d3a307d6c9237b888e40f7ed3a3b590eefc1f9f9739740b03de99c1da56753c2

Analysis

max time kernel
133s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-11-2024 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

input lag and system config/KEYBOARD AND MOUSE OPTIMIZATION.bat
Size

1KB
MD5

4d485ec1b9fca60d44d878e78b376721
SHA1

d1218adac27187aa770698572101b497b90ff1e3
SHA256

8918c3800a2d7d1b9264b9c12388d57c236abcfea31a23d6fcb3adca68a31a1d
SHA512

81b889e199df21bdac34f6ace58e58e6fa9eaf379b31bc4f25ab5950d6a39d3fe2a3feb2b8b7a36625724a25a7292d9bff3ecfffb16ac05159eb0308fc6618b7

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 64 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4120	bcdedit.exe
2076	bcdedit.exe
2248	bcdedit.exe
3312	bcdedit.exe
780	bcdedit.exe
4944	bcdedit.exe
1052	bcdedit.exe
772	bcdedit.exe
1236	bcdedit.exe
1076	bcdedit.exe
2196	bcdedit.exe
2696	bcdedit.exe
3024	bcdedit.exe
4004	bcdedit.exe
3364	bcdedit.exe
2916	bcdedit.exe
4144	bcdedit.exe
4580	bcdedit.exe
3908	bcdedit.exe
3868	bcdedit.exe
4540	bcdedit.exe
4752	bcdedit.exe
3296	bcdedit.exe
3052	bcdedit.exe
3624	bcdedit.exe
4536	bcdedit.exe
4524	bcdedit.exe
4844	bcdedit.exe
788	bcdedit.exe
1268	bcdedit.exe
3000	bcdedit.exe
3468	bcdedit.exe
4564	bcdedit.exe
1120	bcdedit.exe
4932	bcdedit.exe
4708	bcdedit.exe
4828	bcdedit.exe
3628	bcdedit.exe
3988	bcdedit.exe
2480	bcdedit.exe
1360	bcdedit.exe
860	bcdedit.exe
2728	bcdedit.exe
3820	bcdedit.exe
2320	bcdedit.exe
388	bcdedit.exe
2400	bcdedit.exe
4896	bcdedit.exe
4796	bcdedit.exe
1976	bcdedit.exe
5104	bcdedit.exe
412	bcdedit.exe
1380	bcdedit.exe
380	bcdedit.exe
2596	bcdedit.exe
2776	bcdedit.exe
2828	bcdedit.exe
3156	bcdedit.exe
420	bcdedit.exe
2004	bcdedit.exe
1404	bcdedit.exe
2664	bcdedit.exe
4880	bcdedit.exe
1612	bcdedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 240	452	cmd.exe	80
PID 452 wrote to memory of 240	452	cmd.exe	80
PID 452 wrote to memory of 4120	452	cmd.exe	81
PID 452 wrote to memory of 4120	452	cmd.exe	81
PID 452 wrote to memory of 2076	452	cmd.exe	82
PID 452 wrote to memory of 2076	452	cmd.exe	82
PID 452 wrote to memory of 2248	452	cmd.exe	83
PID 452 wrote to memory of 2248	452	cmd.exe	83
PID 452 wrote to memory of 3312	452	cmd.exe	84
PID 452 wrote to memory of 3312	452	cmd.exe	84
PID 452 wrote to memory of 780	452	cmd.exe	85
PID 452 wrote to memory of 780	452	cmd.exe	85
PID 452 wrote to memory of 4944	452	cmd.exe	86
PID 452 wrote to memory of 4944	452	cmd.exe	86
PID 452 wrote to memory of 1052	452	cmd.exe	87
PID 452 wrote to memory of 1052	452	cmd.exe	87
PID 452 wrote to memory of 772	452	cmd.exe	88
PID 452 wrote to memory of 772	452	cmd.exe	88
PID 452 wrote to memory of 1236	452	cmd.exe	89
PID 452 wrote to memory of 1236	452	cmd.exe	89
PID 452 wrote to memory of 1076	452	cmd.exe	90
PID 452 wrote to memory of 1076	452	cmd.exe	90
PID 452 wrote to memory of 2196	452	cmd.exe	91
PID 452 wrote to memory of 2196	452	cmd.exe	91
PID 452 wrote to memory of 2696	452	cmd.exe	92
PID 452 wrote to memory of 2696	452	cmd.exe	92
PID 452 wrote to memory of 3024	452	cmd.exe	93
PID 452 wrote to memory of 3024	452	cmd.exe	93
PID 452 wrote to memory of 4004	452	cmd.exe	94
PID 452 wrote to memory of 4004	452	cmd.exe	94
PID 452 wrote to memory of 3364	452	cmd.exe	95
PID 452 wrote to memory of 3364	452	cmd.exe	95
PID 452 wrote to memory of 2916	452	cmd.exe	96
PID 452 wrote to memory of 2916	452	cmd.exe	96
PID 452 wrote to memory of 4144	452	cmd.exe	97
PID 452 wrote to memory of 4144	452	cmd.exe	97
PID 452 wrote to memory of 4580	452	cmd.exe	98
PID 452 wrote to memory of 4580	452	cmd.exe	98
PID 452 wrote to memory of 3908	452	cmd.exe	99
PID 452 wrote to memory of 3908	452	cmd.exe	99
PID 452 wrote to memory of 3868	452	cmd.exe	100
PID 452 wrote to memory of 3868	452	cmd.exe	100
PID 452 wrote to memory of 4540	452	cmd.exe	101
PID 452 wrote to memory of 4540	452	cmd.exe	101
PID 452 wrote to memory of 4752	452	cmd.exe	102
PID 452 wrote to memory of 4752	452	cmd.exe	102
PID 452 wrote to memory of 3296	452	cmd.exe	103
PID 452 wrote to memory of 3296	452	cmd.exe	103
PID 452 wrote to memory of 3052	452	cmd.exe	104
PID 452 wrote to memory of 3052	452	cmd.exe	104
PID 452 wrote to memory of 3624	452	cmd.exe	105
PID 452 wrote to memory of 3624	452	cmd.exe	105
PID 452 wrote to memory of 4536	452	cmd.exe	106
PID 452 wrote to memory of 4536	452	cmd.exe	106
PID 452 wrote to memory of 4524	452	cmd.exe	107
PID 452 wrote to memory of 4524	452	cmd.exe	107
PID 452 wrote to memory of 4844	452	cmd.exe	108
PID 452 wrote to memory of 4844	452	cmd.exe	108
PID 452 wrote to memory of 788	452	cmd.exe	109
PID 452 wrote to memory of 788	452	cmd.exe	109
PID 452 wrote to memory of 1268	452	cmd.exe	110
PID 452 wrote to memory of 1268	452	cmd.exe	110
PID 452 wrote to memory of 3000	452	cmd.exe	111
PID 452 wrote to memory of 3000	452	cmd.exe	111

