Malware Analysis Report

2025-01-22 19:58

Sample ID 241016-ypsxyatblj
Target Azurite Setup 1.1.12.exe
SHA256 a570a7c27ab10595ae8d850ff72e02aa473a7f2b858603c963df513ebdf67227
Tags
discovery execution evasion lateral_movement persistence privilege_escalation ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

a570a7c27ab10595ae8d850ff72e02aa473a7f2b858603c963df513ebdf67227

Threat Level: Likely malicious

The file Azurite Setup 1.1.12.exe was found to be: Likely malicious.

Malicious Activity Summary

discovery execution evasion lateral_movement persistence privilege_escalation ransomware

Modifies boot configuration data using bcdedit

Maps connected drives based on registry

Remote Services: SMB/Windows Admin Shares

Power Settings

Drops desktop.ini file(s)

Command and Scripting Interpreter: PowerShell

Deletes itself

Checks computer location settings

Executes dropped EXE

Drops file in Windows directory

Checks installed software on the system

Loads dropped DLL

Command and Scripting Interpreter: JavaScript

Event Triggered Execution: Netsh Helper DLL

Browser Information Discovery

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Enumerates physical storage devices

Program crash

Unsigned PE

System Time Discovery

Checks SCSI registry key(s)

Enumerates system info in registry

Modifies system certificate store

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry key

Modifies Internet Explorer settings

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Scheduled Task/Job: Scheduled Task

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 20:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240903-en

Max time kernel

120s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 224

Network

N/A

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

109s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3596 wrote to memory of 1840 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3596 wrote to memory of 1840 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3596 wrote to memory of 1840 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 5.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:07

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

154s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4620 wrote to memory of 2628 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4620 wrote to memory of 2628 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4620 wrote to memory of 2628 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2952 wrote to memory of 4036 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2952 wrote to memory of 4036 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2952 wrote to memory of 4036 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1796 wrote to memory of 2912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 2912 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 1888 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1796 wrote to memory of 5076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9881046f8,0x7ff988104708,0x7ff988104718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13702596586167379232,5642188851394232932,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5284 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e443ee4336fcf13c698b8ab5f3c173d0
SHA1 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA256 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512 cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

\??\pipe\LOCAL\crashpad_1796_RBVXNDGULHQNTQAB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56a4f78e21616a6e19da57228569489b
SHA1 21bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256 d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512 c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a7196c290da66b821ee46b33dfd8a0ff
SHA1 ac545ffdbc725ea1f0fd0f9d3dcd4ec202929356
SHA256 219f4591d913a765703eb51771b1690c30db7d5c8744ee29bf46c27f25f6342d
SHA512 ce6ff053350a8e213a12bab4970fb1b30b171ed65667d1fbb2a34b098825560c406891b79b50617228f86af0657c3f1826e64890f56395131207498cc907eef0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ea5da1739ff1b4a6aa26d815640b8102
SHA1 39a74b95feed6bdf89040ce1e2d44d95afe56732
SHA256 fde327329313623dd4fab6ea3806d729ec79ce5834f962bcba1f742164739dda
SHA512 98f74beb2c5ac9685153b736bfd3c9625f2856c59986ec266e64d2c82e024ffb145be6b2925ad4f0585a4dad6f2a231ca631567f4db00edec5b882619a638988

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 969a77bb1ffc01b6f9d52bd393dd3065
SHA1 c75f69244363c3ff3c2ccea3867854c3745f947f
SHA256 b0bac27bb056044b27e16eb76fa0f2e50f15c93359802bc380615dc74cd8763d
SHA512 5689c47015c0e3203ba526cd40e2965e5414b175629d6e4d1ee0da9077512ae10b14314612e7f91d2a7e05d56805ea9a2a7b73f66fc5f56649c59899975264cf

Analysis: behavioral30

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

144s

Max time network

155s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:07

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2848 wrote to memory of 2564 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2848 wrote to memory of 2564 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2848 wrote to memory of 2564 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2564 -ip 2564

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 628

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 78.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 5.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

141s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3968 wrote to memory of 1196 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3968 wrote to memory of 1196 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3968 wrote to memory of 1196 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1196 -ip 1196

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 5.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240903-en

Max time kernel

121s

Max time network

130s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

138s

Max time network

137s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 27.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1964 wrote to memory of 3448 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1964 wrote to memory of 3448 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1964 wrote to memory of 3448 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3448 -ip 3448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 620

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240708-en

Max time kernel

138s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe"

Signatures

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Windows\system32\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Windows\system32\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Windows\system32\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\system32\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count C:\Windows\system32\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\NextInstance C:\Windows\system32\reg.exe N/A

Power Settings

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\powercfg.exe N/A
N/A N/A C:\Windows\system32\powercfg.exe N/A

Remote Services: SMB/Windows Admin Shares

lateral_movement
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Parameters\NullSessionPipes C:\Windows\system32\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A

System Time Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\system32\reg.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\system32\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK C:\Windows\system32\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\system32\reg.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 916 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe
PID 916 wrote to memory of 1504 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Windows\system32\reg.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe"

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe"

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=gpu-process --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1052 /prefetch:2

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1388 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=renderer --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\Azurite\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1448 /prefetch:1

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RmSvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\xinputhid\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\WUDFRd\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\WpdUpFltr\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vwififlt\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vdrvroot\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBXHCI\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBHUB3\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\umbus\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\storahci\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\stornvme\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisVirtualBus\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\msisadrv\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\mouhid\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\mouhid\Parameters /v DmaRemappingCompatible

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\monitor\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\monitor\Parameters /v DmaRemappingCompatible

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\intelpep\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\CompositeBus\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicRender\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicDisplay\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpipagr\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpi\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpi\Parameters /v DmaRemappingCompatible

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\partmgr\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\partmgr\Parameters /v DmaRemappingCompatible

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\xinputhid\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\pci\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\HDAudBus\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisWan\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisWan\Parameters /v DmaRemappingCompatible

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbhid\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbdclass\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbdclass\Parameters /v DmaRemappingCompatible

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\intellppm\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v DontSendAdditionalData

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v LoggingDisabled

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\FindMyDevice

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\FindMyDevice

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\GraphicsDrivers

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\GraphicsDrivers /v HwSchedMode

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Search

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInstrumentation

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\Power\PowerThrottling

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced /v Start_TrackProgs

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\International\User Profile"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Personalization

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Speech

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\Explorer

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Search

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\InputPersonalization

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\InputPersonalization

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\DataCollection

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\DataCollection /v LimitEnhancedDiagnosticDataWindowsAnalytics

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Maps

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Maps

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\TabletPC

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows\Windows Search"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows\Windows Search"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppPrivacy

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v DisableExceptionChainValidation

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v KernelSEHOPEnabled

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NoLazyMode

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v NoLazyMode

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Internet Explorer\SQM"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableCfg

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePageCombining

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnablePrefetcher

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableSuperfetch

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\FTH

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\FTH /v Enabled

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\FTH /v Enabled

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AJRouter

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppReadiness

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppVClient

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagsvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\embeddedmode

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\EntAppSvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\NaturalAuthentication

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ScDeviceEnum

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SEMgrSvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorDataService

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorService

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SgrmBroker

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\tzautoupdate

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop" /v AutoEndTasks

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop" /v AutoEndTasks

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM /v Composition

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM /v Composition

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Latency Sensitive"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Background Only"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Background Only"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\mouclass\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Psched

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\Tcpip\QoS

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Before Azurite Optimization' -RestorePointType 'MODIFY_SETTINGS'""

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Before Azurite Optimization' -RestorePointType 'MODIFY_SETTINGS'"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\DrvInst.exe

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A8" "00000000000003CC"

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RmSvc /v Start /t REG_DWORD /d 3 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\xinputhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\WUDFRd\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\WpdUpFltr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\vwififlt\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\vdrvroot\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\USBXHCI\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\USBHUB3\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\umbus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\storahci\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\stornvme\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\NdisVirtualBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\msisadrv\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\mouhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\monitor\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\intelpep\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\CompositeBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\BasicRender\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\BasicDisplay\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\acpipagr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\acpi\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\partmgr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\xinputhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\pci\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\HDAudBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\NdisWan\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\kbhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\kbdclass\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\intellppm\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v DontSendAdditionalData /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v LoggingDisabled /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultOverrideBehavior /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultConsent /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main /v AllowPrelaunch /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\FindMyDevice /v AllowFindMyDevice /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\FindMyDevice /v LocationSyncEnabled /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo /v Enabled /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v MaintenanceDisabled /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\GraphicsDrivers /v HwSchedMode /t REG_DWORD /d 2 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications /v GlobalUserDisabled /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Search /v BackgroundAppGlobalToggle /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack /v ShowedToastAtLevel /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v AllowTelemetry /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v MaxTelemetryAllowed /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInstrumentation /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications /v NoTileApplicationNotification /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\Power\PowerThrottling /v PowerThrottlingOff /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced /v Start_TrackProgs /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKCU\Control Panel\International\User Profile" /v HttpAcceptLanguageOptOut /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Personalization /v NoLockScreenCamera /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v DisableInventory /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v DisableUAR /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Speech /v AllowSpeechModelUpdate /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Policies\Microsoft\Windows\Explorer /v NoRemoteDestinations /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy /v TailoredExperiencesWithDiagnosticDataEnabled /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Search /v BingSearchEnabled /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\InputPersonalization /v RestrictImplicitInkCollection /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\InputPersonalization /v RestrictImplicitTextCollection /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo /v DisabledByGroupPolicy /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\DataCollection /v LimitEnhancedDiagnosticDataWindowsAnalytics /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Maps /v AutoDownloadAndUpdateMapData /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Maps /v AllowUntriggeredNetworkTrafficOnSettingsPage /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\TabletPC /v PreventHandwritingDataSharing /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v AITEnable /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v ConnectedSearchUseWeb /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v DisableWebSearch /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation /t REG_DWORD /d 38 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppPrivacy /v LetAppsRunInBackground /t REG_DWORD /d 2 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v KernelSEHOPEnabled /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex /t REG_DWORD /d 10 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness /t REG_DWORD /d 10 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NoLazyMode /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v NoLazyMode /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Internet Explorer\SQM" /v DisableCustomerImprovementProgram /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableCfg /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePageCombining /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnablePrefetcher /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableSuperfetch /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\FTH /v Enabled /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AJRouter /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ALG /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppMgmt /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppReadiness /v Start /t REG_DWORD /d 3 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppVClient /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\defragsvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\diagsvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\embeddedmode /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\EntAppSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\FontCache /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\LanmanServer /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\NaturalAuthentication /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\p2psvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\PcaSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\QWAVE /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RpcLocator /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SCardSvr /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ScDeviceEnum /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SEMgrSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensorDataService /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensorService /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensrSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SessionEnv /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SgrmBroker /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SharedAccess /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\tzautoupdate /v Start /t REG_DWORD /d 4 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout /t REG_SZ /d 2000 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKCU\Control Panel\Desktop" /v AutoEndTasks /t REG_SZ /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\DWM /v Composition /t REG_DWORD /d 0 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Latency Sensitive" /t REG_SZ /d True /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Background Only" /t REG_SZ /d False /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\mouclass\Parameters /v MouseDataQueueSize /t REG_DWORD /d 50 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize /t REG_DWORD /d 50 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Psched /v TimerResolution /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\Tcpip\QoS /v "Do not use NLA" /t REG_DWORD /d 1 /f

C:\Windows\system32\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v EnableMulticast /t REG_DWORD /d 0 /f

C:\Windows\system32\bcdedit.exe

bcdedit /set useplatformtick yes

C:\Windows\system32\bcdedit.exe

bcdedit /deletevalue useplatformclock >nul 2>nul

C:\Windows\system32\bcdedit.exe

bcdedit /set disabledynamictick Yes

C:\Windows\system32\bcdedit.exe

bcdedit /set hypervisorlaunchtype off

C:\Windows\system32\bcdedit.exe

bcdedit /set bootmenupolicy Legacy

C:\Windows\system32\cmd.exe

cmd /C C:\Users\Admin\AppData\Local\Temp\70242550.bat

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wmic os get TotalVisibleMemorySize /format:value

C:\Windows\System32\Wbem\WMIC.exe

wmic os get TotalVisibleMemorySize /format:value

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d "3120624" /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum" /s /f "StorPort"| findstr "StorPort"

C:\Windows\system32\reg.exe

reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum" /s /f "StorPort"

C:\Windows\system32\findstr.exe

findstr "StorPort"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wmic PATH Win32_PnPEntity GET DeviceID | findstr "USB\VID_"

C:\Windows\System32\Wbem\WMIC.exe

wmic PATH Win32_PnPEntity GET DeviceID

C:\Windows\system32\findstr.exe

findstr "USB\VID_"

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "EnhancedPowerManagementEnabled" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "AllowIdleIrpInD3" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "EnableSelectiveSuspend" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "DeviceSelectiveSuspended" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "SelectiveSuspendEnabled" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "SelectiveSuspendOn" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "D3ColdSupported" /t REG_DWORD /d "0" /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wmic path win32_networkadapter get GUID | findstr "{"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_networkadapter get GUID

C:\Windows\system32\findstr.exe

findstr "{"

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{79D1AFAE-0541-4461-A882-E2B75BE0FAF3}" /v "TcpAckFrequency" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{79D1AFAE-0541-4461-A882-E2B75BE0FAF3}" /v "TcpDelAckTicks" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{79D1AFAE-0541-4461-A882-E2B75BE0FAF3}" /v "TCPNoDelay" /t REG_DWORD /d "1" /f

C:\Windows\system32\netsh.exe

netsh int tcp set heuristics disabled

C:\Windows\system32\netsh.exe

netsh int tcp set supplemental Internet congestionprovider=ctcp

C:\Windows\system32\netsh.exe

netsh int tcp set global timestamps=disabled

C:\Windows\system32\netsh.exe

netsh int tcp set global rsc=disabled

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible | find /i "Services\"

C:\Windows\system32\reg.exe

reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible

C:\Windows\system32\find.exe

find /i "Services\"

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ACPI\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpipagr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BasicDisplay\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BasicRender\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CompositeBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HDAudBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intellppm\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intelpep\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\monitor\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msisadrv\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisVirtualBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\partmgr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storahci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\umbus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBHUB3\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBXHCI\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdrvroot\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwififlt\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpdUpFltr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WUDFRd\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xinputhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\system32\powercfg.exe

powercfg /import C:\Users\Admin\AppData\Local\Temp\a2e8cd91.pow 33333333-3333-3333-3333-333333333333

C:\Windows\system32\powercfg.exe

powercfg /setactive 33333333-3333-3333-3333-333333333333

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "whoami /USER /FO CSV /NH"

C:\Windows\system32\whoami.exe

whoami /USER /FO CSV /NH

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "SchTasks /Create /TN "\Azurite\CompletedScreen" /XML "C:\Users\Admin\AppData\Local\Temp\76f57160.xml""

C:\Windows\system32\schtasks.exe

SchTasks /Create /TN "\Azurite\CompletedScreen" /XML "C:\Users\Admin\AppData\Local\Temp\76f57160.xml"

C:\Windows\system32\shutdown.exe

shutdown -r -t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1488 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1652 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=gpu-process --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1184 /prefetch:2

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2256 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=gpu-process --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1728 /prefetch:2

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1788 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1688 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1764 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1740 /prefetch:8

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1068,15133041399259769960,2080964652358441113,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1736 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x144

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

Country Destination Domain Proto
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 pla.atlasos.net udp
US 172.67.174.238:443 pla.atlasos.net tcp
GB 142.250.187.206:443 redirector.gvt1.com tcp
US 8.8.8.8:53 r1---sn-aigl6nz7.gvt1.com udp
US 172.67.174.238:443 pla.atlasos.net tcp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com udp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com tcp
US 8.8.8.8:53 update.tweakcentral.net udp
GB 142.250.187.206:443 redirector.gvt1.com tcp
US 172.67.189.231:443 update.tweakcentral.net tcp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com udp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com tcp

Files

\Users\Admin\AppData\Local\Temp\nso9F8B.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

\Users\Admin\AppData\Local\Temp\nso9F8B.tmp\UAC.dll

MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

\Users\Admin\AppData\Local\Temp\nso9F8B.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nso9F8B.tmp\nsDialogs.dll

MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

\Users\Admin\AppData\Local\Temp\nso9F8B.tmp\nsProcess.dll

MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

\Users\Admin\AppData\Local\Temp\nso9F8B.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

\Users\Admin\AppData\Local\Temp\nso9F8B.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

memory/1708-216-0x0000000003120000-0x0000000003122000-memory.dmp

C:\Users\Admin\AppData\Local\Programs\Azurite\ffmpeg.dll

MD5 af6d3e25c626882b0c6be5a1e662a88d
SHA1 a00b6b71d94ed200ffa44d730efe48cd63148153
SHA256 3615f62c7495308038c2659c266fb144c813fbd44a535111ce10ae47b0996ada
SHA512 54da008ccaf5646479f16a302e0e8d0346ef750ea39565b5b453f205e49ec10f91eb43fc1e826d278519ac48ead943925906e5015b817d235307a6c5a716274e

C:\Users\Admin\AppData\Local\Programs\Azurite\v8_context_snapshot.bin

MD5 e082a9ffd52e98b00e501e934a7e9d8d
SHA1 21746f70466633f881581d9bee651619d8b4b109
SHA256 08058ff9086099965041d0e85e8847704c624baf689ec3bb6a041e7776332520
SHA512 5b6a6f58a9037c260b1b76bb7605746c251641e20153b5e75d99f4b4afb1367a7a44ba255034c9090e7c48748402a6e0bad13da2c4c3e8b7b88bd1d80898fd3b

C:\Users\Admin\AppData\Local\Programs\Azurite\icudtl.dat

MD5 80a7528515595d8b0bf99a477a7eff0d
SHA1 fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA256 6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
SHA512 c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459

C:\Users\Admin\AppData\Local\Programs\Azurite\resources\app.asar

MD5 f0283a70e4e77c72999016a2cc033172
SHA1 48f2207f9363faf63d3a6f2ac16ed2cf8022f8ab
SHA256 e0f0acdba0caa085dac0c2432a97670f88c4deaeded715e2e9452b03400d592f
SHA512 5f73110a134f02e71c84d6d8da4c9aa5c572adec5bbe40255b30b9a37d2818064261c8a57b76c8da7efbfbced061066d53437a66197c9caaa0dcd90c1b60bddc

C:\Users\Admin\AppData\Local\Programs\Azurite\chrome_100_percent.pak

MD5 03aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1 dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
SHA512 c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9

C:\Users\Admin\AppData\Local\Programs\Azurite\chrome_200_percent.pak

MD5 7d4f330a5443eadf32e041c63e7e70ad
SHA1 26ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
SHA512 f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d

C:\Users\Admin\AppData\Local\Programs\Azurite\locales\en-US.pak

MD5 af5c77e1d94dc4f772cb641bd310bc87
SHA1 0ceeb456e2601e22d873250bcc713bab573f2247
SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
SHA512 8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c

C:\Users\Admin\AppData\Local\Programs\Azurite\resources.pak

MD5 d22a5445f36b9ffaafc235e56ae90456
SHA1 c6acefdf31e440c71ff830eb9150efe69775ec63
SHA256 7b94d96c56df3635cd72eac4f970fe3b2df97749427a4e7986612d86aae4b6a8
SHA512 dec6c599ed1045c962a4bd52904eace69c0d323ee68e4ed67b56185ea36712fa4ccf138e7f9552f6483c9c62d5d63e98cbd61b1a0c84a4e6f5f625bc58463673

memory/1088-229-0x0000000000060000-0x0000000000061000-memory.dmp

memory/1088-262-0x0000000076F60000-0x0000000076F61000-memory.dmp

\Users\Admin\AppData\Local\Programs\Azurite\d3dcompiler_47.dll

MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

\Users\Admin\AppData\Local\Programs\Azurite\swiftshader\libEGL.dll

MD5 08d67d57bdb9efa1c6652bab4f68a7fb
SHA1 9b8f156a069f4f40e0fdded92aa1c6f3606101b3
SHA256 33adfdf885f4a64e5792d591bb35ddf5f8b15feeacbcf1539c50a614d168abf5
SHA512 b9972e81eb5a7b4dba758686d6d2962639ad0e7b0c3c6df328f0eb5d1e4b06f4fcf0135c01908bf2d583be4606cdd028485977853c62285e216f07e695e601e9

