmd.exe	122
PID 2368 wrote to memory of 996	2368	cmd.exe	123
PID 2368 wrote to memory of 996	2368	cmd.exe	123
PID 2368 wrote to memory of 4576	2368	cmd.exe	124
PID 2368 wrote to memory of 4576	2368	cmd.exe	124
PID 2368 wrote to memory of 1944	2368	cmd.exe	195
PID 2368 wrote to memory of 1944	2368	cmd.exe	195
PID 2368 wrote to memory of 2684	2368	cmd.exe	198
PID 2368 wrote to memory of 2684	2368	cmd.exe	198
PID 2368 wrote to memory of 1652	2368	cmd.exe	303
PID 2368 wrote to memory of 1652	2368	cmd.exe	303
PID 2368 wrote to memory of 4332	2368	cmd.exe	305
PID 2368 wrote to memory of 4332	2368	cmd.exe	305
PID 2368 wrote to memory of 2176	2368	cmd.exe	129
PID 2368 wrote to memory of 2176	2368	cmd.exe	129
PID 2368 wrote to memory of 2564	2368	cmd.exe	130
PID 2368 wrote to memory of 2564	2368	cmd.exe	130
PID 2368 wrote to memory of 3580	2368	cmd.exe	209
PID 2368 wrote to memory of 3580	2368	cmd.exe	209
PID 2368 wrote to memory of 4972	2368	cmd.exe	211
PID 2368 wrote to memory of 4972	2368	cmd.exe	211
PID 2368 wrote to memory of 184	2368	cmd.exe	133
PID 2368 wrote to memory of 184	2368	cmd.exe	133
PID 2368 wrote to memory of 2772	2368	cmd.exe	136
PID 2368 wrote to memory of 2772	2368	cmd.exe	136
PID 2368 wrote to memory of 1068	2368	cmd.exe	238
PID 2368 wrote to memory of 1068	2368	cmd.exe	238
PID 2368 wrote to memory of 2184	2368	cmd.exe	138
PID 2368 wrote to memory of 2184	2368	cmd.exe	138
PID 2368 wrote to memory of 4692	2368	cmd.exe	139
PID 2368 wrote to memory of 4692	2368	cmd.exe	139
PID 2368 wrote to memory of 376	2368	cmd.exe	140
PID 2368 wrote to memory of 376	2368	cmd.exe	140
PID 2368 wrote to memory of 4280	2368	cmd.exe	141
PID 2368 wrote to memory of 4280	2368	cmd.exe	141
PID 2368 wrote to memory of 2608	2368	cmd.exe	243
PID 2368 wrote to memory of 2608	2368	cmd.exe	243
PID 2368 wrote to memory of 1968	2368	cmd.exe	244
PID 2368 wrote to memory of 1968	2368	cmd.exe	244
PID 2368 wrote to memory of 4596	2368	cmd.exe	245
PID 2368 wrote to memory of 4596	2368	cmd.exe	245
PID 2368 wrote to memory of 1964	2368	cmd.exe	246
PID 2368 wrote to memory of 1964	2368	cmd.exe	246