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\input lag and system config\KEYBOARD AND MOUSE OPTIMIZATION.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\system32\fsutil.exe
  fsutil dirty query C:
  2⤵
  PID:240
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4120
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2076
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2248
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3312
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:780
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4944
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1052
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:772
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1236
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2196
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2696
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3024
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3364
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4144
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4580
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3908
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3868
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4752
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3296
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3052
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4536
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4524
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4844
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:788
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1268
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3000
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3468
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4564
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1120
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4932
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4708
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3988
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1360
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:860
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2728
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3820
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2320
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:388
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2400
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4896
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4796
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1976
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5104
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:412
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2596
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2776
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3156
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:420
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1404
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2664
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4880
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1612
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:5000
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:396
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:3516
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:2908
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:560
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:2808
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:5008
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:1016
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:676
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:4992
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:4384
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:2540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:1980
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:3068
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:1908
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:2412
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:1516
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:1628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:4076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:1868
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:1156
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:4284
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:548
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:5076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:5088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:3552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:2376
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4172
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:1412
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:2352
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4132
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:3680
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:4012
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:248
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:3900
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:5056
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:4628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:4620
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:2500
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:2980
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:2212
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:1740
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:780
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:4944
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:1052
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:772
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:1236
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:1076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:2196
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:2696
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:3092
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:3300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:3644
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:4532
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:832
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:2272
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:4288
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:4312
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:3288
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:4820
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:2816
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:2704
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:4436
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:5044
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:3488
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:3380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:3596
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:1952
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:952
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:3972
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4416
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:4776
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:4932
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:4708
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:3628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:4104
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:3368
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:1176
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4864
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:3284
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:3492
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:3436
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:5060
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:1576
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:3372
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:1704
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3724
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:4136
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:1220
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4940
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:1724
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:3512
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:3304
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:760
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:1916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:4392
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:1112
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:1044
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4980
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:3716
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:1540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:4516
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4152
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:2908
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:560
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:2808
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:5008
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:1016
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:676
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:4992
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:4384
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:2540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:1104
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4064
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:4044
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:2412
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:1516
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:1628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:1868
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:1156
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:4284
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:548
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:5076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:5088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:2376
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:4172
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:1412
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:2368
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:3728
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:4908
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:3668
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3836
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:2216
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:2008
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4616
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:4296
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:4604
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:732
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:4300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:1116
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:2248
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:3312
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:4504
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:852
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:1828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:4372
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:3992
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:2924
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:1076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:2196
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:3040
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:3104
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:4976
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:3388
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:1256
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:5020
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:4732
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:3064
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:3016
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4752
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:2636
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:5012
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:4892
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:3044
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4848
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:4188
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:2484
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:4788
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:1196
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:3116
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:2344
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:3956
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:2244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4936
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:2380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:3560
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:3988
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:2480
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:1360
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:860
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:2728
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3820
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:2300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:4592
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:2420
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:3456
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:1600
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:4452
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:1696
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:5112
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:1244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:1836
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:1720
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:4656
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:2332
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:1876
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:3108
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:1580
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:4572
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:3716
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:1936
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:2180
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:1008
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:5092
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:1972
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:1240
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:4152
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:2908
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:560
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:2808
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:5008
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:1016
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:676
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:4992
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:4384
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:2540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:1104
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:4064
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:4044
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:2412
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:1516
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:1628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:4076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:1868
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:1156
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:4284
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:548
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:5076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:5088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:3552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:2376
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4172
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:1412
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:3076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:4132
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:432
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:2932
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:4748
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:3900
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:2408
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:2928
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:2500
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:2980
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:1004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:1456
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:1884
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:2712
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:1688
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:3832
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:984
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:1920
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:3612
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:3024
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:3364
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:2916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:4144
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:4580
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:3908
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:3868
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:4540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:3028
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:3296
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:3052
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:3624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:4536
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:4524
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4844
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:788
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:1268
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:3000
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:3468
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:4568
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:4308
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:3128
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:2072
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:408
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:4612
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:3328
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:3628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:4104
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:3368
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:1176
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4864
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:2604
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:3168
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:4740
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:1812
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:3736
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:2256
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:4336
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:2444
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:1380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:2844
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:4368
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:4344
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:900
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:1180
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:2004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:1404
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:1112
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:4880
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:3088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:4980
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:1540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:4556
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:1000
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4516
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:3480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:2428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:4068
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:2148
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:3576
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:4420
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:4780
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:888
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:1860
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:1032
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:464
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:3384
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:1272
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:1132
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:1532
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:1552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3284
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:1516
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:1628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:1868
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:1156
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:4284
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:548
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:5076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:5088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:3552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4724
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:4948
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:2352
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:4868
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3692
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:3680
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:4012
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:248
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:4748
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:3900
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:4624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:2408
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:2928
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:2500
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:2212
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4528
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:780
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:852
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:1052
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:1684
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:772
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:1892
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:3608
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:4180
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:3532
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:3360
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:3124
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:2948
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:2504
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:2432
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:2780
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:5040
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:4680
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:2368
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:3296
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:3052
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:3624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:4536
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:4524
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:4844
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:788
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:1268
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:3000
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:3468
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:4568
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4308
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:3128
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:2072
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:408
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4612
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:3328
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:3628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:4104
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3368
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:1176
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:4864
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:2604
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:3168
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:4740
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:1812
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:3372
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:1704
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3724
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:4136
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:1220
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4940
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:2844
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:4368
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:3304
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:760
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:1180
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:2004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:2664
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:4552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4304
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:5000
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:1944
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:404
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:396
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:1000
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:4516
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:3480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:2428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:4068
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:2148
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:3576
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:4420
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:4780
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:888
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:1860
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:2312
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:1196
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:3384
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:1272
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:1132
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:1532
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:1552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:1832
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:1428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4124
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:572
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:4408
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:3316
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3548
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:2524
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:3996
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:748
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:3416
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:2376
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:3968
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:1412
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:4132
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:432
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:2932
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:2216
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:4596
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:3900
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:4624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:2408
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:2928
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:2500
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:2212
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:4528
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:780
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:4944
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:1900
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:108
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:1236
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:2924
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:3612
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:3024
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:4004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:3364
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:2916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:4144
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:4580
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:5020
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4732
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:4540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:3028
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:4752
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:2636
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:2704
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:3624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:4536
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:4524
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4844
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:788
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:1268
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:3000
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3468
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4568
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:4308
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:3012
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:2812
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:4236
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:2448
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:3884
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:1964
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3960
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:3120
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:2728
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:3492
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:3436
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:4816
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:5060
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:1576
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:3460
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:1812
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:3372
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:1704
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:3724
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:4136
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:2596
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:1724
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:2828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:1836
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:4344
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:900
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:4512
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:4520
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:1876
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:1044
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:1580
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:1612
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:2680
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:5068
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:2304
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:4916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:5092
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:1972
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:1480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:3840
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:2428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:2908
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:3904
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:2096
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:2348
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:1800
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:4716
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:1032
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4384
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:2312
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:1196
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:3384
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:4064
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:1804
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:3240
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:2228
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:1184
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:1188
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:4428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:572
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:4408
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:1156
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:4284
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:548
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:968
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:5088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:3552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4724
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:4948
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:3728
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:3164
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:3692
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:3680
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:4012
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:2216
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:5056
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:4296
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:4604
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:732
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:4300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:1116
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:3148
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:1740
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:1224
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:2712
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:1828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:4372
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:3992
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:1920
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:2924
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:3612
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:3024
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:4004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:3364
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:2916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:4144
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4580
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:5020
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:4732
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:4540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:3028
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:4752
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:2636
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:2704
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:1664
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:4524
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4844
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:920
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:4788
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:952
