007cfb9b07a76a2ad7280deb4cf9c88d1f7e7fcd59ba7c028bb47dd351e46498

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Solar Lite V2.exe

Downloads MZ/PE file

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Solar Lite V2.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
3332	icacls.exe
4196	takeown.exe
4612	icacls.exe
3292	takeown.exe
3628	icacls.exe
4716	takeown.exe
4812	icacls.exe
2756	takeown.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Solar Lite V2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Solar Lite V2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Solar Lite Installer.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
2716	Solar Lite V2.exe
660	nvidiaProfileInspector.exe

Modifies file permissions 1 TTPs 8 IoCs

File and Directory Permissions Modification

T1222

pid	Process
3332	icacls.exe
4196	takeown.exe
4612	icacls.exe
3292	takeown.exe
3628	icacls.exe
4716	takeown.exe
4812	icacls.exe
2756	takeown.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4616	powershell.exe
3580	powershell.exe
1740	powershell.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	OneDriveSetup.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
31	discord.com
32	discord.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Solar Lite V2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Solar Lite V2.exe

Modifies boot configuration data using bcdedit 13 IoCs

pid	Process
800	bcdedit.exe
4980	bcdedit.exe
2268	bcdedit.exe
2756	bcdedit.exe
3560	bcdedit.exe
1484	bcdedit.exe
3168	bcdedit.exe
2408	bcdedit.exe
396	bcdedit.exe
3164	bcdedit.exe
924	bcdedit.exe
1736	bcdedit.exe
2160	bcdedit.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3720	powercfg.exe
2616	powercfg.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2632	tasklist.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3892	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileSyncConfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Solar Lite Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDriveSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDriveSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OneDriveSetup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 44 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
3892	cmd.exe
3904	cmd.exe
3620	reg.exe
2240	cmd.exe
1804	cmd.exe
4652	reg.exe
1736	reg.exe
4660	cmd.exe
2808	reg.exe
4132	cmd.exe
3512	reg.exe
5104	cmd.exe
3476	cmd.exe
2852	cmd.exe
2160	reg.exe
3580	cmd.exe
4948	reg.exe
2228	reg.exe
784	reg.exe
1296	reg.exe
1360	reg.exe
1664	cmd.exe
1364	reg.exe
5036	cmd.exe
3240	cmd.exe
2364	cmd.exe
2216	cmd.exe
4788	cmd.exe
2624	reg.exe
4832	cmd.exe
2752	reg.exe
3640	cmd.exe
4360	reg.exe
1224	reg.exe
3276	cmd.exe
2272	cmd.exe
1400	reg.exe
2016	reg.exe
2536	reg.exe
3996	reg.exe
2464	reg.exe
4564	reg.exe
804	cmd.exe
3472	cmd.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Solar Lite Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Solar Lite Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Solar Lite Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Solar Lite V2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Solar Lite V2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Solar Lite V2.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Mouse\MouseHoverTime = "10"	Solar Lite V2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\TypeLib\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\TYPELIB\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}\1.0\0\WIN32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\INTERFACE\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\CLSID\{389510B7-9E58-40D7-98BF-60B911CB0EA9}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{0F872661-C863-47A4-863F-C065C182858A}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\INTERFACE\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{466F31F7-9892-477E-B189-FA5C59DE3603}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\BannerNotificationHandler.BannerNotificationHandler.1	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{9E1CD0DF-72E7-4284-9598-342C0A46F96B}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Interface\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\INTERFACE\{31508CC7-9BC7-494B-9D0F-7B1C7F144182}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Interface\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\SYNCENGINEFILEINFOPROVIDER.SYNCENGINEFILEINFOPROVIDER\CURVER	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\FileSyncClient.AutoPlayHandler\shell	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\TYPELIB\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}\1.0\HELPDIR	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Interface\{b5c25645-7426-433f-8a5f-42b7ff27a7b2}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\WOW6432Node\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\INPROCSERVER32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\OOBEREQUESTHANDLER.OOBEREQUESTHANDLER\CLSID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\TYPELIB\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0\FLAGS	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\INTERFACE\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\INPROCSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\INTERFACE\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{02C98E2C-6C9F-49F8-9B57-3A6E1AA09A67}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\INTERFACE\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\INTERFACE\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\PROGID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\WOW6432Node\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Interface\{02C98E2C-6C9F-49F8-9B57-3A6E1AA09A67}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\WOW6432Node\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\INTERFACE\{9E1CD0DF-72E7-4284-9598-342C0A46F96B}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\WOW6432NODE\INTERFACE\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_CLASSES\INTERFACE\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\WOW6432Node\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}	OneDriveSetup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
4616	powershell.exe
2716	Solar Lite V2.exe
4616	powershell.exe
2716	Solar Lite V2.exe
4288	OneDriveSetup.exe
4288	OneDriveSetup.exe
2716	Solar Lite V2.exe
3404	OneDriveSetup.exe
3404	OneDriveSetup.exe
3404	OneDriveSetup.exe
3404	OneDriveSetup.exe
3404	OneDriveSetup.exe
3404	OneDriveSetup.exe
3404	OneDriveSetup.exe