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\priv pallet lock.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:2220
- C:\Windows\system32\netsh.exe
  netsh int tcp set global autotuninglevel=normal
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1804
- C:\Windows\system32\netsh.exe
  netsh interface 6to4 set state disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3784
- C:\Windows\system32\netsh.exe
  netsh int tcp set global timestamps=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:4156
- C:\Windows\system32\netsh.exe
  netsh int tcp set heuristics disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3360
- C:\Windows\system32\netsh.exe
  netsh int tcp set global chimney=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3620
- C:\Windows\system32\netsh.exe
  netsh int tcp set global ecncapability=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:916
- C:\Windows\system32\netsh.exe
  netsh int tcp set global rsc=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2972
- C:\Windows\system32\netsh.exe
  netsh int tcp set global nonsackrttresiliency=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4036
- C:\Windows\system32\netsh.exe
  netsh int tcp set security mpp=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5100
- C:\Windows\system32\netsh.exe
  netsh int tcp set security profiles=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4784
- C:\Windows\system32\netsh.exe
  netsh int ip set global icmpredirects=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:996
- C:\Windows\system32\netsh.exe
  netsh int tcp set security mpp=disabled profiles=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4576
- C:\Windows\system32\netsh.exe
  netsh int tcp set supplemental internet congestionprovider=ctcp
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1944
- C:\Windows\system32\netsh.exe
  netsh interface teredo set state disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2684
- C:\Windows\system32\netsh.exe
  netsh winsock set autotuning on
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1652
- C:\Windows\system32\netsh.exe
  netsh int isatap set state disable
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4332
- C:\Windows\system32\netsh.exe
  netsh int ip set global taskoffload=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2176
- C:\Windows\system32\netsh.exe
  netsh int ip set global neighborcachelimit=4096
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2564
- C:\Windows\system32\netsh.exe
  netsh int ip set global routecachelimit=4096
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3580
- C:\Windows\system32\netsh.exe
  netsh int ip set global sourceroutingbehavior=drop
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell Disable-NetAdapterLso -Name "*"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "ForEach($adapter In Get-NetAdapter){Disable-NetAdapterPowerManagement -Name $adapter.Name -ErrorAction SilentlyContinue}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "ForEach($adapter In Get-NetAdapter){Disable-NetAdapterLso -Name $adapter.Name -ErrorAction SilentlyContinue}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "Tcp1323Opts" /t REG_DWORD /d "0" /f
  2⤵
  PID:2184
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxDupAcks" /t REG_DWORD /d "2" /f
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpTimedWaitDelay" /t REG_DWORD /d "32" /f
  2⤵
  PID:376
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "GlobalMaxTcpWindowSize" /t REG_DWORD /d "8760" /f
  2⤵
  PID:4280
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpWindowSize" /t REG_DWORD /d "8760" /f
  2⤵
  PID:2608
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxConnectionsPerServer" /t REG_DWORD /d "0" /f
  2⤵
  PID:1968
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxUserPort" /t REG_DWORD /d "65534" /f
  2⤵
  PID:4596
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "SackOpts" /t REG_DWORD /d "0" /f
  2⤵
  PID:1964
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DefaultTTL" /t REG_DWORD /d "64" /f
  2⤵
  PID:3204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_networkadapter get GUID | findstr "{"
  2⤵
  PID:5104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_networkadapter get GUID
    3⤵
    PID:4048
- - C:\Windows\system32\findstr.exe
    findstr "{"
    3⤵
    PID:4828
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{AB1848B7-436A-497A-AE43-DB91F91E6C8E}" /v "TcpAckFrequency" /t REG_DWORD /d "1" /f
  2⤵
  PID:876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_networkadapter get GUID | findstr "{"
  2⤵
  PID:3784
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_networkadapter get GUID
    3⤵
    PID:404
- - C:\Windows\system32\findstr.exe
    findstr "{"
    3⤵
    PID:2776
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{AB1848B7-436A-497A-AE43-DB91F91E6C8E}" /v "TcpDelAckTicks" /t REG_DWORD /d "0" /f
  2⤵
  PID:3568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_networkadapter get GUID | findstr "{"
  2⤵
  PID:944
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_networkadapter get GUID
    3⤵
    PID:1908
- - C:\Windows\system32\findstr.exe
    findstr "{"
    3⤵
    PID:384
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{AB1848B7-436A-497A-AE43-DB91F91E6C8E}" /v "TCPNoDelay" /t REG_DWORD /d "1" /f
  2⤵
  PID:3112
- C:\Windows\system32\powercfg.exe
  powercfg import "C:\ExcusesFN"
  2⤵
  - Power Settings
  PID:4456
- C:\Windows\system32\forfiles.exe
  forfiles -p "C:\Windows\prefetch" -s -m *.* /C "cmd /c del @path"
  2⤵
  - Indirect Command Execution
  PID:5016
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\AgAppLaunch.db"
    3⤵
    PID:2408
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\AgGlFaultHistory.db"
    3⤵
    PID:2904
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\AgGlFgAppHistory.db"