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:3972
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4416
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:1992
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:2244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:4708
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:2380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:3560
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:3988
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:1092
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4104
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:3368
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:1176
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:2300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:2604
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:2672
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:2420
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:3424
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:1976
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:1600
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4452
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:4244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:1380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:3512
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:1724
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:2828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:4368
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:1720
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4656
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:4392
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:4928
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:1624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3108
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4572
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:3716
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:1936
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:2180
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:1912
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:3516
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:1000
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:1492
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:3816
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:2972
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:1152
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:3904
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:2096
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:2348
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:1800
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4716
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:1032
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:4160
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:3160
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4400
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:4884
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:1132
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:1532
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:232
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4876
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:1628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:4076
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:484
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:5064
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:4664
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:3540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:4060
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:2952
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:1528
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:4172
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:4720
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:1520
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:2088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:4868
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4228
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:3668
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:3836
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:2008
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:460
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:1372
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:240
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:864
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:4120
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:4488
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:2248
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:1004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:1456
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:1740
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:1224
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:2712
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:1828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:4372
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:3992
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:1920
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:2696
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:3040
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:3300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:3644
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:3388
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:832
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:2272
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:3868
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:5020
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4732
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:4540
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:3028
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:4752
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:2636
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:2704
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:3624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:1664
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:4524
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:4844
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:920
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:4788
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:952
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3972
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:4416
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:1992
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:2244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:4708
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:2380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:3560
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:3988
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:1092
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:3628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:3120
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:3368
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:1176
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:2300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:2604
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:2672
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:2420
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:3424
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:1976
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:1600
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:4452
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:4244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:1380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3512
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:4940
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:3156
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:420
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:1916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:2332
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:2744
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:1112
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4880
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:3088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:4980
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:1612
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:2680
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:5068
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:2304
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:4916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:1676
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:1972
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:4152
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:644
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:4068
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:2904
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:2808
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:5008
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:3848
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:888
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:3860
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:4384
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:2312
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:1104
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:1272
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:3144
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:4508
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:3240
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:2228
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:1184
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:3880
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:572
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:3568
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:3548
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:2956
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:3996
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:968
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:5088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:3552
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:4700
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:2352
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:1816
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:4908
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:1316
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:2768
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:1856
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:2932
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:4596
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:5056
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:4296
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:4604
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:732
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:4300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:1116
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:2500
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:1456
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:1740
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:1224
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:2712
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:1828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:4372
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:3992
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:1920
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:2696
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:3040
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:3300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:3644
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3388
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:832
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:2272
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:3868
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:3016
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:4820
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:3748
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:4436
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:1344
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:424
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:2760
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:2996
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:2708
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:4340
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:3520
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:1268
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3000
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:3468
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:4568
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:4416
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:1992
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:2244
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:4708
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:2448
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:3560
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3988
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:1092
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:3628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:3120
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:3368
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:1176
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:2300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:2604
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:2672
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:2420
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:3424
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:1976
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:1600
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:4452
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:4244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:1380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:380
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:1724
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:2828
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:4368
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:420
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:1916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:1404
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:4392
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:1876
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:5004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:4880
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:3088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:4980
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:1612
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:2680
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:5068
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:2304
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:4916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:1676
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:5080
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:4156
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:2624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:4068
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:2904
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:2808
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:5008
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:3848
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:888
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:3860
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:4384
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:2312
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:1104
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:1272
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:3144
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:4508
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:1516
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:2228
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:1184
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:3880
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:4428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:572
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:3568
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:3548
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:2956
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:3996
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:968
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:5088
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:3552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:4700
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  PID:2352
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  PID:1816
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  PID:4908
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  PID:1316
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  PID:2768
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  PID:1856
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  PID:2932
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  PID:1372
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  PID:1480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  PID:4296
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  PID:5112
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  PID:2408
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  PID:2148
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  PID:3312
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  PID:4504
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  PID:856
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  PID:852
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  PID:1052
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  PID:984
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  PID:772
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  PID:1892
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  PID:3608
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  PID:4180
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  PID:3532
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads