Overview

overview

10

Static

static

5

875fb36653...8a.exe

windows7-x64

10

875fb36653...8a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    132s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2024, 09:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    875fb3665387733cc84a96927c7b0be160110c89b2fc73b71f60b6b9eddcbb8a.exe
  • Size 486KB
  • Sample241107-lbhtlaypds
  • SHA256 875fb3665387733cc84a96927c7b0be160110c89b2fc73b71f60b6b9eddcbb8a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceransomwaretrojanupx

Malware Config

Signatures

  • Disables service(s) 3 TTPs
    evasionexecution
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables use of System Restore points 1 TTPs
    evasion
  • Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 57 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Power Settings 1 TTPs 3 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 63 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\875fb3665387733cc84a96927c7b0be160110c89b2fc73b71f60b6b9eddcbb8a.exe
    "C:\Users\Admin\AppData\Local\Temp\875fb3665387733cc84a96927c7b0be160110c89b2fc73b71f60b6b9eddcbb8a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Users\Admin\AppData\Local\Temp\875fb3665387733cc84a96927c7b0be160110c89b2fc73b71f60b6b9eddcbb8a.exe
      PECMD**pecmd-cmd* PUTF "C:\Users\Admin\AppData\Local\Temp\~~5648573657867449236.tmp.bat",,"C:\Users\Admin\AppData\Local\Temp\875fb3665387733cc84a96927c7b0be160110c89b2fc73b71f60b6b9eddcbb8a.exe""#102|SCRIPT"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1696
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~~5648573657867449236.tmp.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3980
      • C:\Windows\System32\reg.exe
        Reg query "HKU\S-1-5-19\Environment"
        3⤵
          PID:1224
        • C:\Windows\System32\reg.exe
          Reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowCortana" /t REG_DWORD /d "0" /f
          3⤵
            PID:512
          • C:\Windows\System32\reg.exe
            Reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCortanaButton" /t REG_DWORD /d "0" /f
            3⤵
              PID:860
            • C:\Windows\System32\label.exe
              label C:SYSTEM
              3⤵
                PID:1556
              • C:\Windows\System32\label.exe
                label D:DATA
                3⤵
                • Enumerates connected drives
                PID:4108
              • C:\Windows\System32\attrib.exe
                attrib +h "C:\Program Files (x86)\UI"
                3⤵
                • Views/modifies file attributes
                PID:1736
              • C:\Windows\System32\attrib.exe
                attrib +h "C:\PerfLogs"
                3⤵
                • Views/modifies file attributes
                PID:2368
              • C:\Windows\System32\reg.exe
                Reg DELETE "HKCR\.rtf\ShellNew" /f
                3⤵
                  PID:4972
                • C:\Windows\System32\reg.exe
                  Reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "link" /t Reg_BINARY /d "00000000" /f
                  3⤵
                    PID:3468
                  • C:\Windows\System32\reg.exe
                    Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "link" /t Reg_BINARY /d "00000000" /f
                    3⤵
                      PID:4984
                    • C:\Windows\System32\reg.exe
                      Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "AutoEndTasks" /t Reg_SZ /d "1" /f
                      3⤵
                        PID:4812
                      • C:\Windows\System32\reg.exe
                        Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "HungAppTimeout" /t Reg_SZ /d "3000" /f
                        3⤵
                          PID:980
                        • C:\Windows\System32\reg.exe
                          Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "MenuShowDelay" /t Reg_SZ /d "0" /f
                          3⤵
                            PID:4976
                          • C:\Windows\System32\reg.exe
                            Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "WaitToKillAppTimeout" /t Reg_SZ /d "3000" /f
                            3⤵
                              PID:4740
                            • C:\Windows\System32\reg.exe
                              Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "LowLevelHooksTimeout" /t REG_DWORD /d "3000" /f
                              3⤵
                                PID:2228
                              • C:\Windows\System32\reg.exe
                                Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "WaitToKillServiceTimeout" /t REG_DWORD /d "3000" /f
                                3⤵
                                  PID:2496
                                • C:\Windows\System32\reg.exe
                                  Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Serialize" /v "StartupDelayInMSec" /t REG_DWORD /d 0 /f
                                  3⤵
                                    PID:1940
                                  • C:\Windows\System32\reg.exe
                                    Reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "DontDisplayNetworkSelectionUI" /t Reg_DWORD /d "1" /f
                                    3⤵
                                      PID:4640
                                    • C:\Windows\System32\sc.exe
                                      sc config fdPHost start= auto
                                      3⤵
                                      • Launches sc.exe
                                      PID:1104
                                    • C:\Windows\System32\sc.exe
                                      sc config FDResPub start= auto
                                      3⤵
                                      • Launches sc.exe
                                      PID:5076
                                    • C:\Windows\System32\sc.exe
                                      sc config SSDPSRV start= auto
                                      3⤵
                                        PID:3360
                                      • C:\Windows\System32\sc.exe
                                        sc config upnphost start= auto
                                        3⤵
                                        • Launches sc.exe
                                        PID:4020
                                      • C:\Windows\System32\Dism.exe
                                        dism /online /format:table /get-features
                                        3⤵
                                        • Drops file in Windows directory
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:1856
                                        • C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\dismhost.exe
                                          C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\dismhost.exe {BC9BDBFA-0670-4B7C-8C72-80052B413F91}
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Drops file in Windows directory
                                          PID:2436
                                      • C:\Windows\System32\Dism.exe
                                        dism /online /enable-feature /featurename:SMB1Protocol /NoRestart
                                        3⤵
                                        • Drops file in Windows directory
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:3856
                                        • C:\Users\Admin\AppData\Local\Temp\30A78D34-63D3-41BB-8E1A-046C5B201112\dismhost.exe
                                          C:\Users\Admin\AppData\Local\Temp\30A78D34-63D3-41BB-8E1A-046C5B201112\dismhost.exe {CB6060AD-8D39-45AC-A1F8-BCE7790A5230}
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Drops file in Windows directory
                                          PID:264
                                      • C:\Windows\System32\reg.exe
                                        Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation" /v "AllowInsecureGuestAuth" /t REG_DWORD /d "1" /f
                                        3⤵
                                          PID:1972
                                        • C:\Windows\System32\reg.exe
                                          Reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v AllowInsecureGuestAuth /t REG_DWORD /d 1 /f
                                          3⤵
                                            PID:1608
                                          • C:\Windows\System32\reg.exe
                                            Reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v RequireSecuritySignature /t REG_DWORD /d 0 /f
                                            3⤵
                                              PID:4660
                                            • C:\Windows\System32\reg.exe
                                              Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v "EnableFirewall" /d 0 /t Reg_DWORD /f
                                              3⤵
                                                PID:2516
                                              • C:\Windows\System32\reg.exe
                                                Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile" /v "EnableFirewall" /d 0 /t Reg_DWORD /f
                                                3⤵
                                                  PID:2832
                                                • C:\Windows\System32\reg.exe
                                                  Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile" /v "EnableFirewall" /d 0 /t Reg_DWORD /f
                                                  3⤵
                                                    PID:2356
                                                  • C:\Windows\System32\powercfg.exe
                                                    powercfg /h off
                                                    3⤵
                                                    • Power Settings
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2080
                                                  • C:\Windows\System32\powercfg.exe
                                                    powercfg /hibernate off
                                                    3⤵
                                                    • Power Settings
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2280
                                                  • C:\Windows\System32\bcdedit.exe
                                                    bcdedit /set testsigning off
                                                    3⤵
                                                    • Modifies boot configuration data using bcdedit
                                                    PID:1736
                                                  • C:\Windows\System32\schtasks.exe
                                                    SCHTASKS /Change /disable /TN "\Microsoft\Windows\Defrag\ScheduledDefrag"
                                                    3⤵
                                                      PID:2128
                                                    • C:\Windows\System32\sc.exe
                                                      sc stop defragsvc
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:3500
                                                    • C:\Windows\System32\sc.exe
                                                      sc config defragsvc start= DISABLED
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:2104
                                                    • C:\Windows\System32\sc.exe
                                                      sc stop DiagTrack
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:4828
                                                    • C:\Windows\System32\sc.exe
                                                      sc config DiagTrack start= DISABLED
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:1620
                                                    • C:\Windows\System32\sc.exe
                                                      sc stop dmwappushservice
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:2984
                                                    • C:\Windows\System32\sc.exe
                                                      sc config dmwappushservice start= DISABLED
                                                      3⤵
                                                      • Launches sc.exe
                                                      PID:4060
                                                    • C:\Windows\System32\sc.exe
                                                      sc stop RemoteRegistry
                                                      3⤵
                                                        PID:5092
                                                      • C:\Windows\System32\sc.exe
                                                        sc config RemoteRegistry start= DISABLED
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:2208
                                                      • C:\Windows\System32\sc.exe
                                                        sc stop RetailDemo
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:3968
                                                      • C:\Windows\System32\sc.exe
                                                        sc config RemoteRegistry start= DISABLED
                                                        3⤵
                                                        • Launches sc.exe
                                                        PID:3456
                                                      • C:\Windows\System32\sc.exe
                                                        sc stop WMPNetworkSvc
                                                        3⤵
                                                          PID:3532
                                                        • C:\Windows\System32\sc.exe
                                                          sc config WMPNetworkSvc start= DISABLED
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:3432
                                                        • C:\Windows\System32\sc.exe
                                                          sc stop wsearch
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:3656
                                                        • C:\Windows\System32\sc.exe
                                                          sc config wsearch start= DISABLED
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:1144
                                                        • C:\Windows\System32\sc.exe
                                                          sc stop sysmain
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:2444
                                                        • C:\Windows\System32\sc.exe
                                                          sc config sysmain start= DISABLED
                                                          3⤵
                                                            PID:1628
                                                          • C:\Windows\System32\sc.exe
                                                            sc stop MpsSvc
                                                            3⤵
                                                            • Launches sc.exe
                                                            PID:4520
                                                          • C:\Windows\System32\sc.exe
                                                            sc config MpsSvc start= DISABLED
                                                            3⤵
                                                              PID:4216
                                                            • C:\Windows\System32\sc.exe
                                                              sc stop WdiSystemHost
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:2588
                                                            • C:\Windows\System32\sc.exe
                                                              sc config WdiSystemHost start= DISABLED
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:2192
                                                            • C:\Windows\System32\sc.exe
                                                              sc stop WdiServiceHost
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:1112
                                                            • C:\Windows\System32\sc.exe
                                                              sc config WdiServiceHost start= DISABLED
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:5116
                                                            • C:\Windows\System32\sc.exe
                                                              sc stop DPS
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:264
                                                            • C:\Windows\System32\sc.exe
                                                              sc config DPS start= DISABLED
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:4880
                                                            • C:\Windows\System32\sc.exe
                                                              sc stop Fax
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:5064
                                                            • C:\Windows\System32\sc.exe
                                                              sc config Fax start= DISABLED
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:1940
                                                            • C:\Windows\System32\sc.exe
                                                              sc stop diagsvc
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:2788
                                                            • C:\Windows\System32\sc.exe
                                                              sc config diagsvc start= DISABLED
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:2596
                                                            • C:\Windows\System32\sc.exe
                                                              sc stop MapsBroker
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:4368
                                                            • C:\Windows\System32\sc.exe
                                                              sc config MapsBroker start= DISABLED
                                                              3⤵
                                                              • Launches sc.exe
                                                              PID:3024
                                                            • C:\Windows\System32\sc.exe
                                                              sc stop lfsvc
                                                              3⤵
                                                                PID:3468
                                                              • C:\Windows\System32\sc.exe
                                                                sc config lfsvc start= DISABLED
                                                                3⤵
                                                                • Launches sc.exe
                                                                PID:2740
                                                              • C:\Windows\System32\sc.exe
                                                                sc stop PolicyAgent
                                                                3⤵
                                                                • Launches sc.exe
                                                                PID:3540
                                                              • C:\Windows\System32\sc.exe
                                                                sc config PolicyAgent start= DISABLED
                                                                3⤵
                                                                  PID:1224
                                                                • C:\Windows\System32\sc.exe
                                                                  sc stop pla
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:3692
                                                                • C:\Windows\System32\sc.exe
                                                                  sc config pla start= DISABLED
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:1564
                                                                • C:\Windows\System32\sc.exe
                                                                  sc stop PcaSvc
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:2344
                                                                • C:\Windows\System32\sc.exe
                                                                  sc config PcaSvc start= DISABLED
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:2804
                                                                • C:\Windows\System32\sc.exe
                                                                  sc stop RemoteAccess
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:2288
                                                                • C:\Windows\System32\sc.exe
                                                                  sc config RemoteAccess start= DISABLED
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:3092
                                                                • C:\Windows\System32\sc.exe
                                                                  sc stop shpamsvc
                                                                  3⤵
                                                                  • Launches sc.exe
                                                                  PID:1452
                                                                • C:\Windows\System32\sc.exe
                                                                  sc config shpamsvc start= DISABLED
                                                                  3⤵
                                                                    PID:4736
                                                                  • C:\Windows\System32\sc.exe
                                                                    sc stop WerSvc
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:1744
                                                                  • C:\Windows\System32\sc.exe
                                                                    sc config WerSvc start= DISABLED
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:2436
                                                                  • C:\Windows\System32\sc.exe
                                                                    sc stop spectrum
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:1636
                                                                  • C:\Windows\System32\sc.exe
                                                                    sc config spectrum start= DISABLED
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:1212
                                                                  • C:\Windows\System32\sc.exe
                                                                    sc stop perceptionsimulation
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:2796
                                                                  • C:\Windows\System32\sc.exe
                                                                    sc config perceptionsimulation start= DISABLED
                                                                    3⤵
                                                                    • Launches sc.exe
                                                                    PID:3992
                                                                  • C:\Windows\System32\sc.exe
                                                                    sc stop wisvc
                                                                    3⤵
                                                                      PID:2956
                                                                    • C:\Windows\System32\sc.exe
                                                                      sc config wisvc start= DISABLED
                                                                      3⤵
                                                                        PID:4752
                                                                      • C:\Windows\System32\sc.exe
                                                                        sc stop TroubleshootingSvc
                                                                        3⤵
                                                                          PID:2160
                                                                        • C:\Windows\System32\sc.exe
                                                                          sc config TroubleshootingSvc start=DISABLED
                                                                          3⤵
                                                                          • Launches sc.exe
                                                                          PID:1848
                                                                        • C:\Windows\System32\sc.exe
                                                                          sc stop WpnService
                                                                          3⤵
                                                                          • Launches sc.exe
                                                                          PID:4580
                                                                        • C:\Windows\System32\sc.exe
                                                                          sc config WpnService start= DISABLED
                                                                          3⤵
                                                                          • Launches sc.exe
                                                                          PID:3848
                                                                        • C:\Windows\System32\sc.exe
                                                                          sc stop diagnosticshub.standardcollector.service
                                                                          3⤵
                                                                          • Launches sc.exe
                                                                          PID:3808
                                                                        • C:\Windows\System32\sc.exe
                                                                          sc config diagnosticshub.standardcollector.service start= DISABLED
                                                                          3⤵
                                                                          • Launches sc.exe
                                                                          PID:4660
                                                                        • C:\Windows\System32\sc.exe
                                                                          sc stop DusmSvc
                                                                          3⤵
                                                                          • Launches sc.exe
                                                                          PID:2684
                                                                        • C:\Windows\System32\sc.exe
                                                                          sc config DusmSvc start= DISABLED
                                                                          3⤵
                                                                            PID:2952
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config TermService start= DISABLED
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:3476
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc stop WinRM
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:3856
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config WinRM start= DEMAND
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:1284
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc stop BTTS
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:4276
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config BITS start= DEMAND
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:4928
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config fhsvc start= DEMAND
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:1736
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config KtmRm start= DEMAND
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:812
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config PNRPAutoReg start= DEMAND
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:2128
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config wercplsupport start= DEMAND
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:4468
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config RpcLocator start= DEMAND
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:4828
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config svsvc start= DEMAND
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:3544
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config W32Time start= DEMAND
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:2984
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config EventSystem start= DEMAND
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:4060
                                                                          • C:\Windows\System32\sc.exe
                                                                            sc config MMCSS start= DEMAND
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:5092
                                                                          • C:\Windows\System32\reg.exe
                                                                            Reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /d 0 /t Reg_DWORD /f
                                                                            3⤵
                                                                              PID:2688
                                                                            • C:\Windows\System32\powercfg.exe
                                                                              powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
                                                                              3⤵
                                                                              • Power Settings
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3968
                                                                            • C:\Windows\System32\schtasks.exe
                                                                              SCHTASKS /Change /disable /TN "\Microsoft\Windows\Windows Error Reporting\QueueReporting"
                                                                              3⤵
                                                                                PID:4244
                                                                              • C:\Windows\System32\schtasks.exe
                                                                                SCHTASKS /Change /disable /TN "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver"
                                                                                3⤵
                                                                                  PID:3396
                                                                                • C:\Windows\System32\schtasks.exe
                                                                                  SCHTASKS /Change /disable /TN "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"
                                                                                  3⤵
                                                                                    PID:1488
                                                                                  • C:\Windows\System32\schtasks.exe
                                                                                    SCHTASKS /Change /disable /TN "\Microsoft\Windows\Diagnosis\Scheduled"
                                                                                    3⤵
                                                                                      PID:4068
                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                      SCHTASKS /Change /disable /TN "\Microsoft\Windows\Registry\RegIdleBackup"
                                                                                      3⤵
                                                                                        PID:2444
                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                        SCHTASKS /Change /disable /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start"
                                                                                        3⤵
                                                                                          PID:1628
                                                                                        • C:\Windows\System32\reg.exe
                                                                                          Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ScheduledDiagnostics" /v "EnabledExecution" /d 0 /t Reg_DWORD /f
                                                                                          3⤵
                                                                                            PID:4420
                                                                                          • C:\Windows\System32\reg.exe
                                                                                            Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "1000" /f
                                                                                            3⤵
                                                                                              PID:2260
                                                                                            • C:\Windows\System32\reg.exe
                                                                                              Reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t Reg_DWORD /d "0" /f
                                                                                              3⤵
                                                                                              • UAC bypass
                                                                                              PID:2192
                                                                                            • C:\Windows\System32\reg.exe
                                                                                              Reg add "HKEY_CURRENT_USER\Control Panel\Mouse" /v "MouseHoverTime" /t Reg_SZ /d "0" /f
                                                                                              3⤵
                                                                                                PID:1916
                                                                                              • C:\Windows\System32\reg.exe
                                                                                                Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" /v "Auto" /t Reg_SZ /d "0" /f
                                                                                                3⤵
                                                                                                  PID:1072
                                                                                                • C:\Windows\System32\reg.exe
                                                                                                  Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" /v "Auto" /t Reg_SZ /d "0" /f
                                                                                                  3⤵
                                                                                                    PID:4640
                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                    Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ExtendedUIHoverTime" /t Reg_DWORD /d "0" /f
                                                                                                    3⤵
                                                                                                      PID:2144
                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                      Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "DesktopLivePreviewHoverTime" /t Reg_DWORD /d "0" /f
                                                                                                      3⤵
                                                                                                        PID:1940
                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                        Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "nonetcrawling" /t Reg_DWORD /d "1" /f
                                                                                                        3⤵
                                                                                                          PID:2840
                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                          Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters" /v "maxnegativecachettl" /t Reg_DWORD /d "0" /f
                                                                                                          3⤵
                                                                                                            PID:4208
                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                            Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters" /v "maxcachettl" /t Reg_DWORD /d "10800" /f
                                                                                                            3⤵
                                                                                                              PID:4896
                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                              Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters" /v "maxcacheentryttllimit" /t Reg_DWORD /d "10800" /f
                                                                                                              3⤵
                                                                                                                PID:860
                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters" /v "netfailurecachetime" /t Reg_DWORD /d "0" /f
                                                                                                                3⤵
                                                                                                                • System Time Discovery
                                                                                                                PID:2328
                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters" /v "negativesoacachetime" /t Reg_DWORD /d "0" /f
                                                                                                                3⤵
                                                                                                                  PID:3940
                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                  Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters" /v "MaxConnectionsPerServer" /t Reg_DWORD /d "0" /f
                                                                                                                  3⤵
                                                                                                                    PID:3212
                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                    Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters" /v "Tcp1323Opts" /t Reg_DWORD /d "1" /f
                                                                                                                    3⤵
                                                                                                                      PID:1564
                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                      Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters" /v "SackOpts" /t Reg_DWORD /d "1" /f
                                                                                                                      3⤵
                                                                                                                        PID:2344
                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                        Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters" /v "TcpMaxDupAcks" /t Reg_DWORD /d "2" /f
                                                                                                                        3⤵
                                                                                                                          PID:3120
                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                          Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters" /v "NameSrvQueryTimeout" /t Reg_DWORD /d "3000" /f
                                                                                                                          3⤵
                                                                                                                            PID:2308
                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                            Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters" /v "EnablePMTUDiscovery" /t Reg_DWORD /d "1" /f
                                                                                                                            3⤵
                                                                                                                              PID:3484
                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                              Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters" /v "EnablePMTUBHDetect" /t Reg_DWORD /d "1" /f
                                                                                                                              3⤵
                                                                                                                                PID:3236
                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters" /v "DefaultTTL" /t Reg_DWORD /d "64" /f
                                                                                                                                3⤵
                                                                                                                                  PID:1744
                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                  Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /d 1 /t Reg_DWORD /f
                                                                                                                                  3⤵
                                                                                                                                    PID:2072
                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                    Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting" /v "DoReport" /d 0 /t Reg_DWORD /f
                                                                                                                                    3⤵
                                                                                                                                      PID:1212
                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                      Reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windows Error Reporting" /v "DontSendAdditionalData" /t Reg_DWORD /d 1 /f
                                                                                                                                      3⤵
                                                                                                                                        PID:2956
                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                        Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting" /v "ForceQueueMode" /t Reg_DWORD /d 0 /f
                                                                                                                                        3⤵
                                                                                                                                          PID:3248
                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                          Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" /v "DWNoExternalURL" /t Reg_DWORD /d 1 /f
                                                                                                                                          3⤵
                                                                                                                                            PID:1848
                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                            Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" /v "DWNoFileCollection" /t Reg_DWORD /d 1 /f
                                                                                                                                            3⤵
                                                                                                                                              PID:1608
                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                              Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\DW" /v "DWNoSecondLevelCollection" /t Reg_DWORD /d 1 /f
                                                                                                                                              3⤵
                                                                                                                                                PID:368
                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\HelpSvc" /v "Headlines" /t Reg_DWORD /d 0 /f
                                                                                                                                                3⤵
                                                                                                                                                  PID:2516
                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                  Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PCHealth\HelpSvc" /v "MicrosoftKBSearch" /t Reg_DWORD /d 0 /f
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1088
                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                    Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings" /v "DisableSendGenericDriverNotFoundToWER" /t Reg_DWORD /d 1 /f
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3364
                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                      Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Settings" /v "DisableSendRequestAdditionalSoftwareToWER" /t Reg_DWORD /d 1 /f
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4652
                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                        Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v "EnablePrefetcher" /t Reg_DWORD /d "0" /f
                                                                                                                                                        3⤵
                                                                                                                                                          PID:744
                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                          Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /d off /t Reg_SZ /f
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1284
                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                            Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows" /v "CEIPEnable" /d 0 /t Reg_DWORD /f
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4276
                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                              Reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PintoStartScreen" /f
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4380
                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /v "DisablePCA" /d 1 /t Reg_DWORD /f
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3500
                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                  Reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\DWM" /v "DisallowAnimations" /d 0 /t Reg_dword /f
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2104
                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                    Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "TurnOffSPIAnimations" /d 0 /t Reg_dword /f
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:768
                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                      Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /d 3 /t Reg_DWORD /f
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1620
                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                        Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM" /v "AlwaysHibernateThumbnails" /d 0 /t Reg_DWORD /f
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:2084
                                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                                          Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM" /v "EnableAeroPeek" /d 0 /t Reg_DWORD /f
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:208
                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                            Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /d 0 /t Reg_DWORD /f
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4060
                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                              Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "DragFullWindows" /d 0 /t Reg_SZ /f
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:3168
                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewAlphaSelect" /d 0 /t Reg_DWORD /f
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1264
                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                  Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewShadow" /d 0 /t Reg_DWORD /f
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3012
                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                    Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "FontSmoothing" /d 2 /t Reg_SZ /f
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:3432
                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                      Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "IconsOnly" /d 0 /t Reg_DWORD /f
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:4512
                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                        Reg add "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics" /v "MinAnimate" /d 1 /t Reg_SZ /f
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2300
                                                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                                                          Reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "UserPreferencesMask" /d "9012038012000000" /t Reg_BINARY /f
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1852
                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                            Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d "0" /f
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4520
                                                                                                                                                                                            • C:\Windows\System32\bcdedit.exe
                                                                                                                                                                                              bcdedit /set hypervisorlaunchtype off
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Modifies boot configuration data using bcdedit
                                                                                                                                                                                              PID:3132
                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                              Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v "NetworkThrottlingIndex" /t REG_DWORD /d "4294967295" /f
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2588
                                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                                Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v "SystemResponsiveness" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                  Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v "HiberbootEnabled" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4624
                                                                                                                                                                                                  • C:\Windows\System32\chkntfs.exe
                                                                                                                                                                                                    chkntfs /t:0
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:2484
                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                      Reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:2340
                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                        Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /d 0 /t REG_DWORD /f
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                                                                          Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer" /v "LimitSystemRestoreCheckpointing" /d 1 /t REG_DWORD /f
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:1680
                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                            Reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP\Clients" /f
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2772
                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                              Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v "DisableSR" /d 0 /t REG_DWORD /f
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:3136
                                                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                Reg add "HKLM\SOFTWARE\Microsoft\InputPersonalization" /v "Shutdown" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:332
                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                  Reg add "HKLM\SYSTEM\ControlSet001\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:3764
                                                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                    Reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2412
                                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                      Reg add "HKLM\SYSTEM\ControlSet001\Control\Session Manager\Memory Management" /v "IoPageLockLimit" /t REG_DWORD /d "134217728" /f
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2464
                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                        Reg add "HKLM\SYSTEM\ControlSet001\Control\Session Manager\Memory Management" /v "Disablepagingexecutive" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:3692
                                                                                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                          Reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HiberbootEnabled" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3864
                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                            Reg add "HKLM\SYSTEM\ControlSet001\Services\vwifimp\Enum" /v "Count" /t REG_DWORD /d "2" /f
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:2804
                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                              Reg add "HKLM\SYSTEM\ControlSet001\Services\vwifimp\Enum" /v "NextInstance" /t REG_DWORD /d "2" /f
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:3184
                                                                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                Reg add "HKLM\SYSTEM\CurrentControlSet\Services\vwifimp\Enum" /v "Count" /t REG_DWORD /d "2" /f
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3092
                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                  Reg add "HKLM\SYSTEM\CurrentControlSet\Services\vwifimp\Enum" /v "NextInstance" /t REG_DWORD /d "2" /f
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                    Reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout" /v "EnableAutoLayout" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1960
                                                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                      Reg add "HKLM\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction" /v "Enable" /t REG_SZ /d "N" /f
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                        Reg add "HKLM\SYSTEM\ControlSet001\Control\FileSystem" /v "DisableDeleteNotification" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:2740
                                                                                                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                          Reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "DisableDeleteNotification" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:1744
                                                                                                                                                                                                                                          • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                            net share ipc$ /delete
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:2892
                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                C:\Windows\system32\net1 share ipc$ /delete
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:1988
                                                                                                                                                                                                                                              • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                net share admin$ /delete
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 share admin$ /delete
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:3848
                                                                                                                                                                                                                                                  • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                    net share c$ /delete
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:512
                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\net1 share c$ /delete
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:5096
                                                                                                                                                                                                                                                      • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                        net share d$ /delete
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2832
                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\net1 share d$ /delete
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:3476
                                                                                                                                                                                                                                                          • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                            net share e$ /delete
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:3140
                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\net1 share e$ /delete
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:3808
                                                                                                                                                                                                                                                              • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                                net share f$ /delete
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:3104
                                                                                                                                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 share f$ /delete
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:2080
                                                                                                                                                                                                                                                                  • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                                    net share g$ /delete
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:3044
                                                                                                                                                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 share g$ /delete
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                      • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                                        net share h$ /delete
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:3500
                                                                                                                                                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 share h$ /delete
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:1184
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:4464
                                                                                                                                                                                                                                                                            • C:\Windows\System32\net.exe
                                                                                                                                                                                                                                                                              net share users /delete
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Indicator Removal: Network Share Connection Removal
                                                                                                                                                                                                                                                                              PID:2200
                                                                                                                                                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 share users /delete
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                • Indicator Removal: Network Share Connection Removal
                                                                                                                                                                                                                                                                                PID:2984
                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                              Reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "AutoShareWks" /t Reg_DWORD /d "0" /f
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:3100
                                                                                                                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                Reg add "HKLM\SYSTEM\ControlSet001\Services\LanmanServer\Parameters" /v "AutoShareServer" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:4060
                                                                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                  Reg add "HKLM\SYSTEM\ControlSet001\Services\LanmanServer\Parameters" /v "AutoShareWks" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                    Reg add "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" /v "AutoShareServer" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:3532
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                      Reg add "HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters" /v "AutoShareWks" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:2780
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                        Reg add "HKLM\SYSTEM\ControlSet001\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:3656
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                          Reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "NtfsDisable8dot3NameCreation" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:1144
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                            Reg add "HKCU\Control Panel\Desktop" /v "DragFullWindows" /t REG_SZ /d "0" /f
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:2444
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                              Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "SeparateProcess" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:3156
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                Reg add "HKCU\Control Panel\Desktop" /v "ForegroundLockTimeout" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:5020
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                  Reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "BackgroundAppGlobalToggle" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:4248
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                    Reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "ConfigFileAllocSize" /t REG_DWORD /d "100" /f
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:1112
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                      Reg add "HKLM\SYSTEM\ControlSet001\Services\LanmanServer\Parameters" /v "Size" /t REG_DWORD /d "2" /f
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                        Reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v "Size" /t REG_DWORD /d "2" /f
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:1764
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                          Reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" /v "Auto" /t REG_SZ /d "0" /f
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:4640
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                            Reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug" /v "Auto" /t REG_SZ /d "0" /f
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:2144
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                              Reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoSimpleNetIDList" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:1940
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v AlwaysUnloadDll /t REG_DWORD /d 00000001 /f
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:2840
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                  Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl" /v "AutoReboot" /d 0 /t REG_dword /f
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:4208
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                    Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl" /v "CrashDumpEnabled" /d 0 /t REG_dword /f
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                      Reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windows Error Reporting" /v "LoggingDisabled" /d 1 /t REG_dword /f
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:3652
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                        Reg add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "DoNotTrack" /d "1" /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                        PID:3060
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                        Reg add "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics" /v "PaddedBorderWidth" /d 0 /t REG_SZ /f
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:4628
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                          Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoRestartShell" /d "1" /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:832
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                            Reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Update" /v "UpdateMode" /d "1" /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:4020
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                              Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d 1808 /f
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:2188
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d 1 /f
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:1280
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                  Reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v "MaintenanceDisabled" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:1300
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                    Reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\MRT" /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:1664
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                      Reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds" /v "ShellFeedsTaskbarViewMode" /t REG_DWORD /d "2" /f
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:640
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                        Reg add "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell" /v "FolderType" /t REG_SZ /d "NotSpecified" /f
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                        PID:2996
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                        Reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                        PID:5104
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                        Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                        PID:3984
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                        Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t REG_DWORD /d "7" /f
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:2484
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                          Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t REG_DWORD /d "7" /f
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:3992
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                            Reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:2892
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                              Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Start" /v "ShowRecentList" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:3248
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Start" /v "ShowFrequentList" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4580
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                  Reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "EnableAutoTray" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4456
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                    Reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:368
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                      Reg add "HKEY_CURRENT_USER\Software\Microsoft\Clipboard" /v "EnableClipboardHistory" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1048
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                        Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                                                                                                                                                                                                        PID:2832
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                        Reg add "HKEY_CURRENT_USER\Software\Microsoft\IME\15.0\IMETC" /v "Default Input Mode" /t REG_SZ /d "0x00000001" /f
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4636
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                          Reg add "HKEY_CURRENT_USER\Software\Microsoft\TabletTip\1.7" /v "TipbandDesiredVisibility" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1552
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                            Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4928
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                              Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:744
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowCopilotButton" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2952
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_TrackProgs" /d 1 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:320
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_TrackDocs" /d 0 /t REG_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3928
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoRecentDocsHistory" /d 0 /t Reg_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3076
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                        Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInstrumentation" /d 0 /t Reg_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4468
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                          Reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" /v "DisableSearchBoxSuggestions" /d 1 /t Reg_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2104
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            Reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer" /v "DisableSearchHistory" /d 1 /t Reg_DWORD /f
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2148
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              Reg add "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" /v "IconStreams" /t Reg_BINARY /f
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                              PID:1580
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              Reg add "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" /v "PastIconsStream" /t Reg_BINARY /f
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                              PID:2084
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                              Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_IrisRecommendations" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3416
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_AccountNotifications" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2688
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                  Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Start" /v "VisiblePlaces" /t REG_BINARY /d "86087352aa5143429f7b2776584659d4bc248a140cd68942a0806ed9bba248824ab0bd744af9684f8bd64398071da8bc" /f
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    Reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\TaskbarDeveloperSettings" /v "TaskbarEndTask" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3176
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\Dism.exe
                                                                                                                                                                                                                                                                                                                                                                                      DISM /Online /Set-ReservedStorageState /State:Disabled
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                      PID:4512
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\A49ADCD6-DDDC-458E-A831-702AD007C0D9\dismhost.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\A49ADCD6-DDDC-458E-A831-702AD007C0D9\dismhost.exe {CFF766AF-BD51-4877-83A3-D3180FC67649}
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                        PID:3400
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                      Reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy" /v "01" /t REG_DWORD /d "0" /f
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3992
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                        Reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "AlwaysShowMenus" /t REG_DWORD /d "1" /f
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2892
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\gpupdate.exe
                                                                                                                                                                                                                                                                                                                                                                                          gpupdate /force
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3248
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                            taskkill /F /IM explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                            PID:4472
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                            PID:3104
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            Reg query "HKU\S-1-5-19\Environment"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2952
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\875fb3665387733cc84a96927c7b0be160110c89b2fc73b71f60b6b9eddcbb8a.exe
                                                                                                                                                                                                                                                                                                                                                                                            PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~7530446743173112637.cmd"
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                            PID:532
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              cmd /c "C:\Users\Admin\AppData\Local\Temp\~7530446743173112637.cmd"
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2464
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                            PID:3488
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\srtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3780
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                              PID:3896
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                              PID:2832

                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                                                                                                                                                  System Services

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1569

                                                                                                                                                                                                                                                                                                                                                                                                  Service Execution

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1569.002

                                                                                                                                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                                                  Active Setup

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1547.014

                                                                                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                  Power Settings

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1653

                                                                                                                                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1548

                                                                                                                                                                                                                                                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                                                  Active Setup

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1547.014

                                                                                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                  Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1548

                                                                                                                                                                                                                                                                                                                                                                                                  Bypass User Account Control

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1548.002

                                                                                                                                                                                                                                                                                                                                                                                                  Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1564

                                                                                                                                                                                                                                                                                                                                                                                                  Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1564.001

                                                                                                                                                                                                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                                                                                                                                                                                                  Disable or Modify Tools

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1562.001

                                                                                                                                                                                                                                                                                                                                                                                                  Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1070

                                                                                                                                                                                                                                                                                                                                                                                                  Network Share Connection Removal

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1070.005

                                                                                                                                                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                                                                                                                                  Network Share Discovery

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1135

                                                                                                                                                                                                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                  3
                                                                                                                                                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                  System Time Discovery

                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                  T1124

                                                                                                                                                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                                                                                                                                                  Inhibit System Recovery

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1490

                                                                                                                                                                                                                                                                                                                                                                                                  Service Stop

                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                  T1489

                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                  AppCache133754449393268326.txt
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133754449393268326.txt
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 74KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 84a54c5836c51441f888aa1313ba3d63e2d572ddc4904020d1a831e868285f49
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  AppxProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\AppxProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 554KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  AssocProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\AssocProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 112KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  CbsProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\CbsProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 875KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  DismCore.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\DismCore.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 402KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  DismCorePS.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\DismCorePS.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 183KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  DismHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\DismHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 142KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  DmiProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\DmiProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 415KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  FfuProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\FfuProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 619KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  FolderProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\FolderProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 59KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  GenericProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\GenericProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 149KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  IBSProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\IBSProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 59KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ImagingProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\ImagingProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 218KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  IntlProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\IntlProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 296KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1bb39f3389aa4258a923fa265afa2279688e6cdb14ff771f1621a56b03ddcf52
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  LogProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\LogProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 77KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  MsiProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\MsiProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 207KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7ff3939e1ef015da8c9577af4edfdd46f0029a2cfe4e3dac574d3175516e095f
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  OSProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\OSProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 149KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  OfflineSetupProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\OfflineSetupProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 182KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b38d322af8e614cc54299effd2164247c75bd7e68e0eb1a428376fcedaca9a6f
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ProvProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\ProvProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 753KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  SetupPlatformProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\SetupPlatformProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 159KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 367e73f97318b6663018a83a11019147e67b62ab83988730ebbda93984664dd3
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  SmiProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\SmiProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 246KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ac1e7407317859981d253fd9d977e246a4d0da24572c45efe0ade1745376bffb
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  SysprepProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\SysprepProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 778KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f9b4d0afe87f434e8319556961b292ddc7d3a8c6fc06b8a08a50b5a96e28a204
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  TransmogProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\TransmogProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 943ea79ccbbb9790723f411720777af386acc03efab709ac2cbfeb7bd040a3e4
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  UnattendProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\UnattendProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 228KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 05da5af89fafe492adf5255a7dbf16468be6d130ee8a9d713ab2182c72346db0
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  VhdProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\VhdProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 560KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4ed23b46188dae12523f96a2755434c0574cd27584f9921133b0b4c1017b8a36
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  WimProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\WimProvider.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 589KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8b7821a1fb9170c6aa1ec25eea378f43661812eba25064bb95999156b472c377
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  dismprov.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\dismprov.dll
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 255KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  AppxProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\AppxProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 22KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  AssocProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\AssocProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 8KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  CbsProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\CbsProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 53KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  DismCore.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\DismCore.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  DmiProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\DmiProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  FfuProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\FfuProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  FolderProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\FolderProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  GenericProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\GenericProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  IBSProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\IBSProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ImagingProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\ImagingProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 18KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  IntlProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\IntlProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 27KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 aa43b64db4fdcd89e56ba5309f3ba2ffac2663ba30514e87c160687f4314221f
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  LogProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\LogProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 6e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  MsiProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\MsiProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 1ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  OSProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\OSProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b6758aba17f6cd74923ca0976dd580222851ef6435cd16b3b2b04e85280ce706
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  OfflineSetupProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\OfflineSetupProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 692744ce4bba1e82ad1a91ab97eec2bac7146bc995e8e8ed59bc2c7d366af7ec
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ProvProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\ProvProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 50ad19e21b6425d12aa57cd4656748877db1f147189ec44abb19ba90be8505ea
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  SetupPlatformProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\SetupPlatformProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5d4dfc9bde18be1ec0b3834a65de6abab581e04c8c4f66ee14a62fb4b1b4cd06
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  SmiProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\SmiProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a1a302e940f6d6718700737b787af7a2053ef68b5ea2ec61497e7ae2444c5835
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  SysprepProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\SysprepProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 4389362a9dc662aa3c7a1d830498472bc586e00f0d269a8541975a34b03a1aa4
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  TransmogProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\TransmogProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 16KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a75288f9e83cccf2a6a644ff78e6c26dadd5772a2626f80120b81975664e7dab
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  UnattendProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\UnattendProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 11f7957b8cc57dd7176f62b0612e658d6588b7caa8be4db3a337953b02b98c24
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  VhdProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\VhdProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2ba085379434b3f9fcb0c70c2bd02a7f4f0170e6160578a583eb42c8d333fab7
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  WimProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\WimProvider.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 27KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a9eebcb85a0271061ac620ff9d2a6d22332721c782aeb06ab1ccf1149bff2aa4
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  dismprov.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\69B45CF8-47D4-4C07-A9D5-709146D5D239\en-US\dismprov.dll.mui
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ~7530446743173112637.cmd
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\~7530446743173112637.cmd
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 404B
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e76aa7e70ac0789ce0e091e2353964ad62a7fc35906ee714c950f07bc2fb2f30
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  ~~5648573657867449236.tmp.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\~~5648573657867449236.tmp.bat
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 25KB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 0ac5be46423a4bb3682ac644369312923d1740e84cc44b13073d55845bdcb903
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  dism.log
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Logs\DISM\dism.log
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8b636a86e5baf9e99da3a7aa9390c23121c87758742d5bc34e79818de529236a
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  dism.log
                                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Logs\DISM\dism.log
                                                                                                                                                                                                                                                                                                                                                                                                  • Size 2.2MB
                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 910b8ac86baeb7805c8a43207c8a0341d22bae2b9b764d53a355c54e5589d06e
                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/532-940-0x0000000000400000-0x00000000004F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/1624-237-0x0000000000400000-0x00000000004F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/1624-938-0x0000000000400000-0x00000000004F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/1624-0-0x0000000000400000-0x00000000004F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/1696-3-0x0000000000400000-0x00000000004F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/2832-946-0x000001FF137E0000-0x000001FF138E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/2832-947-0x000001FF137E0000-0x000001FF138E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/2832-951-0x000001FF14820000-0x000001FF14840000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/2832-974-0x000001FF14BF0000-0x000001FF14C10000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                  memory/2832-962-0x000001FF145E0000-0x000001FF14600000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                  Download