    3⤵
    PID:5000
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\AgGlGlobalHistory.db"
    3⤵
    PID:4520
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\AgRobust.db"
    3⤵
    PID:4020
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\APPLICATIONFRAMEHOST.EXE-CCEEF759.pf"
    3⤵
    PID:4848
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\ASPNET_REGIIS.EXE-945CDB73.pf"
    3⤵
    PID:2972
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\ASPNET_REGIIS.EXE-A5891C91.pf"
    3⤵
    PID:3068
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\AUDIODG.EXE-BDFD3029.pf"
    3⤵
    PID:2068
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\BACKGROUNDTASKHOST.EXE-ACEF2FA2.pf"
    3⤵
    PID:2344
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\BACKGROUNDTRANSFERHOST.EXE-CF5B50C1.pf"
    3⤵
    PID:888
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\BYTECODEGENERATOR.EXE-C1E9BCE6.pf"
    3⤵
    PID:788
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\CONHOST.EXE-1F3E9D7E.pf"
    3⤵
    PID:100
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\DISM.EXE-DE199F71.pf"
    3⤵
    PID:4968
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\DISMHOST.EXE-8F2B04FD.pf"
    3⤵
    PID:2488
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\DLLHOST.EXE-504C779A.pf"
    3⤵
    PID:1988
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\DLLHOST.EXE-5E46FA0D.pf"
    3⤵
    PID:4884
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\DLLHOST.EXE-A73FB9CB.pf"
    3⤵
    PID:4328
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\DLLHOST.EXE-FC981FFE.pf"
    3⤵
    PID:4788
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\FILESYNCCONFIG.EXE-33763EB7.pf"
    3⤵
    PID:2280
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\FSQUIRT.EXE-BBD9646E.pf"
    3⤵
    PID:4132
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\LINQWEBCONFIG.EXE-0FDCD1CB.pf"
    3⤵
    PID:1088
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\LINQWEBCONFIG.EXE-4A3DBBF6.pf"
    3⤵
    PID:3484
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\MOUSOCOREWORKER.EXE-681A8FEE.pf"
    3⤵
    PID:3368
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\NGEN.EXE-AE594A6B.pf"
    3⤵
    PID:4376
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\NGEN.EXE-EC3F9239.pf"
    3⤵
    PID:2004
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\ONEDRIVE.EXE-96969DDA.pf"
    3⤵
    PID:4924
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\ONEDRIVESETUP.EXE-8CE5A462.pf"
    3⤵
    PID:1192
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\ONEDRIVESETUP.EXE-ADFC0EFD.pf"
    3⤵
    PID:4812
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\PfPre_5f3b4030.mkd"
    3⤵
    PID:732
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\PfSvPerfStats.bin"
    3⤵
    PID:1764
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\POWERSHELL.EXE-920BBA2A.pf"
    3⤵
    PID:4564
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\REG.EXE-E7E8BD26.pf"
    3⤵
    PID:2140
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\ResPriHMStaticDb.ebd"
    3⤵
    PID:1944
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-002D6F84.pf"
    3⤵
    PID:3724
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-01E21A55.pf"
    3⤵
    PID:2404
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-0521102C.pf"
    3⤵
    PID:2684
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-08AF006C.pf"
    3⤵
    PID:2656
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-0A03C9B5.pf"
    3⤵
    PID:3192
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-0C84305E.pf"
    3⤵
    PID:868
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-1463E66D.pf"
    3⤵
    PID:1280
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-156D43F1.pf"
    3⤵
    PID:372
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-1589E4C3.pf"
    3⤵
    PID:2224
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-16AF9B6E.pf"
    3⤵
    PID:4380
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-18665B15.pf"
    3⤵
    PID:3916
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-23EA2E5B.pf"
    3⤵
    PID:1692
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-2C52326A.pf"
    3⤵
    PID:4260
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-32DA767E.pf"
    3⤵
    PID:3580
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-373C0EED.pf"
    3⤵
    PID:3240
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-4DC9A20E.pf"
    3⤵
    PID:4972
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-4EFE6110.pf"
    3⤵
    PID:4208
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-56E309E9.pf"
    3⤵
    PID:1400
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-5B70F332.pf"
    3⤵
    PID:4232
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-61696F68.pf"
    3⤵
    PID:5092
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-641DCE1C.pf"
    3⤵
    PID:4432
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-6F2A95AF.pf"
    3⤵
    PID:1852
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-7194EF5E.pf"
    3⤵
    PID:1076
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-7BB97BF6.pf"
    3⤵
    PID:4340
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-7BCB4814.pf"
    3⤵
    PID:1228
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-7C77C512.pf"
    3⤵
    PID:1316
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-7CB48DE8.pf"
    3⤵
    PID:3016
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-7E8D1C35.pf"
    3⤵
    PID:464
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-7EF4A0DD.pf"
    3⤵
    PID:1808
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-7F337F0A.pf"
    3⤵
    PID:3520
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-894C9E34.pf"
    3⤵
    PID:1904