3404	OneDriveSetup.exe
3404	OneDriveSetup.exe
3404	OneDriveSetup.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
3580	powershell.exe
3580	powershell.exe
1740	powershell.exe
1740	powershell.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe
2716	Solar Lite V2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	Solar Lite Installer.exe
Token: SeDebugPrivilege	2716	Solar Lite V2.exe
Token: SeIncreaseQuotaPrivilege	2948	WMIC.exe
Token: SeSecurityPrivilege	2948	WMIC.exe
Token: SeTakeOwnershipPrivilege	2948	WMIC.exe
Token: SeLoadDriverPrivilege	2948	WMIC.exe
Token: SeSystemProfilePrivilege	2948	WMIC.exe
Token: SeSystemtimePrivilege	2948	WMIC.exe
Token: SeProfSingleProcessPrivilege	2948	WMIC.exe
Token: SeIncBasePriorityPrivilege	2948	WMIC.exe
Token: SeCreatePagefilePrivilege	2948	WMIC.exe
Token: SeBackupPrivilege	2948	WMIC.exe
Token: SeRestorePrivilege	2948	WMIC.exe
Token: SeShutdownPrivilege	2948	WMIC.exe
Token: SeDebugPrivilege	2948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2948	WMIC.exe
Token: SeRemoteShutdownPrivilege	2948	WMIC.exe
Token: SeUndockPrivilege	2948	WMIC.exe
Token: SeManageVolumePrivilege	2948	WMIC.exe
Token: 33	2948	WMIC.exe
Token: 34	2948	WMIC.exe
Token: 35	2948	WMIC.exe
Token: 36	2948	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2948	WMIC.exe
Token: SeSecurityPrivilege	2948	WMIC.exe
Token: SeTakeOwnershipPrivilege	2948	WMIC.exe
Token: SeLoadDriverPrivilege	2948	WMIC.exe
Token: SeSystemProfilePrivilege	2948	WMIC.exe
Token: SeSystemtimePrivilege	2948	WMIC.exe
Token: SeProfSingleProcessPrivilege	2948	WMIC.exe
Token: SeIncBasePriorityPrivilege	2948	WMIC.exe
Token: SeCreatePagefilePrivilege	2948	WMIC.exe
Token: SeBackupPrivilege	2948	WMIC.exe
Token: SeRestorePrivilege	2948	WMIC.exe
Token: SeShutdownPrivilege	2948	WMIC.exe
Token: SeDebugPrivilege	2948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2948	WMIC.exe
Token: SeRemoteShutdownPrivilege	2948	WMIC.exe
Token: SeUndockPrivilege	2948	WMIC.exe
Token: SeManageVolumePrivilege	2948	WMIC.exe
Token: 33	2948	WMIC.exe
Token: 34	2948	WMIC.exe
Token: 35	2948	WMIC.exe
Token: 36	2948	WMIC.exe
Token: SeShutdownPrivilege	3720	powercfg.exe
Token: SeCreatePagefilePrivilege	3720	powercfg.exe
Token: SeShutdownPrivilege	2616	powercfg.exe
Token: SeCreatePagefilePrivilege	2616	powercfg.exe
Token: SeTakeOwnershipPrivilege	4196	takeown.exe
Token: SeTakeOwnershipPrivilege	3292	takeown.exe
Token: SeTakeOwnershipPrivilege	4716	takeown.exe
Token: SeTakeOwnershipPrivilege	2756	takeown.exe
Token: SeIncreaseQuotaPrivilege	2892	wmic.exe
Token: SeSecurityPrivilege	2892	wmic.exe
Token: SeTakeOwnershipPrivilege	2892	wmic.exe
Token: SeLoadDriverPrivilege	2892	wmic.exe
Token: SeSystemProfilePrivilege	2892	wmic.exe
Token: SeSystemtimePrivilege	2892	wmic.exe
Token: SeProfSingleProcessPrivilege	2892	wmic.exe
Token: SeIncBasePriorityPrivilege	2892	wmic.exe
Token: SeCreatePagefilePrivilege	2892	wmic.exe
Token: SeBackupPrivilege	2892	wmic.exe
Token: SeRestorePrivilege	2892	wmic.exe
Token: SeShutdownPrivilege	2892	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 2716	924	Solar Lite Installer.exe	99
PID 924 wrote to memory of 2716	924	Solar Lite Installer.exe	99
PID 2716 wrote to memory of 1620	2716	Solar Lite V2.exe	102
PID 2716 wrote to memory of 1620	2716	Solar Lite V2.exe	102
PID 1620 wrote to memory of 2948	1620	cmd.exe	104
PID 1620 wrote to memory of 2948	1620	cmd.exe	104
PID 2716 wrote to memory of 3584	2716	Solar Lite V2.exe	105
PID 2716 wrote to memory of 3584	2716	Solar Lite V2.exe	105
PID 3584 wrote to memory of 1172	3584	cmd.exe	107
PID 3584 wrote to memory of 1172	3584	cmd.exe	107
PID 2716 wrote to memory of 4932	2716	Solar Lite V2.exe	108
PID 2716 wrote to memory of 4932	2716	Solar Lite V2.exe	108
PID 4932 wrote to memory of 3624	4932	cmd.exe	110
PID 4932 wrote to memory of 3624	4932	cmd.exe	110
PID 2716 wrote to memory of 3676	2716	Solar Lite V2.exe	111
PID 2716 wrote to memory of 3676	2716	Solar Lite V2.exe	111
PID 3676 wrote to memory of 800	3676	cmd.exe	113
PID 3676 wrote to memory of 800	3676	cmd.exe	113
PID 2716 wrote to memory of 2736	2716	Solar Lite V2.exe	114
PID 2716 wrote to memory of 2736	2716	Solar Lite V2.exe	114
PID 2736 wrote to memory of 4980	2736	cmd.exe	116
PID 2736 wrote to memory of 4980	2736	cmd.exe	116
PID 2716 wrote to memory of 3424	2716	Solar Lite V2.exe	117
PID 2716 wrote to memory of 3424	2716	Solar Lite V2.exe	117
PID 3424 wrote to memory of 2268	3424	cmd.exe	119
PID 3424 wrote to memory of 2268	3424	cmd.exe	119
PID 2716 wrote to memory of 2540	2716	Solar Lite V2.exe	120
PID 2716 wrote to memory of 2540	2716	Solar Lite V2.exe	120
PID 2540 wrote to memory of 2756	2540	cmd.exe	123
PID 2540 wrote to memory of 2756	2540	cmd.exe	123
PID 2716 wrote to memory of 4160	2716	Solar Lite V2.exe	124
PID 2716 wrote to memory of 4160	2716	Solar Lite V2.exe	124
PID 4160 wrote to memory of 3560	4160	cmd.exe	126
PID 4160 wrote to memory of 3560	4160	cmd.exe	126
PID 2716 wrote to memory of 2792	2716	Solar Lite V2.exe	127
PID 2716 wrote to memory of 2792	2716	Solar Lite V2.exe	127
PID 2792 wrote to memory of 1484	2792	cmd.exe	129
PID 2792 wrote to memory of 1484	2792	cmd.exe	129
PID 2716 wrote to memory of 4776	2716	Solar Lite V2.exe	130
PID 2716 wrote to memory of 4776	2716	Solar Lite V2.exe	130
PID 4776 wrote to memory of 3168	4776	cmd.exe	132
PID 4776 wrote to memory of 3168	4776	cmd.exe	132
PID 2716 wrote to memory of 1168	2716	Solar Lite V2.exe	134
PID 2716 wrote to memory of 1168	2716	Solar Lite V2.exe	134
PID 1168 wrote to memory of 2408	1168	cmd.exe	136
PID 1168 wrote to memory of 2408	1168	cmd.exe	136
PID 2716 wrote to memory of 4592	2716	Solar Lite V2.exe	137
PID 2716 wrote to memory of 4592	2716	Solar Lite V2.exe	137
PID 4592 wrote to memory of 396	4592	cmd.exe	139
PID 4592 wrote to memory of 396	4592	cmd.exe	139
PID 2716 wrote to memory of 376	2716	Solar Lite V2.exe	140
PID 2716 wrote to memory of 376	2716	Solar Lite V2.exe	140
PID 376 wrote to memory of 3164	376	cmd.exe	142
PID 376 wrote to memory of 3164	376	cmd.exe	142
PID 2716 wrote to memory of 3248	2716	Solar Lite V2.exe	143
PID 2716 wrote to memory of 3248	2716	Solar Lite V2.exe	143
PID 3248 wrote to memory of 924	3248	cmd.exe	145
PID 3248 wrote to memory of 924	3248	cmd.exe	145
PID 2716 wrote to memory of 784	2716	Solar Lite V2.exe	146
PID 2716 wrote to memory of 784	2716	Solar Lite V2.exe	146
PID 784 wrote to memory of 1736	784	cmd.exe	148
PID 784 wrote to memory of 1736	784	cmd.exe	148
PID 2716 wrote to memory of 1008	2716	Solar Lite V2.exe	149
PID 2716 wrote to memory of 1008	2716	Solar Lite V2.exe	149

C:\Users\Admin\AppData\Local\Temp\Solar Lite Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Solar Lite Installer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924
- C:\Solar Services\Apps\Solar Lite V2\Solar Lite V2.exe
  "C:\Solar Services\Apps\Solar Lite V2\Solar Lite V2.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Enumerates system info in registry
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c wmic path Win32_VideoController get PNPDeviceID
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_VideoController get PNPDeviceID
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2948
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg query "HKLM\SYSTEM\ControlSet001\Enum\PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\3&11583659&0&08 " /v "Driver"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\ControlSet001\Enum\PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\3&11583659&0&08 " /v "Driver"
      4⤵
      PID:1172
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C Reg.exe add "HKLM\System\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "RMHdcpKeyglobZero" /t REG_DWORD /d "1" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Windows\system32\reg.exe
      Reg.exe add "HKLM\System\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "RMHdcpKeyglobZero" /t REG_DWORD /d "1" /f
      4⤵
      PID:3624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set UsePlatformTick Yes >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set UsePlatformTick Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:800
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set DisableDynamicTick Yes >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set DisableDynamicTick Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4980
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set NX AlwaysOff >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set NX AlwaysOff
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2268
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set BootUX disabled >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set BootUX disabled
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set HypervisorLaunchType Off >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set HypervisorLaunchType Off
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3560
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set VM No >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set VM No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1484
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set VSMLaunchType Off >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set VSMLaunchType Off
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3168
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set IsolatedContext No >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set IsolatedContext No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2408
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set Loadoptions DISABLE-LSA-ISO,DISABLE-VBS >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set Loadoptions DISABLE-LSA-ISO,DISABLE-VBS
      4⤵
      Modifies boot configuration data using bcdedit
      PID:396
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Timeout 0 >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Timeout 0
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3164
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set {GlobalSettings} Custom:16000067 True >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set {GlobalSettings} Custom:16000067 True
      4⤵
      Modifies boot configuration data using bcdedit
      PID:924
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set {GlobalSettings} Custom:16000069 True >Nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set {GlobalSettings} Custom:16000069 True
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1736
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c Bcdedit /Set {GlobalSettings} Custom:16000068 True >Nul 2>&1
    3⤵
    PID:1008
  - - C:\Windows\system32\bcdedit.exe
      Bcdedit /Set {GlobalSettings} Custom:16000068 True
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2160
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg ADD "HKLM\SYSTEM\CurrentControlSet\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d 5217772 /f
    3⤵
    PID:1384
  - - C:\Windows\system32\reg.exe
      reg ADD "HKLM\SYSTEM\CurrentControlSet\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d 5217772 /f
      4⤵
      PID:2684
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "ExitLatency" /t REG_DWORD /d 1 /f
    3⤵
    PID:800
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "ExitLatency" /t REG_DWORD /d 1 /f
      4⤵
      PID:3632
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "ExitLatencyCheckEnabled" /t REG_DWORD /d 1 /f
    3⤵
    PID:4456
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "ExitLatencyCheckEnabled" /t REG_DWORD /d 1 /f
      4⤵
      PID:4060
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "Latency" /t REG_DWORD /d 1 /f
    3⤵
    PID:4400
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "Latency" /t REG_DWORD /d 1 /f
      4⤵
      PID:3612
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyToleranceDefault" /t REG_DWORD /d 1 /f
    3⤵
    PID:2628
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyToleranceDefault" /t REG_DWORD /d 1 /f
      4⤵
      PID:1064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyToleranceFSVP" /t REG_DWORD /d 1 /f
    3⤵
    PID:4944
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyToleranceFSVP" /t REG_DWORD /d 1 /f
      4⤵
      PID:2216
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyTolerancePerfOverride" /t REG_DWORD /d 1 /f
    3⤵
    PID:3552
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyTolerancePerfOverride" /t REG_DWORD /d 1 /f
      4⤵
      PID:4108
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyToleranceScreenOffIR" /t REG_DWORD /d 1 /f
    3⤵
    PID:3168
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyToleranceScreenOffIR" /t REG_DWORD /d 1 /f
      4⤵
      PID:2408
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "RtlCapabilityCheckLatency" /t REG_DWORD /d 1 /f
    3⤵
    PID:756
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /v "RtlCapabilityCheckLatency" /t REG_DWORD /d 1 /f
      4⤵
      PID:2832
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyActivelyUsed" /t REG_DWORD /d 1 /f
    3⤵
    PID:1740
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyActivelyUsed" /t REG_DWORD /d 1 /f
      4⤵
      PID:4616
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleLongTime" /t REG_DWORD /d 1 /f
    3⤵
    PID:4448
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleLongTime" /t REG_DWORD /d 1 /f
      4⤵
      PID:4220
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleMonitorOff" /t REG_DWORD /d 1 /f
    3⤵
    PID:4420
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleMonitorOff" /t REG_DWORD /d 1 /f
      4⤵
      PID:4356
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleNoContext" /t REG_DWORD /d 1 /f
    3⤵
    PID:1648
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleNoContext" /t REG_DWORD /d 1 /f
      4⤵
      PID:1796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleShortTime" /t REG_DWORD /d 1 /f
    3⤵
    PID:3248
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleShortTime" /t REG_DWORD /d 1 /f
      4⤵
      PID:2152
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleVeryLongTime" /t REG_DWORD /d 1 /f
    3⤵
    PID:4968
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleVeryLongTime" /t REG_DWORD /d 1 /f
      4⤵
      PID:4988
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle0" /t REG_DWORD /d 1 /f
    3⤵
    PID:3372
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle0" /t REG_DWORD /d 1 /f
      4⤵
      PID:3700
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle0MonitorOff" /t REG_DWORD /d 1 /f
    3⤵
    PID:2992
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle0MonitorOff" /t REG_DWORD /d 1 /f
      4⤵
      PID:4624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle1" /t REG_DWORD /d 1 /f
    3⤵
    PID:2336
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle1" /t REG_DWORD /d 1 /f
      4⤵
      PID:2624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle1MonitorOff" /t REG_DWORD /d 1 /f
    3⤵
    PID:368
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle1MonitorOff" /t REG_DWORD /d 1 /f
      4⤵
      PID:1636
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceMemory" /t REG_DWORD /d 1 /f
    3⤵
    PID:4980
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceMemory" /t REG_DWORD /d 1 /f
      4⤵
      PID:4872
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceNoContext" /t REG_DWORD /d 1 /f
    3⤵
    PID:2324
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceNoContext" /t REG_DWORD /d 1 /f
      4⤵
      PID:4008
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceNoContextMonitorOff" /t REG_DWORD /d 1 /f
    3⤵
    PID:3684
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceNoContextMonitorOff" /t REG_DWORD /d 1 /f
      4⤵
      PID:1652
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceOther" /t REG_DWORD /d 1 /f
    3⤵
    PID:1936
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceOther" /t REG_DWORD /d 1 /f
      4⤵
      PID:3752
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceTimerPeriod" /t REG_DWORD /d 1 /f
    3⤵
    PID:4944
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceTimerPeriod" /t REG_DWORD /d 1 /f
      4⤵
      PID:1660
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultMemoryRefreshLatencyToleranceActivelyUsed" /t REG_DWORD /d 1 /f
    3⤵
    PID:3552
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultMemoryRefreshLatencyToleranceActivelyUsed" /t REG_DWORD /d 1 /f
      4⤵
      PID:4964
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultMemoryRefreshLatencyToleranceMonitorOff" /t REG_DWORD /d 1 /f
    3⤵
    PID:660
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultMemoryRefreshLatencyToleranceMonitorOff" /t REG_DWORD /d 1 /f
      4⤵
      PID:3676
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultMemoryRefreshLatencyToleranceNoContext" /t REG_DWORD /d 1 /f
    3⤵
    PID:4440
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultMemoryRefreshLatencyToleranceNoContext" /t REG_DWORD /d 1 /f
      4⤵
      PID:1740
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "Latency" /t REG_DWORD /d 1 /f
    3⤵
    PID:4868
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "Latency" /t REG_DWORD /d 1 /f
      4⤵
      PID:4448
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MaxIAverageGraphicsLatencyInOneBucket" /t REG_DWORD /d 1 /f
    3⤵
    PID:3164
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MaxIAverageGraphicsLatencyInOneBucket" /t REG_DWORD /d 1 /f
      4⤵
      PID:4780
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MiracastPerfTrackGraphicsLatency" /t REG_DWORD /d 1 /f
    3⤵
    PID:1736
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MiracastPerfTrackGraphicsLatency" /t REG_DWORD /d 1 /f
      4⤵
      PID:4948
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MonitorLatencyTolerance" /t REG_DWORD /d 1 /f
    3⤵
    PID:1844
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MonitorLatencyTolerance" /t REG_DWORD /d 1 /f
      4⤵
      PID:1064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MonitorRefreshLatencyTolerance" /t REG_DWORD /d 1 /f
    3⤵
    PID:2408
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MonitorRefreshLatencyTolerance" /t REG_DWORD /d 1 /f
      4⤵
      PID:3140
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "TransitionLatency" /t REG_DWORD /d 1 /f
    3⤵
    PID:696
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "TransitionLatency" /t REG_DWORD /d 1 /f
      4⤵
      PID:4660
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "DesktopLivePreviewHoverTime" /t REG_DWORD /d 1 /f
    3⤵
    PID:4048
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "DesktopLivePreviewHoverTime" /t REG_DWORD /d 1 /f
      4⤵
      PID:2184
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Control Panel\Mouse" /v "MouseHoverTime" /t REG_SZ /d "1" /f
    3⤵
    PID:712
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Control Panel\Mouse" /v "MouseHoverTime" /t REG_SZ /d "1" /f
      4⤵
      PID:4520
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "1" /f
    3⤵
    PID:1820
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "1" /f
      4⤵
      PID:4624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "ActiveWndTrackTimeout" /t REG_DWORD /d 10 /f
    3⤵
    PID:5028
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "ActiveWndTrackTimeout" /t REG_DWORD /d 10 /f
      4⤵
      PID:2324
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "AutoEndTasks" /t REG_SZ /d "1" /f
    3⤵
    PID:3864
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "AutoEndTasks" /t REG_SZ /d "1" /f
      4⤵
      PID:944
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "HungAppTimeout" /t REG_SZ /d "2000" /f
    3⤵
    PID:1140
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "HungAppTimeout" /t REG_SZ /d "2000" /f
      4⤵
      PID:4564
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "0" /f
    3⤵
    PID:3752
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "0" /f
      4⤵
      PID:3560
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "WaitToKillAppTimeout" /t REG_SZ /d "3000" /f
    3⤵
    PID:2760
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "WaitToKillAppTimeout" /t REG_SZ /d "3000" /f
      4⤵
      PID:3640
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "LowLevelHooksTimeout" /t REG_SZ /d "2000" /f
    3⤵
    PID:1156
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "LowLevelHooksTimeout" /t REG_SZ /d "2000" /f
      4⤵
      PID:4840
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_ShowRun" /t REG_DWORD /d 1 /f
    3⤵
    PID:5060
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Start_ShowRun" /t REG_DWORD /d 1 /f
      4⤵
      PID:4540
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLowDiskSpaceChecks" /t REG_DWORD /d 1 /f
    3⤵
    PID:1588
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoLowDiskSpaceChecks" /t REG_DWORD /d 1 /f
      4⤵
      PID:912
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "LinkResolveIgnoreLinkInfo" /t REG_DWORD /d 1 /f
    3⤵
    PID:4480
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "LinkResolveIgnoreLinkInfo" /t REG_DWORD /d 1 /f
      4⤵
      PID:2044
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoResolveSearch" /t REG_DWORD /d 1 /f
    3⤵
    PID:4288
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoResolveSearch" /t REG_DWORD /d 1 /f
      4⤵
      PID:5116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoResolveTrack" /t REG_DWORD /d 1 /f
    3⤵
    PID:4108
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoResolveTrack" /t REG_DWORD /d 1 /f
      4⤵
      PID:4220
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetOpenWith" /t REG_DWORD /d 1 /f
    3⤵
    PID:3616
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetOpenWith" /t REG_DWORD /d 1 /f
      4⤵
      PID:4240
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "2000" /f
    3⤵
    PID:1400
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "2000" /f
      4⤵
      PID:5088
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "2000" /f
    3⤵
    PID:3848
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "2000" /f
      4⤵
      PID:4448
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "2000" /f
    3⤵
    PID:3140
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "2000" /f
      4⤵
      PID:3236
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg ADD "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "Win32PrioritySeparation" /t REG_DWORD /d 24 /f
    3⤵
    PID:3968
  - - C:\Windows\system32\reg.exe
      reg ADD "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "Win32PrioritySeparation" /t REG_DWORD /d 24 /f
      4⤵
      PID:2304
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility" /v "StickyKeys" /t REG_SZ /d "506" /f
    3⤵
    PID:1236
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility" /v "StickyKeys" /t REG_SZ /d "506" /f
      4⤵
      PID:3508
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "DelayBeforeAcceptance" /t REG_SZ /d "0" /f
    3⤵
    PID:4680
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "DelayBeforeAcceptance" /t REG_SZ /d "0" /f
      4⤵
      PID:3864
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "AutoRepeatRate" /t REG_SZ /d "0" /f