\Users\Admin\AppData\Local\Programs\Azurite\swiftshader\libGLESv2.dll

MD5 9089a52d103849175b1ed9b5a469a782
SHA1 90eb9c2536f801920551c4b2c70fd318223308d1
SHA256 47092d9bfd855fcfb613741580ac742ce521567509929daab5574a71f83a2801
SHA512 553d85f8ffbccd10c324d58d1b3f5479f039cb50cfda49a891f35c13462a59160c29c96a43aa48725c6e5fa6773f84fa684f9e4add4d250fd14c09d451ff19fa

C:\Users\Admin\AppData\Local\Programs\Azurite\resources\app-update.yml

MD5 a454c573d0c72b4122d074a4048f8a22
SHA1 ce06018b60adf940f42401c8e311fc5d27619d90
SHA256 d82261f6161e06ac8b48bfd619acc1a0eaefc63270d4e4a1155a255d2b0e6eff
SHA512 56a06b34547a19be4d569c780770eb43d19f5a2ef55c62f98a00d372e7c02865265ccb35a1c5f5a82b48c279516c55c07b0b4b6ea2d858be7f131391dd76d495

C:\Users\Admin\AppData\Roaming\azurite\en-US-9-0.bdic

MD5 a78ad14e77147e7de3647e61964c0335
SHA1 cecc3dd41f4cea0192b24300c71e1911bd4fce45
SHA256 0d6803758ff8f87081fafd62e90f0950dfb2dd7991e9607fe76a8f92d0e893fa
SHA512 dde24d5ad50d68fc91e9e325d31e66ef8f624b6bb3a07d14ffed1104d3ab5f4ef1d7969a5cde0dfbb19cb31c506f7de97af67c2f244f7e7e8e10648ea8321101

C:\Users\Admin\AppData\Roaming\azurite\Preferences

MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

memory/2420-1208-0x000000001B630000-0x000000001B912000-memory.dmp

memory/2420-1209-0x0000000001E70000-0x0000000001E78000-memory.dmp

C:\Users\Admin\AppData\Roaming\azurite\logs\main.log

MD5 45f7916a61663254eda6aac4cf744819
SHA1 eb8b5861ec96c863ae893230b8f3bf87ac1466b8
SHA256 281bcc3126d38958f8b7bc134dbfde5d073ff3788f6cb14cdffdd1388507d8d4
SHA512 bb44a5b4456afd43aeaa1bc565da732263d81a4701b4b238bde4798149afcaf6dc03f79fc96b0d018c47b3de408e1e004f500a7c5663a4af27ef1c79bcbc21c2

C:\Users\Admin\AppData\Local\Temp\70242550.bat

MD5 b96aac30465cba9e3cc089c3ef5c7df6
SHA1 6858ce127c45a1eddb6ccbffcb290b6c650016a8
SHA256 1afa7f9a0ea79a193e10a096f5eafffb687e07ecbe5cabdc716b700ff6c97b63
SHA512 56d7d549394cbcfe4edefa914e99c457346737b96e63659271e95ac73b75a00fb9bb6352f335c79ea0c220583dc65c49249e236b646458397108fd2c36eb1202

C:\Users\Admin\AppData\Local\Temp\76f57160.xml

MD5 5339c1c7894eab0d271fda744b15996c
SHA1 3008223e249ec55f5a0af23b6a6476d30e41ad90
SHA256 402239bb93b000bfc05136757af293d3175ead54b8a5465c69dca9298b63ed67
SHA512 cac61d238a16e01c000ea35b30303fd3338b78f2593cea0c829cefee66c4a7f66ea699184c0c9d4ad60d0200687da41f7e248998c05687a2d4423fe991062450

memory/1628-1880-0x0000000000070000-0x0000000000080000-memory.dmp

memory/1628-1866-0x0000000000070000-0x0000000000080000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3120 wrote to memory of 212 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3120 wrote to memory of 212 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3120 wrote to memory of 212 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 212 -ip 212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 624

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 5.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20241010-en

Max time kernel

119s

Max time network

126s

Command Line

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Signatures

Command and Scripting Interpreter: JavaScript

execution

Processes

C:\Windows\system32\wscript.exe

wscript.exe C:\Users\Admin\AppData\Local\Temp\resources\app.js

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240903-en

Max time kernel

121s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 220

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A

Checks installed software on the system

discovery

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 3188 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe
PID 4636 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite Setup 1.1.12.exe"

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe"

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=gpu-process --field-trial-handle=1620,9821936797400945042,3667239650327155822,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1628 /prefetch:2

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=renderer --field-trial-handle=1620,9821936797400945042,3667239650327155822,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\Azurite\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,9821936797400945042,3667239650327155822,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2192 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe

"C:\Users\Admin\AppData\Local\Programs\Azurite\Azurite.exe" --type=gpu-process --field-trial-handle=1620,9821936797400945042,3667239650327155822,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2264 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 pla.atlasos.net udp
US 104.21.31.37:443 pla.atlasos.net tcp
US 104.21.31.37:443 pla.atlasos.net tcp
US 8.8.8.8:53 update.tweakcentral.net udp
US 172.67.189.231:443 update.tweakcentral.net tcp
US 8.8.8.8:53 37.31.21.104.in-addr.arpa udp
US 8.8.8.8:53 231.189.67.172.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsfC7C5.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsfC7C5.tmp\UAC.dll

MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

C:\Users\Admin\AppData\Local\Temp\nsfC7C5.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsfC7C5.tmp\nsDialogs.dll

MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

C:\Users\Admin\AppData\Local\Temp\nsfC7C5.tmp\nsProcess.dll

MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

C:\Users\Admin\AppData\Local\Temp\nsfC7C5.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nsfC7C5.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Programs\Azurite\ffmpeg.dll

MD5 af6d3e25c626882b0c6be5a1e662a88d
SHA1 a00b6b71d94ed200ffa44d730efe48cd63148153
SHA256 3615f62c7495308038c2659c266fb144c813fbd44a535111ce10ae47b0996ada
SHA512 54da008ccaf5646479f16a302e0e8d0346ef750ea39565b5b453f205e49ec10f91eb43fc1e826d278519ac48ead943925906e5015b817d235307a6c5a716274e

C:\Users\Admin\AppData\Local\Programs\Azurite\v8_context_snapshot.bin

MD5 e082a9ffd52e98b00e501e934a7e9d8d
SHA1 21746f70466633f881581d9bee651619d8b4b109
SHA256 08058ff9086099965041d0e85e8847704c624baf689ec3bb6a041e7776332520
SHA512 5b6a6f58a9037c260b1b76bb7605746c251641e20153b5e75d99f4b4afb1367a7a44ba255034c9090e7c48748402a6e0bad13da2c4c3e8b7b88bd1d80898fd3b

C:\Users\Admin\AppData\Local\Programs\Azurite\icudtl.dat

MD5 80a7528515595d8b0bf99a477a7eff0d
SHA1 fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA256 6e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
SHA512 c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459

C:\Users\Admin\AppData\Local\Programs\Azurite\resources\app.asar

MD5 f0283a70e4e77c72999016a2cc033172
SHA1 48f2207f9363faf63d3a6f2ac16ed2cf8022f8ab
SHA256 e0f0acdba0caa085dac0c2432a97670f88c4deaeded715e2e9452b03400d592f
SHA512 5f73110a134f02e71c84d6d8da4c9aa5c572adec5bbe40255b30b9a37d2818064261c8a57b76c8da7efbfbced061066d53437a66197c9caaa0dcd90c1b60bddc

C:\Users\Admin\AppData\Local\Programs\Azurite\resources.pak

MD5 d22a5445f36b9ffaafc235e56ae90456
SHA1 c6acefdf31e440c71ff830eb9150efe69775ec63
SHA256 7b94d96c56df3635cd72eac4f970fe3b2df97749427a4e7986612d86aae4b6a8
SHA512 dec6c599ed1045c962a4bd52904eace69c0d323ee68e4ed67b56185ea36712fa4ccf138e7f9552f6483c9c62d5d63e98cbd61b1a0c84a4e6f5f625bc58463673

C:\Users\Admin\AppData\Local\Programs\Azurite\locales\en-US.pak

MD5 af5c77e1d94dc4f772cb641bd310bc87
SHA1 0ceeb456e2601e22d873250bcc713bab573f2247
SHA256 781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
SHA512 8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c

C:\Users\Admin\AppData\Local\Programs\Azurite\chrome_200_percent.pak

MD5 7d4f330a5443eadf32e041c63e7e70ad
SHA1 26ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA256 b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
SHA512 f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d

C:\Users\Admin\AppData\Local\Programs\Azurite\chrome_100_percent.pak

MD5 03aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1 dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA256 c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
SHA512 c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9

memory/2324-220-0x00007FFACA0F0000-0x00007FFACA0F1000-memory.dmp

C:\Users\Admin\AppData\Local\Programs\Azurite\swiftshader\libEGL.dll

MD5 08d67d57bdb9efa1c6652bab4f68a7fb
SHA1 9b8f156a069f4f40e0fdded92aa1c6f3606101b3
SHA256 33adfdf885f4a64e5792d591bb35ddf5f8b15feeacbcf1539c50a614d168abf5
SHA512 b9972e81eb5a7b4dba758686d6d2962639ad0e7b0c3c6df328f0eb5d1e4b06f4fcf0135c01908bf2d583be4606cdd028485977853c62285e216f07e695e601e9

C:\Users\Admin\AppData\Local\Programs\Azurite\swiftshader\libGLESv2.dll

MD5 9089a52d103849175b1ed9b5a469a782
SHA1 90eb9c2536f801920551c4b2c70fd318223308d1
SHA256 47092d9bfd855fcfb613741580ac742ce521567509929daab5574a71f83a2801
SHA512 553d85f8ffbccd10c324d58d1b3f5479f039cb50cfda49a891f35c13462a59160c29c96a43aa48725c6e5fa6773f84fa684f9e4add4d250fd14c09d451ff19fa