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-8AFD300C.pf"
    3⤵
    PID:2412
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-976DB280.pf"
    3⤵
    PID:1668
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-97BCF638.pf"
    3⤵
    PID:1924
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-99F89D15.pf"
    3⤵
    PID:4880
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-AE5EC6E9.pf"
    3⤵
    PID:212
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-AED2006F.pf"
    3⤵
    PID:2348
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-B2C296EF.pf"
    3⤵
    PID:3704
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-C5BE1C43.pf"
    3⤵
    PID:1792
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-C8D69DC6.pf"
    3⤵
    PID:2028
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-D2B15AE2.pf"
    3⤵
    PID:4516
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-D71F3FEA.pf"
    3⤵
    PID:3748
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-DB926CB0.pf"
    3⤵
    PID:1068
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-E66A223C.pf"
    3⤵
    PID:3588
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-E8196656.pf"
    3⤵
    PID:2988
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-FCAF5656.pf"
    3⤵
    PID:3140
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-FDF50724.pf"
    3⤵
    PID:3256
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNDLL32.EXE-FFCC5BB3.pf"
    3⤵
    PID:2608
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNTIMEBROKER.EXE-005D3145.pf"
    3⤵
    PID:1968
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNTIMEBROKER.EXE-06226CEB.pf"
    3⤵
    PID:4596
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNTIMEBROKER.EXE-3ED30A86.pf"
    3⤵
    PID:1964
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNTIMEBROKER.EXE-4DE02988.pf"
    3⤵
    PID:3204
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNTIMEBROKER.EXE-94A02D86.pf"
    3⤵
    PID:1512
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNTIMEBROKER.EXE-98C67737.pf"
    3⤵
    PID:2220
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNTIMEBROKER.EXE-B1A87C0F.pf"
    3⤵
    PID:4648
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNTIMEBROKER.EXE-BC366267.pf"
    3⤵
    PID:3060
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNTIMEBROKER.EXE-C4B5739C.pf"
    3⤵
    PID:2896
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\RUNTIMEBROKER.EXE-D9106866.pf"
    3⤵
    PID:3252
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SETTINGSYNCHOST.EXE-2521C7ED.pf"
    3⤵
    PID:1528
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SGRMBROKER.EXE-0CA31CC6.pf"
    3⤵
    PID:4888
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SHELLEXPERIENCEHOST.EXE-A3608B1E.pf"
    3⤵
    PID:2776
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SHUTDOWN.EXE-E7D5C9CC.pf"
    3⤵
    PID:3568
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SLUI.EXE-724E99D9.pf"
    3⤵
    PID:632
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SMCONFIGINSTALLER.EXE-039D5D2E.pf"
    3⤵
    PID:556
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SMCONFIGINSTALLER.EXE-EC979AE0.pf"
    3⤵
    PID:1908
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SOBQL9.EXE-62BA7442.pf"
    3⤵
    PID:384
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-033BBABB.pf"
    3⤵
    PID:820
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-342BD74A.pf"
    3⤵
    PID:5096
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-4BA0E729.pf"
    3⤵
    PID:5108
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-5AC380EC.pf"
    3⤵
    PID:1616
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-7CFEDEA3.pf"
    3⤵
    PID:1196
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-8102A33C.pf"
    3⤵
    PID:2012
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-C49E779A.pf"
    3⤵
    PID:5028
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-CABA5DBC.pf"
    3⤵
    PID:1004
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-DF3D779F.pf"
    3⤵
    PID:4544
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-E45D8788.pf"
    3⤵
    PID:4872
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-F027B880.pf"
    3⤵
    PID:1856
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\SVCHOST.EXE-FF8EBD82.pf"
    3⤵
    PID:4124
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\TAKEOWN.EXE-A80759AD.pf"
    3⤵
    PID:4220
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\TASKHOSTW.EXE-3E0B74C8.pf"
    3⤵
    PID:232
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\TASKKILL.EXE-8F5B2253.pf"
    3⤵
    PID:1956
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\TIWORKER.EXE-C101ABCD.pf"
    3⤵
    PID:4264
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf"
    3⤵
    PID:4628
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\VSSVC.EXE-B8AFC319.pf"
    3⤵
    PID:208
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\WFSERVICESREG.EXE-3EE82250.pf"
    3⤵
    PID:4320
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\WFSERVICESREG.EXE-766D3C5B.pf"
    3⤵
    PID:3128
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\WLRMDR.EXE-C2B47318.pf"
    3⤵
    PID:228
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\WMIADAP.EXE-F8DFDFA2.pf"
    3⤵
    PID:4312
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\WMIPRVSE.EXE-1628051C.pf"
    3⤵
    PID:3312
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\ReadyBoot\rblayout.xin"
    3⤵
    PID:4532
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\ReadyBoot\ReadyBoot.etl"
    3⤵
    PID:4580
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\prefetch\ReadyBoot\Trace1.fx"
    3⤵
    PID:936
- C:\Windows\system32\forfiles.exe
  forfiles -p "C:\Users\justin\AppData\Local\Temp" -s -m *.* /C "cmd /c del @path"
  2⤵
  - Indirect Command Execution
  PID:2612
- C:\Windows\system32\forfiles.exe
  forfiles -p "C:\Windows\Temp" -s -m *.* /C "cmd /c del @path"
  2⤵
  - Indirect Command Execution
  PID:4724
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\amc34FA.tmp"
    3⤵
    PID:3960
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\amc34FA.tmp.LOG1"
    3⤵
    PID:3808
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\amc34FA.tmp.LOG2"
    3⤵
    PID:932
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\amc34FB.tmp"
    3⤵
    PID:848
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\amc34FB.tmp.LOG1"
    3⤵
    PID:1336
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\amc34FB.tmp.LOG2"
    3⤵
    PID:4644
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\amc3A69.tmp"
    3⤵
    PID:4756
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\amc3A69.tmp.LOG1"
    3⤵
    PID:4372
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\amc3A69.tmp.LOG2"
    3⤵
    PID:2716
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\ASPNETSetup_00000.log"
    3⤵
    PID:3436
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\ASPNETSetup_00001.log"
    3⤵
    PID:1704
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\FXSAPIDebugLogFile.txt"
    3⤵
    PID:3284
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\FXSTIFFDebugLogFile.txt"
    3⤵
    PID:2212
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\msedge_installer.log"
    3⤵
    PID:1652
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\officeclicktorun.exe_streamserver(20240709142536870).log"
    3⤵
    PID:3780
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\officeclicktorun.exe_streamserver(20240709142656948).log"
    3⤵
    PID:4332
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\officeclicktorun.exe_streamserver(202407091428169B4).log"
    3⤵
    PID:372
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\officeclicktorun.exe_streamserver(202407091429399FC).log"
    3⤵
    PID:3216
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\officeclicktorun.exe_streamserver(202407091432049C4).log"
    3⤵
    PID:1940
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\officeclicktorun.exe_streamserver(20240709143451A04).log"
    3⤵
    PID:5024
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\officeclicktorun.exe_streamserver(20240709151318720).log"
    3⤵
    PID:4720
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1419.log"
    3⤵
    PID:4996
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1420.log"
    3⤵
    PID:3332
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1420a.log"
    3⤵
    PID:3240
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1420b.log"
    3⤵
    PID:3336
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1420c.log"
    3⤵
    PID:4208
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1420d.log"
    3⤵
    PID:4604
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1425.log"
    3⤵
    PID:3668
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1427.log"
    3⤵
    PID:5092
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1428.log"
    3⤵
    PID:3168
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1429.log"
    3⤵
    PID:1852
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1431.log"
    3⤵
    PID:1076
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1432.log"
    3⤵
    PID:4340
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1434.log"
    3⤵
    PID:2440
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1508.log"
    3⤵
    PID:552
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\VOCYMMGW-20240709-1513.log"
    3⤵
    PID:3356
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\MsEdgeCrashpad\settings.dat"
    3⤵
    PID:464
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\MsEdgeCrashpad\throttle_store.dat"
    3⤵
    PID:1808
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\_6F581920-6408-4221-81CD-ED6B4EED22E6\WindowsUpdate.20240709.140645.275.1.etl"
    3⤵
    PID:3520
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\_6F581920-6408-4221-81CD-ED6B4EED22E6\WindowsUpdate.20240709.140645.275.2.etl"
    3⤵
    PID:1904
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\_6F581920-6408-4221-81CD-ED6B4EED22E6\WindowsUpdate.20240709.140645.275.3.etl"
    3⤵
    PID:2412
- - C:\Windows\system32\cmd.exe
    /c del "C:\Windows\Temp\_6F581920-6408-4221-81CD-ED6B4EED22E6\WindowsUpdate.20240727.063418.297.1.etl"
    3⤵
    PID:4512
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current sub_processor 5d76a2ca-e8c0-402f-a133-2158492d58ad 1
  2⤵
  - Power Settings
  PID:3504
- C:\Windows\system32\powercfg.exe
  powercfg -setactive scheme_current
  2⤵
  - Power Settings
  PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "ForEach($v in (Get-Command -Name \"Set-ProcessMitigation\").Parameters[\"Disable\"].Attributes.ValidValues){Set-ProcessMitigation -System -Disable $v.ToString() -ErrorAction SilentlyContinue}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:3400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "Remove-Item -Path \"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*\" -Recurse -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:2036
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3 /f
  2⤵
  PID:2672
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f
  2⤵
  PID:4140
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:4048
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v "MonitorLatencyTolerance" /t REG_DWORD /d "0" /f
  2⤵
  PID:1296
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v "MonitorRefreshLatencyTolerance" /t REG_DWORD /d "0" /f
  2⤵
  PID:436
- C:\Windows\system32\fsutil.exe
  fsutil behavior set DisableDeleteNotify 1
  2⤵
  PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Indirect Command Execution

T1202

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
661739d384d9dfd807a089721202900b

SHA1
5b2c5d6a7122b4ce849dc98e79a7713038feac55

SHA256
70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

SHA512
81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8b37d4c4212937039cb6791f34cd1991

SHA1
be4cddde010d16bf472a8211995efc7187d2a605

SHA256
6e567f8348eb87a4e470219b08edbb14d6ec13652e676cc17dff7f39282450a6

SHA512
98dfef5ec121056c7fc42662c3b5d9159740753451308a466def95425c3fbf411a9fc2e597de2e3e17ea50710b28d4c3a3641a6bfceab31c812d108c068825f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
997eb28e4024d22ccc41b134788d416e

SHA1
779082f7b7341c45102bc0afab193318af67a4ff

SHA256
c8af4c89e7f8cc49a7baf6deed09a84e30c263febab26fd31d2ff070d0019835

SHA512
cc300708cf96e249d00dc7a4994dc934e6049f4aebcd726cf32b69b48a22ea46a341affe2f7ea68c0f29860f1561ee2d38c471af3a8a5003e94d19c9dd4d7708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
17aec4af6739c0b2edfc3032deefda35

SHA1
ebf6c712b33c4763eafb35ee8328d1e0e8077992

SHA256
be1676aa247ca3205e8accdb86575e81513c34de86d33072fa499d685dc602a9

SHA512
ca01a1cf606a37596902ce145221f351f3c206c20bb0c0942ae36c831bad582b8b15a373f096ae0c0457d06b4edcc4812bf00a5f97d5bdae21ec3b9bf3e4309a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2488d3bd582fc500b6e3a79cba25cf76

SHA1
123e41b8c12c60648eda8c5aebb85c82693439dc

SHA256
ddc9246c3f222e7e09302e90cd51ad09eb3a5e9e3c766061e61c2af348d4a037

SHA512
54a99b725677af943e548a42148666a0e2057b6816effb954d4dcc7eb87f476eaf4e17813a9903ef7c77c6ffb3f59db48127d7572491f545bccfcd26cc25d226

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3osooja5.3sn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/184-9-0x0000021CEBAE0000-0x0000021CEBB02000-memory.dmp

Filesize
136KB

Download
memory/3400-45-0x000001F76A6A0000-0x000001F76A6BE000-memory.dmp

Filesize
120KB

Download