    3⤵
    PID:2384
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "AutoRepeatRate" /t REG_SZ /d "0" /f
      4⤵
      PID:512
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "AutoRepeatDelay" /t REG_SZ /d "0" /f
    3⤵
    PID:2412
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "AutoRepeatDelay" /t REG_SZ /d "0" /f
      4⤵
      PID:1328
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "122" /f
    3⤵
    PID:4184
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "122" /f
      4⤵
      PID:4520
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "AutoRepeatDelay" /t REG_SZ /d "0" /f
    3⤵
    PID:944
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "AutoRepeatDelay" /t REG_SZ /d "0" /f
      4⤵
      PID:3980
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "AutoRepeatRate" /t REG_SZ /d "0" /f
    3⤵
    PID:2728
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "AutoRepeatRate" /t REG_SZ /d "0" /f
      4⤵
      PID:2260
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "BounceTime" /t REG_SZ /d "0" /f
    3⤵
    PID:2792
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "BounceTime" /t REG_SZ /d "0" /f
      4⤵
      PID:1208
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "DelayBeforeAcceptance" /t REG_SZ /d "0" /f
    3⤵
    PID:924
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "DelayBeforeAcceptance" /t REG_SZ /d "0" /f
      4⤵
      PID:4480
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Last BounceKey Setting" /t REG_SZ /d "0" /f
    3⤵
    PID:2272
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Last BounceKey Setting" /t REG_SZ /d "0" /f
      4⤵
      PID:4288
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Last Valid Delay" /t REG_SZ /d "0" /f
    3⤵
    PID:4416
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Last Valid Delay" /t REG_SZ /d "0" /f
      4⤵
      PID:4840
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Last Valid Repeat" /t REG_SZ /d "0" /f
    3⤵
    PID:2216
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Last Valid Repeat" /t REG_SZ /d "0" /f
      4⤵
      PID:4956
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c sc config SysMain start=disabled
    3⤵
    PID:3248
  - - C:\Windows\system32\sc.exe
      sc config SysMain start=disabled
      4⤵
      Launches sc.exe
      PID:3892
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Last Valid Wait" /t REG_SZ /d "1000" /f
    3⤵
    PID:4968
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Last Valid Wait" /t REG_SZ /d "1000" /f
      4⤵
      PID:1064
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "126" /f
    3⤵
    PID:4008
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "126" /f
      4⤵
      PID:3236
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "Flags" /t REG_DWORD /d 62 /f
    3⤵
    PID:4596
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "Flags" /t REG_DWORD /d 62 /f
      4⤵
      PID:2256
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "MaximumSpeed" /t REG_SZ /d "40" /f
    3⤵
    PID:2616
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "MaximumSpeed" /t REG_SZ /d "40" /f
      4⤵
      PID:3964
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "TimeToMaximumSpeed" /t REG_SZ /d "3000" /f
    3⤵
    PID:1364
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v "TimeToMaximumSpeed" /t REG_SZ /d "3000" /f
      4⤵
      PID:3476
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Version" /t REG_SZ /d "1.0" /f
    3⤵
    PID:2624
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Version" /t REG_SZ /d "1.0" /f
      4⤵
      PID:3572
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Application Name" /t REG_SZ /d "javaw.exe" /f
    3⤵
    PID:3996
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Application Name" /t REG_SZ /d "javaw.exe" /f
      4⤵
      PID:3972
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Protocol" /t REG_SZ /d "*" /f
    3⤵
    PID:3040
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Protocol" /t REG_SZ /d "*" /f
      4⤵
      PID:3684
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Local Port" /t REG_SZ /d "*" /f
    3⤵
    PID:2752
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Local Port" /t REG_SZ /d "*" /f
      4⤵
      PID:3224
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Local IP" /t REG_SZ /d "*" /f
    3⤵
    PID:1004
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Local IP" /t REG_SZ /d "*" /f
      4⤵
      PID:1520
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Local IP Prefix Length" /t REG_SZ /d "*" /f
    3⤵
    PID:4160
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Local IP Prefix Length" /t REG_SZ /d "*" /f
      4⤵
      PID:2736
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Remote Port" /t REG_SZ /d "*" /f
    3⤵
    PID:756
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Remote Port" /t REG_SZ /d "*" /f
      4⤵
      PID:4896
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Remote IP" /t REG_SZ /d "*" /f
    3⤵
    PID:1272
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Remote IP" /t REG_SZ /d "*" /f
      4⤵
      PID:2836
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Remote IP Prefix Length" /t REG_SZ /d "*" /f
    3⤵
    PID:4528
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Remote IP Prefix Length" /t REG_SZ /d "*" /f
      4⤵
      PID:4420
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "DSCP Value" /t REG_SZ /d "46" /f
    3⤵
    PID:2884
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "DSCP Value" /t REG_SZ /d "46" /f
      4⤵
      PID:4104
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Throttle Rate" /t REG_SZ /d "-1" /f
    3⤵
    PID:1648
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\javaw.exe" /v "Throttle Rate" /t REG_SZ /d "-1" /f
      4⤵
      PID:5116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Version" /t REG_SZ /d "1.0" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3580
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Version" /t REG_SZ /d "1.0" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Application Name" /t REG_SZ /d "FortniteClient-Win64-Shipping.exe" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2216
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Application Name" /t REG_SZ /d "FortniteClient-Win64-Shipping.exe" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1400
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Protocol" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3892
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Protocol" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4948
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Local Port" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4660
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Local Port" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2016
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Local IP" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3904
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Local IP" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2536
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Local IP Prefix Length" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5104
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Local IP Prefix Length" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3620
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Remote Port" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4788
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Remote Port" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1360
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Remote IP" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1664
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Remote IP" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1364
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Remote IP Prefix Length" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4832
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Remote IP Prefix Length" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2808
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "DSCP Value" /t REG_SZ /d "46" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3476
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "DSCP Value" /t REG_SZ /d "46" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2228