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Programs\Azurite\d3dcompiler_47.dll

MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

C:\Users\Admin\AppData\Local\Programs\Azurite\resources\app-update.yml

MD5 a454c573d0c72b4122d074a4048f8a22
SHA1 ce06018b60adf940f42401c8e311fc5d27619d90
SHA256 d82261f6161e06ac8b48bfd619acc1a0eaefc63270d4e4a1155a255d2b0e6eff
SHA512 56a06b34547a19be4d569c780770eb43d19f5a2ef55c62f98a00d372e7c02865265ccb35a1c5f5a82b48c279516c55c07b0b4b6ea2d858be7f131391dd76d495

C:\Users\Admin\AppData\Roaming\azurite\Preferences

MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

C:\Users\Admin\AppData\Roaming\azurite\Preferences~RFe5827d6.TMP

MD5 d11dedf80b85d8d9be3fec6bb292f64b
SHA1 aab8783454819cd66ddf7871e887abdba138aef3
SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
SHA512 6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

C:\Users\Admin\AppData\Roaming\azurite\Network Persistent State

MD5 529f66a7edc36ae980c6f714dcbf5942
SHA1 88dee8c1e4ef93cd45372461b091d0f89687bb11
SHA256 18bd7a16f541035715e427465e0be82e3622ef0f51360e6ef084da2535a4f7cc
SHA512 c9ea591230f4b48e98539eb473f80c171420bf578df806114752e333ea08b82c02c1b7059e83a35ff4b01400912d39704e32895716616db1a440d6e8a64652e5

C:\Users\Admin\AppData\Roaming\azurite\Network Persistent State~RFe5911c9.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Analysis: behavioral32

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

146s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240903-en

Max time kernel

122s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WinShell.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 220

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240903-en

Max time kernel

122s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 220

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240903-en

Max time kernel

119s

Max time network

130s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 220

Network

N/A

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240903-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:07

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 27.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240903-en

Max time kernel

122s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3028 wrote to memory of 2544 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3028 wrote to memory of 2544 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3028 wrote to memory of 2544 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3028 wrote to memory of 2544 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3028 wrote to memory of 2544 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3028 wrote to memory of 2544 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3028 wrote to memory of 2544 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240708-en

Max time kernel

136s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3008 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe"

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=gpu-process --field-trial-handle=1060,3941830905933144758,1140710030190987949,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1068 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1060,3941830905933144758,1140710030190987949,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1368 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=renderer --field-trial-handle=1060,3941830905933144758,1140710030190987949,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1416 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 pla.atlasos.net udp
GB 142.250.187.206:443 redirector.gvt1.com tcp
US 172.67.174.238:443 pla.atlasos.net tcp
US 172.67.174.238:443 pla.atlasos.net tcp
US 8.8.8.8:53 r1---sn-aigl6nz7.gvt1.com udp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com udp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com tcp
US 8.8.8.8:53 update.tweakcentral.net udp
GB 142.250.187.206:443 redirector.gvt1.com tcp
US 104.21.10.38:443 update.tweakcentral.net tcp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com udp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com tcp

Files

memory/3056-33-0x0000000077AC0000-0x0000000077AC1000-memory.dmp

memory/3056-1-0x0000000000060000-0x0000000000061000-memory.dmp

C:\Users\Admin\AppData\Roaming\azurite\en-US-9-0.bdic

MD5 a78ad14e77147e7de3647e61964c0335
SHA1 cecc3dd41f4cea0192b24300c71e1911bd4fce45
SHA256 0d6803758ff8f87081fafd62e90f0950dfb2dd7991e9607fe76a8f92d0e893fa
SHA512 dde24d5ad50d68fc91e9e325d31e66ef8f624b6bb3a07d14ffed1104d3ab5f4ef1d7969a5cde0dfbb19cb31c506f7de97af67c2f244f7e7e8e10648ea8321101

C:\Users\Admin\AppData\Roaming\azurite\c2b9c8fb-f352-42ab-ad4d-f6b58efc3d18.tmp

MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Analysis: behavioral27

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:07

Platform

win7-20240729-en

Max time kernel

67s

Max time network

131s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000f749cd458a9116123e1de68c880345d9cbc4f090fdb514ccdd10198e6cc88d47000000000e8000000002000020000000c2221579ef0ca1cd6ab6d0273055ab021fed06cca88d7a254d73512d00d5b55c90000000c9748ac4c312ba100393d6d75ffcd374233cbafd8b93c3aff396f48db8632e56d63d84d7616ccda3ccd201ee4fa97854435ceaec50a24471e79952e0e6c8925e400df2df9f5bcd7fa81a2139c0d538e8d19264e4fb34231dedfef49f4f798be0969ad7024468b5a18a8d14b5841eb22652ddd00dc193915c48848efa6f424f478ee565d60a53a2ff782df8bf84aa971a400000006691ecb43ea01f8a17e5b00a30e54909e85fd9996d53638efd721b0cd0d59cff94f0af4e181de259a2d12a605328f6f3a738a8ff99ca5d640ea4e35b972af0a3 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435270987" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5078f8cc0620db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000004498224699ed3fffc4fbcd6c2ac9bf6e91a1a89db8b5ba413ffc077360cf8a31000000000e8000000002000020000000f41d71e5f88935d6de2c5832f96c2895fec0f81109c4f7a1f4c0d51987bf695520000000891e56b04c525876829c2bb04eb1872cd7d0122cc3e9110954346f35ce730cac400000005d65dc0a96a0ce257c542b2f368f463eafa47698be4b185b8dc810bf4f302071de02332b90f66e0c8bf5304f3a6d6b97fceef7291fdbce8dad8729e3847f34d4 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8471BB1-8BF9-11EF-A641-5E10E05FA61A} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabF99E.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarF9C0.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7a82eadbebd841c322bbf5985a317e97
SHA1 c9a919e22bfe385d3d4e7034b2b48695e8b1892f
SHA256 46306e9f95bb02789c96b53fc221e35b5218cc054e18916ddbb5746982883faf
SHA512 3c781495b9492cab51bf55e05d62e35e2539082ab63743efa1d93a3bfb639ce018b8dfe1a983858e01c610fb262c311eb294c574f9be4e65f4731d826817fd8e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d7555be5ccb541a69f87854150f673e8
SHA1 915a0f1a1ca61da995809798da5d62db98903756
SHA256 7b88eb13dbc7bb3109588d1848f0007cf82555238cc59c677c9da245ab959bbd
SHA512 416b51d0860a5cb5414e0d95b54b65672cb526b81430137099214c46f074d6c92aa4120664a74b75074f456a832019cfec6550365083049b023f00daa4a1728f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aa3b7cb514abcd6332c1ec734205703c
SHA1 1bc0898331f877706af10aff402443f3d838a0be
SHA256 480741e98b6d5456bebca0024141986d5934e7184359416445b62086384a523d
SHA512 a56674420b2e01ba0f213c11b871d9795b6c928958e344c9a04dc18fb3e3684a7d9361fc755f91fe90638f2336ca1ae695ef1ce30153dcb3a62202ce7d63a333

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b2e3c0a039a3ca3695669c446934e7d5
SHA1 e7ce06f287a85a96f7b437b01b61f1cc88d7327e
SHA256 069dd02369b8739b98e9cc57f8043bf4f08d45ebcf321896dee12ec32b6bcf8a
SHA512 3e923ba9f0a425ef613170763c40a1dc854d8dac95be19f2d3e4ca9c3baae890675fb816a570464f679cdf444b2d9e1f3804927b4f19dadd8e3ce382f0f4527e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 781cf303df91b5cf5e0635018acd6f68
SHA1 0e6a79710c5e3786eb9a5cb21f048e3c0937e687
SHA256 e7199eb9c8acfb881b23172d6d7970779fa92f08c5b81f761a86bbbde88cea85
SHA512 38f4d5d814e851a6ab3d528399eeac69f2697f2d04ddc3bc64f5ba7371700dfe9a4d34001227dde40b860ec100d23baeb845551fb35d12b031a7bb956a929a4b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 04b488275d803d8c920fb83b8a4a1154
SHA1 3174076c38c113313a0339deb4661696fd554845
SHA256 2fac31fad272b7da733637f02395d0b0e46624f498de1c324a05d10d7b439bee
SHA512 cc04a011be348adda53f4c1832bd0ad28e4e21a45a5b8518eeffb59b78ee929efde3f6f11beaa6f85af83800d67d07a2f3306b3ff9ca15e6659de9a20a773dbe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 891af90b1e5328c8d6f8001f8df579c0
SHA1 4f1661e4715dca16adcaf971736fefa849718b09
SHA256 654abdc6e857a13965961cef22179ed16496658f20c3b082803a545cb3b2e6db
SHA512 2f6368f06fc864941a0b4b6c1fa642c74b063771181487b32a1415c8891c537caa1b4fcf5f3ee6cf7031d525dcd8a20c647d6937af4f88c7d7da51f8b6801014

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5689bf9507034c313604a1c2921e8410
SHA1 5ca0b7633164defa7c083cfc5ce7ecf11889f2db
SHA256 b5753a916af745e697e61ef40b8a07971554e977007dc8880d4ce9429502727f
SHA512 c47455f74d36b794d0ca06407da24be127d3eae3eb5cd421c8b98510b75dd744894e183fb20f2b7b5430f4be0c4ead0b803631c17a85c03988879b6084341204

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dd1b07bda556057a7c8d0d631f0937a3
SHA1 509b91da41e2ceea7a384b45dcf93d8be0b395b2
SHA256 9f53d43ca26e4974d7c2f34b0b12077e94db7610a9b0c5a9c899340f697314ee
SHA512 e11a9170a450f8de8946f7e81326d44f3e386b00612f9aeb7618def7f725dfb308109ec01d797595ac4f8026febe19856ebea5d06e7dc228741f450e5c407ec1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5325429a77bf5175625c1f3d14df65fe
SHA1 eb26c8b3c1bf239b01edf9c11a8a8f981c9818a3
SHA256 acde98fbdb0b471d332be8d15dfb8c8800c75d0a69dc8e51e6a46ce9cca4e941
SHA512 4a945585a05e20215b29aeaf72b2713faf857858aea03b52c957ac2294e2fc5c7a9b4c96eaf1a48a9c849264dc86b6d902b093d3d0d3a847aff616abd3423209

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 feb1dd7f7156d5b13698b4a225575786
SHA1 2fe0c3dba10446ba679b2f9b9d5c30dd1b1d8552
SHA256 e6ca3321d88513b3ad66df38c6652d9e21e073fd055150df515cc0069e3ab3fa
SHA512 af597aa997acb1eba02532beb0fc9d3ba4531c627644a49c60d1eec5240b448a671e267a5ec596adbb8a4d5aa1a83b854014e9f0194ba9db746f7b64d044e039

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1d083f592eee7829c41945894e52dd9b
SHA1 aa97eeb3cbd203c669cc63d38ae3043eafa20b5b
SHA256 4535acd4a88e0d135f4116c1f5feb4850e7ec582357cf6668b0e224109d9d3ee
SHA512 69a433e1d101b761826376d6ea8e61c72fb6769e349d286f103ee909bc647001d3e9501b747e1d837a9552a385f34031c415ee32a0a66df8e9f5125b86e95a40

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5f6d3aaa264dea361b21d52a51f15547
SHA1 d5755a643a2f40c3738e765d0efcec59e85b47de
SHA256 fa18baab118f904479b3aa42aa4e1f33df5f176f8f23ddf275f24affc9f93f3a
SHA512 8f97c6ed1dacad0461abc3c8c14f8b045c5c7b66fd333541b73e6ce8314728aaaf45f6e35c33f98d1344af4b3ff319b99d8e220a36ab78e9b1a9005bc13e32dc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 284c78fe40910becb425c1f38c75f5ac
SHA1 74c7436845a519748ae9845b40899347aec9916e
SHA256 1cd5d95b78c865d7e68de48f668f44c0c1cbdac807978c746fa5a0b0370ef362
SHA512 d7f6d073a5c89e4ce007a70ebbf9dfd608e6e675317f5c0d4a868cfb99a677f36d1687eb4a8f42ab5c7f7ba42d4a74f5784f61ea3774a3e29c8c569035dd567a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5ef4dc4dff6b5e39a36c71116c0276d2
SHA1 b713b7569ca1c36d1de230b0c6891d64be399db9
SHA256 451ee21c762d7f1809ad952a1173ea3d999b4989927ada7728bfd6f028e29146
SHA512 e50c1732ab6d076012ff100ca243d6c5037f553a2e86e3f6da24d9253d675c5bccb5deba62a4080d1735d693e7d34425cafbe8d3ac1c1ee7a3ceffb2668c161e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c0a3b7154127753a8d9eb38344d848c
SHA1 7c65632593d21f69628aa1e5bb3614cd32790df6
SHA256 a57e636f90a6662d91a90dc0b2a399de2810fc347a82c228c366533e26067cc4
SHA512 2e2c1e74fc8b4918bc86c5867bcc4492de953313f902246e618e73d5339684955ee6703e212bb5f7fc712859b803e993ae7d8e97418ac1b2b47cdc78f61db799

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ff1c58e7ac17f8ce61579435bc2bdc41
SHA1 c047606682690f72aa53a2120cf162eb755e4f3f
SHA256 bcd173f2d0315a93372349cecb9b0b5cedc0efd7281aa3b426135d03eb912c9a
SHA512 76c7ba92560221012cd4741759bd2a350b9efbca565ff4bd35afe250b2aabc5b63add29d22cb0a2a67de998735f0c35b9e3a5a676f0630dc80d9075c2ce6cb2a

Analysis: behavioral31

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20241010-en

Max time kernel

8s

Max time network

20s

Command Line

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe

"C:\Users\Admin\AppData\Local\Temp\resources\elevate.exe"

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240903-en

Max time kernel

146s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\NextInstance C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Windows\SysWOW64\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum C:\Windows\SysWOW64\reg.exe N/A

Power Settings

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\powercfg.exe N/A
N/A N/A C:\Windows\SysWOW64\powercfg.exe N/A

Remote Services: SMB/Windows Admin Shares

lateral_movement
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\LanmanServer\Parameters\NullSessionPipes C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\whoami.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

System Time Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\SysWOW64\reg.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK C:\Windows\SysWOW64\reg.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1832 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1832 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe"

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=gpu-process --field-trial-handle=1020,13751434042066048224,13936571193593341897,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1036 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1020,13751434042066048224,13936571193593341897,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1168 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=renderer --field-trial-handle=1020,13751434042066048224,13936571193593341897,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1480 /prefetch:1

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RmSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\xinputhid\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\WUDFRd\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\WpdUpFltr\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vwififlt\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vdrvroot\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBXHCI\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBHUB3\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\umbus\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\storahci\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\stornvme\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisVirtualBus\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\msisadrv\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\mouhid\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\mouhid\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\monitor\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\monitor\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\intelpep\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\CompositeBus\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicRender\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicDisplay\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpipagr\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpi\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpi\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\partmgr\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\partmgr\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\xinputhid\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\pci\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\HDAudBus\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisWan\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisWan\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbhid\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbdclass\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbdclass\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\intellppm\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v DontSendAdditionalData

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v LoggingDisabled

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\FindMyDevice

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\FindMyDevice

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\GraphicsDrivers

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\GraphicsDrivers /v HwSchedMode

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Search

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInstrumentation

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\Power\PowerThrottling

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced /v Start_TrackProgs

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\International\User Profile"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Personalization

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Speech

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Search

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\InputPersonalization

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\InputPersonalization

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\DataCollection

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\DataCollection /v LimitEnhancedDiagnosticDataWindowsAnalytics

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Maps

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Maps

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\TabletPC

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows\Windows Search"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows\Windows Search"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppPrivacy

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v DisableExceptionChainValidation

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v KernelSEHOPEnabled

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Internet Explorer\SQM"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableCfg

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePageCombining

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnablePrefetcher

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableSuperfetch

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\FTH

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\FTH /v Enabled

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\FTH /v Enabled

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AJRouter

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppReadiness

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppVClient

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagsvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\embeddedmode

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\EntAppSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\NaturalAuthentication

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ScDeviceEnum

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SEMgrSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorDataService

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorService

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SgrmBroker

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\tzautoupdate

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop" /v AutoEndTasks

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop" /v AutoEndTasks

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM /v Composition

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM /v Composition

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\mouclass\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Psched

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\Tcpip\QoS

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Before Azurite Optimization' -RestorePointType 'MODIFY_SETTINGS'""

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Before Azurite Optimization' -RestorePointType 'MODIFY_SETTINGS'"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\DrvInst.exe

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000498" "00000000000005C8"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RmSvc /v Start /t REG_DWORD /d 3 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\xinputhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\WUDFRd\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\WpdUpFltr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\vwififlt\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\vdrvroot\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\USBXHCI\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\USBHUB3\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\umbus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\storahci\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\stornvme\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\NdisVirtualBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\msisadrv\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\mouhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\monitor\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\intelpep\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\CompositeBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\BasicRender\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\BasicDisplay\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\acpipagr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\acpi\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\partmgr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\xinputhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\pci\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\HDAudBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\NdisWan\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\kbhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\kbdclass\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\intellppm\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v DontSendAdditionalData /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v LoggingDisabled /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultOverrideBehavior /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultConsent /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main /v AllowPrelaunch /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\FindMyDevice /v AllowFindMyDevice /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\FindMyDevice /v LocationSyncEnabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo /v Enabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v MaintenanceDisabled /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\GraphicsDrivers /v HwSchedMode /t REG_DWORD /d 2 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications /v GlobalUserDisabled /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Search /v BackgroundAppGlobalToggle /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack /v ShowedToastAtLevel /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v AllowTelemetry /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v MaxTelemetryAllowed /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInstrumentation /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications /v NoTileApplicationNotification /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\Power\PowerThrottling /v PowerThrottlingOff /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced /v Start_TrackProgs /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKCU\Control Panel\International\User Profile" /v HttpAcceptLanguageOptOut /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Personalization /v NoLockScreenCamera /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v DisableInventory /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v DisableUAR /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Speech /v AllowSpeechModelUpdate /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Policies\Microsoft\Windows\Explorer /v NoRemoteDestinations /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy /v TailoredExperiencesWithDiagnosticDataEnabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Search /v BingSearchEnabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\InputPersonalization /v RestrictImplicitInkCollection /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\InputPersonalization /v RestrictImplicitTextCollection /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo /v DisabledByGroupPolicy /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\DataCollection /v LimitEnhancedDiagnosticDataWindowsAnalytics /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Maps /v AutoDownloadAndUpdateMapData /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Maps /v AllowUntriggeredNetworkTrafficOnSettingsPage /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\TabletPC /v PreventHandwritingDataSharing /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v AITEnable /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v ConnectedSearchUseWeb /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v DisableWebSearch /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation /t REG_DWORD /d 38 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppPrivacy /v LetAppsRunInBackground /t REG_DWORD /d 2 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v KernelSEHOPEnabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex /t REG_DWORD /d 10 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness /t REG_DWORD /d 10 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NoLazyMode /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v NoLazyMode /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Internet Explorer\SQM" /v DisableCustomerImprovementProgram /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableCfg /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePageCombining /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnablePrefetcher /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableSuperfetch /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\FTH /v Enabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AJRouter /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ALG /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppMgmt /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppReadiness /v Start /t REG_DWORD /d 3 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppVClient /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\defragsvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\diagsvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\embeddedmode /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\EntAppSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\FontCache /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\LanmanServer /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\NaturalAuthentication /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\p2psvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\PcaSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\QWAVE /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RpcLocator /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SCardSvr /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ScDeviceEnum /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SEMgrSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensorDataService /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensorService /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensrSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SessionEnv /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SgrmBroker /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SharedAccess /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\tzautoupdate /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout /t REG_SZ /d 2000 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKCU\Control Panel\Desktop" /v AutoEndTasks /t REG_SZ /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\DWM /v Composition /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Latency Sensitive" /t REG_SZ /d True /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Background Only" /t REG_SZ /d False /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\mouclass\Parameters /v MouseDataQueueSize /t REG_DWORD /d 50 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize /t REG_DWORD /d 50 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Psched /v TimerResolution /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\Tcpip\QoS /v "Do not use NLA" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v EnableMulticast /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\cmd.exe

cmd /C C:\Users\Admin\AppData\Local\Temp\5b7d276b.bat

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c wmic os get TotalVisibleMemorySize /format:value

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic os get TotalVisibleMemorySize /format:value

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d "3120624" /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum" /s /f "StorPort"| findstr "StorPort"

C:\Windows\SysWOW64\reg.exe

reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum" /s /f "StorPort"

C:\Windows\SysWOW64\findstr.exe

findstr "StorPort"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c wmic PATH Win32_PnPEntity GET DeviceID | findstr "USB\VID_"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic PATH Win32_PnPEntity GET DeviceID

C:\Windows\SysWOW64\findstr.exe

findstr "USB\VID_"

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "EnhancedPowerManagementEnabled" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "AllowIdleIrpInD3" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "EnableSelectiveSuspend" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "DeviceSelectiveSuspended" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "SelectiveSuspendEnabled" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "SelectiveSuspendOn" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "D3ColdSupported" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c wmic path win32_networkadapter get GUID | findstr "{"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_networkadapter get GUID

C:\Windows\SysWOW64\findstr.exe

findstr "{"

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{B11C04ED-A679-453C-A9EF-DA13E46D4B2C}" /v "TcpAckFrequency" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{B11C04ED-A679-453C-A9EF-DA13E46D4B2C}" /v "TcpDelAckTicks" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{B11C04ED-A679-453C-A9EF-DA13E46D4B2C}" /v "TCPNoDelay" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\netsh.exe

netsh int tcp set heuristics disabled

C:\Windows\SysWOW64\netsh.exe

netsh int tcp set supplemental Internet congestionprovider=ctcp

C:\Windows\SysWOW64\netsh.exe

netsh int tcp set global timestamps=disabled

C:\Windows\SysWOW64\netsh.exe

netsh int tcp set global rsc=disabled

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible | find /i "Services\"

C:\Windows\SysWOW64\reg.exe

reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible

C:\Windows\SysWOW64\find.exe

find /i "Services\"

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ACPI\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpipagr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BasicDisplay\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BasicRender\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CompositeBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HDAudBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intellppm\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intelpep\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\monitor\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msisadrv\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisVirtualBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\partmgr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storahci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\umbus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBHUB3\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBXHCI\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdrvroot\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwififlt\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpdUpFltr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WUDFRd\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xinputhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\powercfg.exe

powercfg /import C:\Users\Admin\AppData\Local\Temp\21a7434c.pow 33333333-3333-3333-3333-333333333333

C:\Windows\SysWOW64\powercfg.exe

powercfg /setactive 33333333-3333-3333-3333-333333333333

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "whoami /USER /FO CSV /NH"

C:\Windows\SysWOW64\whoami.exe

whoami /USER /FO CSV /NH

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "SchTasks /Create /TN "\Azurite\CompletedScreen" /XML "C:\Users\Admin\AppData\Local\Temp\cdc0f673.xml""

C:\Windows\SysWOW64\schtasks.exe

SchTasks /Create /TN "\Azurite\CompletedScreen" /XML "C:\Users\Admin\AppData\Local\Temp\cdc0f673.xml"

C:\Windows\SysWOW64\shutdown.exe

shutdown -r -t 0

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1020,13751434042066048224,13936571193593341897,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1360 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1020,13751434042066048224,13936571193593341897,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1624 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x1c8

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

Country Destination Domain Proto
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 pla.atlasos.net udp
US 172.67.174.238:443 pla.atlasos.net tcp
GB 142.250.187.206:443 redirector.gvt1.com tcp
US 172.67.174.238:443 pla.atlasos.net tcp
US 8.8.8.8:53 r1---sn-aigl6nz7.gvt1.com udp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com udp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com tcp
US 8.8.8.8:53 update.tweakcentral.net udp
GB 142.250.187.206:443 redirector.gvt1.com tcp
US 104.21.10.38:443 update.tweakcentral.net tcp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com udp
GB 74.125.168.102:443 r1---sn-aigl6nz7.gvt1.com tcp

Files

memory/560-1-0x00000000004F0000-0x00000000004F1000-memory.dmp

C:\Users\Admin\AppData\Roaming\azurite\en-US-9-0.bdic

MD5 a78ad14e77147e7de3647e61964c0335
SHA1 cecc3dd41f4cea0192b24300c71e1911bd4fce45
SHA256 0d6803758ff8f87081fafd62e90f0950dfb2dd7991e9607fe76a8f92d0e893fa
SHA512 dde24d5ad50d68fc91e9e325d31e66ef8f624b6bb3a07d14ffed1104d3ab5f4ef1d7969a5cde0dfbb19cb31c506f7de97af67c2f244f7e7e8e10648ea8321101

C:\Users\Admin\AppData\Roaming\azurite\8c9ef07a-d2e6-44a8-9960-505fc766b300.tmp

MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

C:\Users\Admin\AppData\Roaming\azurite\logs\main.log

MD5 3b9a4c0cf4e5e4ed9417cf8bc3b2476e
SHA1 f2e58a8dd780dca8ee007803d16bcf0483bd9a16
SHA256 c1d2811bcc6d6fffb1b82f25530f17553f535ac461ecae27538ed6163307d9b7
SHA512 e1375f73ae6fe0dfaf527157527e653c18f54a2da8712d748a435702ae2465bb28c571e4c6699a8a5d5af40fbfcf712f90d817e44041d9bd06d433c44c798194

C:\Users\Admin\AppData\Local\Temp\5b7d276b.bat

MD5 b96aac30465cba9e3cc089c3ef5c7df6
SHA1 6858ce127c45a1eddb6ccbffcb290b6c650016a8
SHA256 1afa7f9a0ea79a193e10a096f5eafffb687e07ecbe5cabdc716b700ff6c97b63
SHA512 56d7d549394cbcfe4edefa914e99c457346737b96e63659271e95ac73b75a00fb9bb6352f335c79ea0c220583dc65c49249e236b646458397108fd2c36eb1202

C:\Users\Admin\AppData\Local\Temp\cdc0f673.xml

MD5 26e2e3a64afbef2f17034f53f61929f0
SHA1 90633c40428c121311d7584bace3370a499091a9
SHA256 c061a1dfebe1c388a936b2d3936d6701c095aaa60f42a466cd832b123a70136d
SHA512 0dabaa2abd7c43d50241b78f4265a7ff1062cf46bb96c0d1a179c4d90f32659686284215942f24940814d368f194bed61dbd11fc134d12b88ed69bafc68ff847

\Users\Admin\AppData\Local\Temp\ffmpeg.dll

MD5 8fdf0538c272fad678992cc6ce0b8e9f
SHA1 15df28fca0f415068ee28bb6a437c762bc5f6afb
SHA256 7b75da11cc24af5434f76b3affec3cbd03cfcc633ce57e072bc3677f01c250e8
SHA512 0a3907d2a43f1bd243514fe825fab919f2a1250359b3b645304df8e57ce1c4918388d4c427e16925390cc078961ba12da989c5bf4a85c305b0b059032155b62a

Analysis: behavioral12

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum C:\Windows\SysWOW64\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance C:\Windows\SysWOW64\reg.exe N/A

Power Settings

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\powercfg.exe N/A
N/A N/A C:\Windows\SysWOW64\powercfg.exe N/A

Remote Services: SMB/Windows Admin Shares

lateral_movement
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\NullSessionPipes C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\domgmt.20241007_090424_391.etl C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\domgmt.20241007_160317_880.etl C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\domgmt.20241007_160329_271.etl C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20241007_090412_000.etl C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20241007_090759_566.etl C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\powercfg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

System Time Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ContainerID C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters\DefaultRequestFlags C:\Windows\SysWOW64\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ClassGUID C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\SysWOW64\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\DefaultRequestFlags C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport C:\Windows\SysWOW64\reg.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport\PowerCycleCount C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters C:\Windows\SysWOW64\reg.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters C:\Windows\SysWOW64\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM C:\Windows\SysWOW64\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UINumber C:\Windows\SysWOW64\reg.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Address C:\Windows\SysWOW64\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ContainerID C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LocationInformation C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UINumber C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities C:\Windows\SysWOW64\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Address C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters C:\Windows\SysWOW64\reg.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\SysWOW64\reg.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\AttributesTableCache C:\Windows\SysWOW64\reg.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000041ba55ff39bb976e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000041ba55ff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090041ba55ff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d41ba55ff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000041ba55ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\DefaultRequestFlags C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver C:\Windows\SysWOW64\reg.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport\InitialTimestamp C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LocationInformation C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg C:\Windows\SysWOW64\reg.exe N/A
Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\SysWOW64\reg.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\Attributes C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 1620 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe
PID 1620 wrote to memory of 4448 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Windows\SysWOW64\reg.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe"

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=gpu-process --field-trial-handle=1320,17841672628122569974,15822557394915857989,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1612 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1320,17841672628122569974,15822557394915857989,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2140 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=renderer --field-trial-handle=1320,17841672628122569974,15822557394915857989,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RmSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RmSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RmSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\xinputhid\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\WUDFRd\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\WpdUpFltr\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vwififlt\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vwififlt\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vdrvroot\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\vdrvroot\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBXHCI\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBXHCI\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBXHCI\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBHUB3\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\USBHUB3\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\umbus\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\umbus\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\storahci\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\storahci\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\storahci\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\stornvme\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\stornvme\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\stornvme\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisVirtualBus\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisVirtualBus\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\msisadrv\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\msisadrv\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\mouhid\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\mouhid\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\monitor\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\monitor\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\intelpep\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\intelpep\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\CompositeBus\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\CompositeBus\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicRender\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicRender\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicDisplay\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\BasicDisplay\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpipagr\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpi\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\acpi\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\partmgr\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\partmgr\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\xinputhid\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\pci\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\pci\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\pci\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\HDAudBus\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\HDAudBus\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisWan\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\NdisWan\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbhid\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbdclass\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\kbdclass\Parameters /v DmaRemappingCompatible

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\ControlSet001\Services\intellppm\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v DontSendAdditionalData

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v LoggingDisabled

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultOverrideBehavior

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultConsent

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultConsent

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\FindMyDevice

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\FindMyDevice

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v MaintenanceDisabled

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\GraphicsDrivers

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\GraphicsDrivers /v HwSchedMode

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications /v GlobalUserDisabled

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Search

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Search /v BackgroundAppGlobalToggle

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack /v ShowedToastAtLevel

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack /v ShowedToastAtLevel

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v AllowTelemetry

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v MaxTelemetryAllowed

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInstrumentation

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\Power\PowerThrottling

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced /v Start_TrackProgs

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced /v Start_TrackProgs

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\International\User Profile"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\International\User Profile" /v HttpAcceptLanguageOptOut

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Personalization

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Speech

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\Explorer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Policies\Microsoft\Windows\Explorer /v NoRemoteDestinations

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy /v TailoredExperiencesWithDiagnosticDataEnabled

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy /v TailoredExperiencesWithDiagnosticDataEnabled

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Search

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\InputPersonalization

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\InputPersonalization

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\DataCollection

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Maps

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Maps

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\TabletPC

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppCompat

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows\Windows Search"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows\Windows Search"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v DoNotShowFeedbackNotifications

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\AppPrivacy

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v DisableExceptionChainValidation

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v KernelSEHOPEnabled

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Internet Explorer\SQM"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableCfg

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePageCombining

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnablePrefetcher

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableSuperfetch

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Microsoft\FTH

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AJRouter

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AJRouter /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AJRouter /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ALG /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppMgmt /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppReadiness

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppReadiness /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppReadiness /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppVClient

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppVClient /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\AppVClient /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\defragsvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagsvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagsvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\diagsvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\embeddedmode

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\embeddedmode /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\embeddedmode /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\EntAppSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\EntAppSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\EntAppSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\LanmanServer /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\NaturalAuthentication

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\NaturalAuthentication /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\NaturalAuthentication /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\p2psvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\PcaSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\QWAVE /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\RpcLocator /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SCardSvr /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ScDeviceEnum

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ScDeviceEnum /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ScDeviceEnum /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SEMgrSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SEMgrSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SEMgrSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorDataService

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorDataService /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorDataService /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorService

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorService /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensorService /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SensrSvc /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SessionEnv /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SgrmBroker

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SgrmBroker /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SgrmBroker /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\SharedAccess /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\tzautoupdate

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\tzautoupdate /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\tzautoupdate /v Start

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop" /v AutoEndTasks

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKCU\Control Panel\Desktop" /v AutoEndTasks

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM /v Composition

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\DWM /v Composition

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games"

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\mouclass\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\Software\Policies\Microsoft\Windows\Psched

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY HKLM\System\CurrentControlSet\Services\Tcpip\QoS

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe QUERY "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Before Azurite Optimization' -RestorePointType 'MODIFY_SETTINGS'""

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Before Azurite Optimization' -RestorePointType 'MODIFY_SETTINGS'"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RmSvc /v Start /t REG_DWORD /d 3 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\xinputhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\WUDFRd\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\WpdUpFltr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\vwififlt\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\vdrvroot\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\USBXHCI\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\USBHUB3\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\umbus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\storahci\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\stornvme\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\NdisVirtualBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\msisadrv\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\mouhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\monitor\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\intelpep\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\CompositeBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\BasicRender\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\BasicDisplay\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\acpipagr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\acpi\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\partmgr\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\xinputhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\pci\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\HDAudBus\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\NdisWan\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\kbhid\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\kbdclass\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\ControlSet001\Services\intellppm\Parameters /v DmaRemappingCompatible /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v DontSendAdditionalData /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting" /v LoggingDisabled /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultOverrideBehavior /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows\Windows Error Reporting\Consent" /v DefaultConsent /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main /v AllowPrelaunch /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\FindMyDevice /v AllowFindMyDevice /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\FindMyDevice /v LocationSyncEnabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo /v Enabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v MaintenanceDisabled /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\GraphicsDrivers /v HwSchedMode /t REG_DWORD /d 2 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications /v GlobalUserDisabled /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Search /v BackgroundAppGlobalToggle /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack /v ShowedToastAtLevel /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v AllowTelemetry /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v MaxTelemetryAllowed /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLowDiskSpaceChecks /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v LinkResolveIgnoreLinkInfo /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveSearch /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoResolveTrack /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInternetOpenWith /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoInstrumentation /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\PushNotifications /v NoTileApplicationNotification /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\Power\PowerThrottling /v PowerThrottlingOff /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\explorer\advanced /v Start_TrackProgs /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKCU\Control Panel\International\User Profile" /v HttpAcceptLanguageOptOut /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Personalization /v NoLockScreenCamera /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v DisableInventory /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v DisableUAR /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Speech /v AllowSpeechModelUpdate /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Policies\Microsoft\Windows\Explorer /v NoRemoteDestinations /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy /v TailoredExperiencesWithDiagnosticDataEnabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Search /v BingSearchEnabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\InputPersonalization /v RestrictImplicitInkCollection /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\InputPersonalization /v RestrictImplicitTextCollection /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo /v DisabledByGroupPolicy /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\DataCollection /v LimitEnhancedDiagnosticDataWindowsAnalytics /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Maps /v AutoDownloadAndUpdateMapData /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Maps /v AllowUntriggeredNetworkTrafficOnSettingsPage /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\TabletPC /v PreventHandwritingDataSharing /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /v AITEnable /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v ConnectedSearchUseWeb /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v DisableWebSearch /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation /t REG_DWORD /d 38 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\AppPrivacy /v LetAppsRunInBackground /t REG_DWORD /d 2 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v DisableExceptionChainValidation /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\kernel" /v KernelSEHOPEnabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex /t REG_DWORD /d 10 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness /t REG_DWORD /d 10 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NoLazyMode /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v NoLazyMode /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Internet Explorer\SQM" /v DisableCustomerImprovementProgram /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableCfg /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePageCombining /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnablePrefetcher /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v EnableSuperfetch /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Microsoft\FTH /v Enabled /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AJRouter /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ALG /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppIDSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppMgmt /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppReadiness /v Start /t REG_DWORD /d 3 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\AppVClient /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\CertPropSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\defragsvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\diagsvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\embeddedmode /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\EntAppSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\FontCache /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\FontCache3.0.0.0 /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\GraphicsPerfSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\LanmanServer /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\NaturalAuthentication /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\p2pimsvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\p2psvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\PcaSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\QWAVE /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RemoteAccess /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RemoteRegistry /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\RpcLocator /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SCardSvr /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ScDeviceEnum /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SEMgrSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensorDataService /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensorService /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SensrSvc /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SessionEnv /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SgrmBroker /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\SharedAccess /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\ShellHWDetection /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\tzautoupdate /v Start /t REG_DWORD /d 4 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Control /v WaitToKillServiceTimeout /t REG_SZ /d 2000 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKCU\Control Panel\Desktop" /v AutoEndTasks /t REG_SZ /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\DWM /v Composition /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Latency Sensitive" /t REG_SZ /d True /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Background Only" /t REG_SZ /d False /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\mouclass\Parameters /v MouseDataQueueSize /t REG_DWORD /d 50 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize /t REG_DWORD /d 50 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\Software\Policies\Microsoft\Windows\Psched /v TimerResolution /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD HKLM\System\CurrentControlSet\Services\Tcpip\QoS /v "Do not use NLA" /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\system32\reg.exe ADD "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v EnableMulticast /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\cmd.exe

cmd /C C:\Users\Admin\AppData\Local\Temp\3d9c077b.bat

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c wmic os get TotalVisibleMemorySize /format:value

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic os get TotalVisibleMemorySize /format:value

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d "5217772" /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum" /s /f "StorPort"| findstr "StorPort"

C:\Windows\SysWOW64\reg.exe

reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum" /s /f "StorPort"

C:\Windows\SysWOW64\findstr.exe

findstr "StorPort"

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\PCI\VEN_8086&DEV_2922&SUBSYS_11001AF4&REV_02\3&11583659&0&10\Device Parameters\StorPort" /v "EnableIdlePowerManagement" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\PCI\VEN_8086&DEV_2922&SUBSYS_11001AF4&REV_02\3&11583659&0&FA\Device Parameters\StorPort" /v "EnableIdlePowerManagement" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\{8e7bd593-6e6c-4c52-86a6-77175494dd8e}\MsVhdHba\1&3030e83&0&01\Device Parameters\StorPort" /v "EnableIdlePowerManagement" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c wmic PATH Win32_PnPEntity GET DeviceID | findstr "USB\VID_"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic PATH Win32_PnPEntity GET DeviceID

C:\Windows\SysWOW64\findstr.exe

findstr "USB\VID_"

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "EnhancedPowerManagementEnabled" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "AllowIdleIrpInD3" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "EnableSelectiveSuspend" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "DeviceSelectiveSuspended" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "SelectiveSuspendEnabled" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "SelectiveSuspendOn" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USB\VID_0627&PID_0001\28754-0000:00:04.0-1 \Device Parameters" /v "D3ColdSupported" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c wmic path win32_networkadapter get GUID | findstr "{"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic path win32_networkadapter get GUID

C:\Windows\SysWOW64\findstr.exe

findstr "{"

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{E69E4C34-05A9-4294-A11B-94530354B8FC}" /v "TcpAckFrequency" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{E69E4C34-05A9-4294-A11B-94530354B8FC}" /v "TcpDelAckTicks" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{E69E4C34-05A9-4294-A11B-94530354B8FC}" /v "TCPNoDelay" /t REG_DWORD /d "1" /f

C:\Windows\SysWOW64\netsh.exe

netsh int tcp set heuristics disabled

C:\Windows\SysWOW64\netsh.exe

netsh int tcp set supplemental Internet congestionprovider=ctcp

C:\Windows\SysWOW64\netsh.exe

netsh int tcp set global timestamps=disabled

C:\Windows\SysWOW64\netsh.exe

netsh int tcp set global rsc=disabled

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible | find /i "Services\"

C:\Windows\SysWOW64\reg.exe

reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible

C:\Windows\SysWOW64\find.exe

find /i "Services\"

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=gpu-process --field-trial-handle=1320,17841672628122569974,15822557394915857989,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1536 /prefetch:2

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ACPI\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpipagr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BasicDisplay\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BasicRender\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CompositeBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HDAudBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intellppm\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intelpep\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\monitor\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msisadrv\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisVirtualBus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\partmgr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storahci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\umbus\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBHUB3\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBXHCI\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdrvroot\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwififlt\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WpdUpFltr\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WUDFRd\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xinputhid\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\powercfg.exe

powercfg /import C:\Users\Admin\AppData\Local\Temp\35a72afd.pow 33333333-3333-3333-3333-333333333333

C:\Windows\SysWOW64\powercfg.exe

powercfg /setactive 33333333-3333-3333-3333-333333333333

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 pla.atlasos.net udp
US 172.67.174.238:443 pla.atlasos.net tcp
US 172.67.174.238:443 pla.atlasos.net tcp
US 8.8.8.8:53 update.tweakcentral.net udp
US 172.67.189.231:443 update.tweakcentral.net tcp
US 8.8.8.8:53 238.174.67.172.in-addr.arpa udp
US 8.8.8.8:53 231.189.67.172.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 27.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 8.46.22.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Roaming\azurite\f1d5bf9c-e578-460f-a70b-a5eaf50549de.tmp

MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

memory/1952-389-0x0000000002780000-0x00000000027B6000-memory.dmp

memory/1952-390-0x00000000052C0000-0x00000000058E8000-memory.dmp

memory/1952-391-0x00000000050D0000-0x00000000050F2000-memory.dmp

memory/1952-392-0x00000000059A0000-0x0000000005A06000-memory.dmp

memory/1952-393-0x0000000005A10000-0x0000000005A76000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0yyct3w4.cf5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1952-403-0x0000000005A80000-0x0000000005DD4000-memory.dmp

memory/1952-404-0x0000000006080000-0x000000000609E000-memory.dmp

memory/1952-405-0x00000000060E0000-0x000000000612C000-memory.dmp

memory/1952-406-0x00000000070A0000-0x0000000007136000-memory.dmp

memory/1952-407-0x0000000006570000-0x000000000658A000-memory.dmp

memory/1952-408-0x00000000065C0000-0x00000000065E2000-memory.dmp

memory/1952-409-0x00000000076F0000-0x0000000007C94000-memory.dmp

C:\Users\Admin\AppData\Roaming\azurite\logs\main.log

MD5 b54d54eb11a6ab453e617fa6fda9be57
SHA1 a042d5e42da5abfe9faca187fa38f8c811bd6c45
SHA256 5f5a27204a896462f93dbf1e39af39aaa7660c0e5c6aff811823ee2f1467ed07
SHA512 86e03005d4ac4cdca37c519da210dbf638d5afb920ceca70b1b9939a4e39c72f4785afbbf1a0e50f6cda54b9ff5b8a0594e8888f5f38a2787c6ba5aa8041a22b

C:\Users\Admin\AppData\Local\Temp\3d9c077b.bat

MD5 b96aac30465cba9e3cc089c3ef5c7df6
SHA1 6858ce127c45a1eddb6ccbffcb290b6c650016a8
SHA256 1afa7f9a0ea79a193e10a096f5eafffb687e07ecbe5cabdc716b700ff6c97b63
SHA512 56d7d549394cbcfe4edefa914e99c457346737b96e63659271e95ac73b75a00fb9bb6352f335c79ea0c220583dc65c49249e236b646458397108fd2c36eb1202

C:\Users\Admin\AppData\Roaming\azurite\Network Persistent State

MD5 529f66a7edc36ae980c6f714dcbf5942
SHA1 88dee8c1e4ef93cd45372461b091d0f89687bb11
SHA256 18bd7a16f541035715e427465e0be82e3622ef0f51360e6ef084da2535a4f7cc
SHA512 c9ea591230f4b48e98539eb473f80c171420bf578df806114752e333ea08b82c02c1b7059e83a35ff4b01400912d39704e32895716616db1a440d6e8a64652e5

C:\Users\Admin\AppData\Roaming\azurite\Network Persistent State~RFe58cabd.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll

MD5 8fdf0538c272fad678992cc6ce0b8e9f
SHA1 15df28fca0f415068ee28bb6a437c762bc5f6afb
SHA256 7b75da11cc24af5434f76b3affec3cbd03cfcc633ce57e072bc3677f01c250e8
SHA512 0a3907d2a43f1bd243514fe825fab919f2a1250359b3b645304df8e57ce1c4918388d4c427e16925390cc078961ba12da989c5bf4a85c305b0b059032155b62a

C:\Users\Admin\AppData\Local\Temp\d3dcompiler_47.dll

MD5 2f2e363c9a9baa0a9626db374cc4e8a4
SHA1 17f405e81e5fce4c5a02ca049f7bd48b31674c8f
SHA256 2630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df
SHA512 e668a5d1f5e6f821ebfa0913e201f0dfd8da2f96605701f8db18d14ea4fdeac73aeb9b4fe1f22eaeffcdd1c0f73a6701763727d5b09775666f82b678404e4924

C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll

MD5 8243a4fffca9219970a187b74d81b2a0
SHA1 d89bd462170bb4a56c14567fe0b17a0b75a5ede8
SHA256 8130e68850b0b521e66a648c4bfd4351b856bab11e9a6f9fb1272588329161fc
SHA512 7e5dc068aace50eaf893ec479e5c2e72eeca491ed6490b97d302675568aa6be3b715be0990541b5f531ea089dac625abb14ed3af86dcecd0508ab86c02d70425

C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll

MD5 45210582981a7428c2802c2795c84bd8
SHA1 35d5d9fd0bb8e602328c7d3ef5f35edb2efbb15c
SHA256 021cc27cbde002b59991c876d6a9b85a9576e189e1fc9dbd9478f9f2d68387ec
SHA512 791c8ccfa328766e2eb4a7928b3d92a07ad3763ee245d515d2a0bad851d7f79cbdb42820644c1c4e4ca1aa826111887ae9cfc385616683e9de8f1c18bb1982fc

C:\Users\Admin\AppData\Local\Temp\7346a248-9f95-4a77-8518-75e17a1e3fb8.tmp.pow

MD5 f81191582f273b07e50ea9ac1818dfdd
SHA1 e9d762bed0cfe1219854c2b1d5948f050458d426
SHA256 15828be7fca345b210fe3cde9eded3a2e12238580335e927952f85bae480db28
SHA512 954eb770bb4425cea2e24b56ced7acd70d5df7b219d5597ee101630f071fbc9a976b30e9ef8bcc375f2306dea7ad441dd5f4e15f450ddd313e6561963ac68271

Analysis: behavioral17

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20241010-en

Max time kernel

122s

Max time network

138s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2848 wrote to memory of 2856 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2848 wrote to memory of 2856 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2848 wrote to memory of 2856 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2848 wrote to memory of 2856 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2848 wrote to memory of 2856 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2848 wrote to memory of 2856 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2848 wrote to memory of 2856 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win7-20240903-en

Max time kernel

117s

Max time network

121s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1016 wrote to memory of 2004 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1016 wrote to memory of 2004 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1016 wrote to memory of 2004 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1016 wrote to memory of 2004 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1016 wrote to memory of 2004 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1016 wrote to memory of 2004 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1016 wrote to memory of 2004 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

151s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\Azurite.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe
PID 3704 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\Azurite.exe C:\Users\Admin\AppData\Local\Temp\Azurite.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe"

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=gpu-process --field-trial-handle=1596,2560638794377519889,5968959295975431433,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1612 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,2560638794377519889,5968959295975431433,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2112 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=renderer --field-trial-handle=1596,2560638794377519889,5968959295975431433,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\Azurite.exe

"C:\Users\Admin\AppData\Local\Temp\Azurite.exe" --type=gpu-process --field-trial-handle=1596,2560638794377519889,5968959295975431433,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1456 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 pla.atlasos.net udp
US 172.67.174.238:443 pla.atlasos.net tcp
US 172.67.174.238:443 pla.atlasos.net tcp
US 8.8.8.8:53 update.tweakcentral.net udp
US 172.67.189.231:443 update.tweakcentral.net tcp
US 8.8.8.8:53 238.174.67.172.in-addr.arpa udp
US 8.8.8.8:53 231.189.67.172.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

memory/1952-2-0x00007FFBE0540000-0x00007FFBE0541000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Roaming\azurite\Preferences

MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

C:\Users\Admin\AppData\Roaming\azurite\Preferences~RFe57be00.TMP

MD5 d11dedf80b85d8d9be3fec6bb292f64b
SHA1 aab8783454819cd66ddf7871e887abdba138aef3
SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
SHA512 6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

C:\Users\Admin\AppData\Roaming\azurite\Network Persistent State

MD5 529f66a7edc36ae980c6f714dcbf5942
SHA1 88dee8c1e4ef93cd45372461b091d0f89687bb11
SHA256 18bd7a16f541035715e427465e0be82e3622ef0f51360e6ef084da2535a4f7cc
SHA512 c9ea591230f4b48e98539eb473f80c171420bf578df806114752e333ea08b82c02c1b7059e83a35ff4b01400912d39704e32895716616db1a440d6e8a64652e5

C:\Users\Admin\AppData\Roaming\azurite\Network Persistent State~RFe58a786.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Analysis: behavioral6

Detonation Overview

Submitted

2024-10-16 19:58

Reported

2024-10-16 20:08

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

148s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 780 wrote to memory of 1668 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 780 wrote to memory of 1668 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 780 wrote to memory of 1668 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1668 -ip 1668

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 27.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

N/A