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Throttle Rate" /t REG_SZ /d "-1" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2240
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\FortniteClient-Win64-Shipping.exe" /v "Throttle Rate" /t REG_SZ /d "-1" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2624
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Version" /t REG_SZ /d "1.0" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4132
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Version" /t REG_SZ /d "1.0" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3996
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Application Name" /t REG_SZ /d "Valorant-Win64-Shipping.exe" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5036
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Application Name" /t REG_SZ /d "Valorant-Win64-Shipping.exe" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2464
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Protocol" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3240
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Protocol" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2752
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Local Port" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1804
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Local Port" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4652
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Local IP" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2852
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Local IP" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4564
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Local IP Prefix Length" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3640
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Local IP Prefix Length" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3512
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Remote Port" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:804
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Remote Port" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4360
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Remote IP" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2364
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Remote IP" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1224
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Remote IP Prefix Length" /t REG_SZ /d "*" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3276
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Remote IP Prefix Length" /t REG_SZ /d "*" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:784
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "DSCP Value" /t REG_SZ /d "46" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2272
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "DSCP Value" /t REG_SZ /d "46" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1736
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Throttle Rate" /t REG_SZ /d "-1" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3472
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\Valorant-Win64-Shipping.exe" /v "Throttle Rate" /t REG_SZ /d "-1" /f
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2160
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg ADD "HKLM\SYSTEM\CurrentControlSet\Control\Processor" /v "Cstates" /t REG_DWORD /d 1 /f
    3⤵
    PID:3616
  - - C:\Windows\system32\reg.exe
      reg ADD "HKLM\SYSTEM\CurrentControlSet\Control\Processor" /v "Cstates" /t REG_DWORD /d 1 /f
      4⤵
      PID:1012
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C reg ADD "HKLM\SYSTEM\CurrentControlSet\Control\Processor" /v "Capabilities" /t REG_DWORD /d 0 /f
    3⤵
    PID:64
  - - C:\Windows\system32\reg.exe
      reg ADD "HKLM\SYSTEM\CurrentControlSet\Control\Processor" /v "Capabilities" /t REG_DWORD /d 0 /f
      4⤵
      PID:3152
- - C:\Windows\SYSTEM32\powercfg.exe
    "powercfg" /import "C:\Solar Lite V2\Applications\Core.pow" 945fe57c-e762-487e-984a-4e9213d9e9d7
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- - C:\Windows\SYSTEM32\powercfg.exe
    "powercfg" /setactive 945fe57c-e762-487e-984a-4e9213d9e9d7
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\Acpidev.sys"
    3⤵
    PID:1952
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\drivers\Acpidev.sys"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4196
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\Acpidev.sys" /grant "Admin":F
    3⤵
    PID:636
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\Acpidev.sys" /grant "Admin":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4612
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\Acpipagr.sys"
    3⤵
    PID:3952
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\drivers\Acpipagr.sys"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:3292
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\Acpipagr.sys" /grant "Admin":F
    3⤵
    PID:2672
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\Acpipagr.sys" /grant "Admin":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3628
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\Acpitime.sys"
    3⤵
    PID:3572
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\drivers\Acpitime.sys"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4716
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\Acpitime.sys" /grant "Admin":F
    3⤵
    PID:2300
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\Acpitime.sys" /grant "Admin":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4812
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c takeown /f "C:\Windows\system32\drivers\Acpipmi.sys"
    3⤵
    PID:2628
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\drivers\Acpipmi.sys"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c icacls "C:\Windows\system32\drivers\Acpipmi.sys" /grant "Admin":F
    3⤵
    PID:4328
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\drivers\Acpipmi.sys" /grant "Admin":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3332
- - C:\Solar Lite V2\Applications\Nvidia Profile Inspector\nvidiaProfileInspector.exe
    "C:\Solar Lite V2\Applications\Nvidia Profile Inspector\nvidiaProfileInspector.exe" "C:\Solar Lite V2\Applications\Nvidia Profile Inspector\Config\NPIConfig.nip"
    3⤵
    - Executes dropped EXE
    PID:660
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" path Win32_VideoController get PNPDeviceID
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\kr2tosug.024\jwjpmara.tyf.bat"
    3⤵
    PID:2272
  - - C:\Windows\system32\fltMC.exe
      fltmc
      4⤵
      PID:4588
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "ImageName eq OneDrive.exe" /fo csv
      4⤵
      Enumerates processes with tasklist
      PID:2632
  - - C:\Windows\system32\find.exe
      find /i "OneDrive.exe"
      4⤵
      PID:1736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -ExecutionPolicy Unrestricted -Command "$keyName = 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'; $valueName = 'OneDrive'; $hive = $keyName.Split('\')[0]; $path = """$($hive):$($keyName.Substring($hive.Length))"""; Write-Host """Removing the registry value '$valueName' from '$path'."""; if (-Not (Test-Path -LiteralPath $path)) { Write-Host 'Skipping, no action needed, registry key does not exist.'; Exit 0; }; $existingValueNames = (Get-ItemProperty -LiteralPath $path).PSObject.Properties.Name; if (-Not ($existingValueNames -Contains $valueName)) { Write-Host 'Skipping, no action needed, registry value does not exist.'; Exit 0; }; try { if ($valueName -ieq '(default)') { Write-Host 'Removing the default value.'; $(Get-Item -LiteralPath $path).OpenSubKey('', $true).DeleteValue(''); } else { Remove-ItemProperty -LiteralPath $path -Name $valueName -Force -ErrorAction Stop; }; Write-Host 'Successfully removed the registry value.'; } catch { Write-Error """Failed to remove the registry value: $($_.Exception.Message)"""; }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4616
  - - C:\Windows\SysWOW64\OneDriveSetup.exe
      "C:\Windows\SysWOW64\OneDriveSetup.exe" /uninstall
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4288
    - - C:\Windows\SysWOW64\OneDriveSetup.exe
        
        "C:\Windows\SysWOW64\OneDriveSetup.exe" C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /permachine /childprocess /silent /enableOMCTelemetry /enableExtractCabV2 /cusid:S-1-5-21-493223053-2004649691-1575712786-1000
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
    - - C:\Windows\SysWOW64\OneDriveSetup.exe
        
        C:\Windows\SysWOW64\OneDriveSetup.exe /uninstall /peruser /childprocess /enableOMCTelemetry /enableExtractCabV2
        5⤵
        Modifies system executable filetype association
        Drops desktop.ini file(s)
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe" /uninstall
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\OneDrive*'; if (-Not $directoryGlob.EndsWith('\')) { $directoryGlob += '\' }; $directoryGlob )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; $deletedCount = 0; $failedCount = 0; $oneDriveUserFolderPattern = [System.Environment]::ExpandEnvironmentVariables('C:\Users\Admin\OneDrive') + '*'; while ($true) { <# Loop to control the execution of the subsequent code #>; try { $userShellFoldersRegistryPath = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders'; if (-not (Test-Path $userShellFoldersRegistryPath)) { Write-Output """Skipping verification: The registry path for user shell folders is missing: `"""$userShellFoldersRegistryPath`""""""; break; }; $userShellFoldersRegistryKeys = Get-ItemProperty -Path $userShellFoldersRegistryPath; $userShellFoldersEntries = @($userShellFoldersRegistryKeys.PSObject.Properties); if ($userShellFoldersEntries.Count -eq 0) { Write-Warning """Skipping verification: No entries found for user shell folders in the registry: `"""$userShellFoldersRegistryPath`""""""; break; }; Write-Output """Initiating verification: Checking if any of the ${userShellFoldersEntries.Count} user shell folders point to the OneDrive user folder pattern ($oneDriveUserFolderPattern)."""; $userShellFoldersInOneDrive = @(); foreach ($registryEntry in $userShellFoldersEntries) { $userShellFolderName = $registryEntry.Name; $userShellFolderPath = $registryEntry.Value; if (!$userShellFolderPath) { Write-Output """Skipping: The user shell folder `"""$userShellFolderName`""" does not have a defined path."""; continue; }; $expandedUserShellFolderPath = [System.Environment]::ExpandEnvironmentVariables($userShellFolderPath); if(-not ($expandedUserShellFolderPath -like $oneDriveUserFolderPattern)) { continue; }; $userShellFoldersInOneDrive += [PSCustomObject]@{ Name = $userShellFolderName; Path = $expandedUserShellFolderPath }; }; if ($userShellFoldersInOneDrive.Count -gt 0) { $warningMessage = 'To keep your computer running smoothly, OneDrive user folder will not be deleted.'; $warningMessage += """`nIt's being used by the OS as a user shell directory for the following folders:"""; $userShellFoldersInOneDrive.ForEach( { $warningMessage += """`n- $($_.Name): $($_.Path)"""; }); Write-Warning $warningMessage; exit 0; }; Write-Output """Successfully verified that none of the $($userShellFoldersEntries.Count) user shell folders point to the OneDrive user folder pattern."""; break; } catch { Write-Warning """An error occurred during verification of user shell folders. Skipping prevent potential issues. Error: $($_.Exception.Message)"""; exit 0; }; }; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { try { if (Test-Path -Path $path -PathType Leaf) { Write-Warning """Retaining file `"""$path`""" to safeguard your data."""; continue; } elseif (Test-Path -Path $path -PathType Container) { if ((Get-ChildItem """$path""" -Recurse | Measure-Object).Count -gt 0) { Write-Warning """Preserving non-empty folder `"""$path`""" to protect your files."""; continue; }; }; } catch { Write-Warning """An error occurred while processing `"""$path`""". Skipping to protect your data. Error: $($_.Exception.Message)"""; continue; }; if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      PowerShell -ExecutionPolicy Unrestricted -Command "$pathGlobPattern = """$($directoryGlob = 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive'; if (-Not $directoryGlob.EndsWith('\')) { $directoryGlob += '\' }; $directoryGlob )"""; $expandedPath = [System.Environment]::ExpandEnvironmentVariables($pathGlobPattern); Write-Host """Searching for items matching pattern: `"""$($expandedPath)`"""."""; <# Not using `Get-Acl`/`Set-Acl` to avoid adjusting token privileges #>; $parentDirectory = [System.IO.Path]::GetDirectoryName($expandedPath); $fileName = [System.IO.Path]::GetFileName($expandedPath); if ($parentDirectory -like '*[*?]*') { throw """Unable to grant permissions to glob path parent directory: `"""$parentDirectory`""", wildcards in parent directory are not supported by ``takeown`` and ``icacls``."""; }; if (($fileName -ne '*') -and ($fileName -like '*[*?]*')) { throw """Unable to grant permissions to glob path file name: `"""$fileName`""", wildcards in file name is not supported by ``takeown`` and ``icacls``."""; }; Write-Host """Taking ownership of `"""$expandedPath`"""."""; $cmdPath = $expandedPath; if ($cmdPath.EndsWith('\')) { $cmdPath += '\' <# Escape trailing backslash for correct handling in batch commands #>; }; $takeOwnershipCommand = """takeown /f `"""$cmdPath`""" /a""" <# `icacls /setowner` does not succeed, so use `takeown` instead. #>; if (-not (Test-Path -Path """$expandedPath""" -PathType Leaf)) { $localizedYes = 'Y' <# Default 'Yes' flag (fallback) #>; try { $choiceOutput = cmd /c """choice <nul 2>nul"""; if ($choiceOutput -and $choiceOutput.Length -ge 2) { $localizedYes = $choiceOutput[1]; } else { Write-Warning """Failed to determine localized 'Yes' character. Output: `"""$choiceOutput`""""""; }; } catch { Write-Warning """Failed to determine localized 'Yes' character. Error: $_"""; }; $takeOwnershipCommand += """ /r /d $localizedYes"""; }; $takeOwnershipOutput = cmd /c """$takeOwnershipCommand 2>&1""" <# `stderr` message is misleading, e.g. """ERROR: The system cannot find the file specified.""" is not an error. #>; if ($LASTEXITCODE -eq 0) { Write-Host """Successfully took ownership of `"""$expandedPath`""" (using ``$takeOwnershipCommand``)."""; } else { Write-Host """Did not take ownership of `"""$expandedPath`""" using ``$takeOwnershipCommand``, status code: $LASTEXITCODE, message: $takeOwnershipOutput."""; <# Do not write as error or warning, because this can be due to missing path, it's handled in next command. #>; <# `takeown` exits with status code `1`, making it hard to handle missing path here. #>; }; Write-Host """Granting permissions for `"""$expandedPath`"""."""; $adminSid = New-Object System.Security.Principal.SecurityIdentifier 'S-1-5-32-544'; $adminAccount = $adminSid.Translate([System.Security.Principal.NTAccount]); $adminAccountName = $adminAccount.Value; $grantPermissionsCommand = """icacls `"""$cmdPath`""" /grant `"""$($adminAccountName):F`""" /t"""; $icaclsOutput = cmd /c """$grantPermissionsCommand"""; if ($LASTEXITCODE -eq 3) { Write-Host """Skipping, no items available for deletion according to: ``$grantPermissionsCommand``."""; exit 0; } elseif ($LASTEXITCODE -ne 0) { Write-Host """Take ownership message:`n$takeOwnershipOutput"""; Write-Host """Grant permissions:`n$icaclsOutput"""; Write-Warning """Failed to assign permissions for `"""$expandedPath`""" using ``$grantPermissionsCommand``, status code: $LASTEXITCODE."""; } else { $fileStats = $icaclsOutput | ForEach-Object { $_ -match '\d+' | Out-Null; $matches[0] } | Where-Object { $_ -ne $null } | ForEach-Object { [int]$_ }; if ($fileStats.Count -gt 0 -and ($fileStats | ForEach-Object { $_ -eq 0 } | Where-Object { $_ -eq $false }).Count -eq 0) { Write-Host """Skipping, no items available for deletion according to: ``$grantPermissionsCommand``."""; exit 0; } else { Write-Host """Successfully granted permissions for `"""$expandedPath`""" (using ``$grantPermissionsCommand``)."""; }; }; $deletedCount = 0; $failedCount = 0; $foundAbsolutePaths = @(); Write-Host 'Iterating files and directories recursively.'; try { $foundAbsolutePaths += @(; Get-ChildItem -Path $expandedPath -Force -Recurse -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; try { $foundAbsolutePaths += @(; Get-Item -Path $expandedPath -ErrorAction Stop | Select-Object -ExpandProperty FullName; ); } catch [System.Management.Automation.ItemNotFoundException] { <# Swallow, do not run `Test-Path` before, it's unreliable for globs requiring extra permissions #>; }; $foundAbsolutePaths = $foundAbsolutePaths | Select-Object -Unique | Sort-Object -Property { $_.Length } -Descending; if (!$foundAbsolutePaths) { Write-Host 'Skipping, no items available.'; exit 0; }; Write-Host """Initiating processing of $($foundAbsolutePaths.Count) items from `"""$expandedPath`"""."""; foreach ($path in $foundAbsolutePaths) { if (-not (Test-Path $path)) { <# Re-check existence as prior deletions might remove subsequent items (e.g., subdirectories). #>; Write-Host """Successfully deleted: $($path) (already deleted)."""; $deletedCount++; continue; }; try { Remove-Item -Path $path -Force -Recurse -ErrorAction Stop; $deletedCount++; Write-Host """Successfully deleted: $($path)"""; } catch { $failedCount++; Write-Warning """Unable to delete $($path): $_"""; }; }; Write-Host """Successfully deleted $($deletedCount) items."""; if ($failedCount -gt 0) { Write-Warning """Failed to delete $($failedCount) items."""; }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1740
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "choice <nul 2>nul"
        5⤵
        
        PID:2052
      - C:\Windows\system32\choice.exe
        
        choice
        6⤵
        
        PID:1296

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
- System Location Discovery: System Language Discovery
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion