916f1b6644b58d164c74b9d5ac14798f1c27958149effdbd85b95709b0d2ad6d

Analysis

max time kernel
149s
max time network
16s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03-02-2025 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TWEAK NVDIA.exe
Size

11.4MB
MD5

3507038edf6b4f164c5149f39cff11b0
SHA1

720cae8b2c67d7526837f1fd3a44cbcf80ae6dd5
SHA256

916f1b6644b58d164c74b9d5ac14798f1c27958149effdbd85b95709b0d2ad6d
SHA512

c420055bfe38ae687e897ea8e5fba7cf2821ccae21819eb6ce92901b940539c107a2c8ee5c987ce07ebc060b3a008752ea5946a01cc56e45a8937da4c6be73ef
SSDEEP

196608:EG9LuhOZDB08T3uPqG4d1/1wKEIs52FykwcAFRrj5H8o99skweFOGXdaAPj:Lk2DPTX/Ts5JPfrN9s5eFOGoyj

Score

10^/10

defense_evasion discovery execution persistence pyinstaller trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2616	powershell.exe
2084	powershell.exe
980	powershell.exe
2308	powershell.exe
804	powershell.exe
1748	powershell.exe
2208	powershell.exe
1392	powershell.exe
1624	powershell.exe
2084	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2808	Update.exe
1640	Update.exe
1188	Process not Found

Loads dropped DLL 4 IoCs

pid	Process
1180	TWEAK NVDIA.exe
2808	Update.exe
1640	Update.exe
1188	Process not Found

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1352	powercfg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001c780-63.dat	upx
behavioral1/memory/1640-65-0x000007FEF5D60000-0x000007FEF6348000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2616	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2256	sc.exe
2528	sc.exe
952	sc.exe
2872	sc.exe
2980	sc.exe
980	sc.exe
548	sc.exe
1384	sc.exe
2008	sc.exe
2180	sc.exe
2444	sc.exe
2160	sc.exe
2352	sc.exe
2900	sc.exe
556	sc.exe
2844	sc.exe
1796	sc.exe
776	sc.exe
832	sc.exe
2800	sc.exe
1272	sc.exe
1576	sc.exe
2700	sc.exe
2028	sc.exe
1052	sc.exe
1804	sc.exe
1224	sc.exe
1524	sc.exe
1256	sc.exe
2420	sc.exe
1152	sc.exe
2320	sc.exe
2680	sc.exe
2716	sc.exe
2072	sc.exe
2284	sc.exe
2340	sc.exe
824	sc.exe
1996	sc.exe
2332	sc.exe
2232	sc.exe
2800	sc.exe
2564	sc.exe
2404	sc.exe
1008	sc.exe
1100	sc.exe
2776	sc.exe
1644	sc.exe
1848	sc.exe
1752	sc.exe
1224	sc.exe
1336	sc.exe
1352	sc.exe
2448	sc.exe
2016	sc.exe
2760	sc.exe
2672	sc.exe
1540	sc.exe
2260	sc.exe
1624	sc.exe
2876	sc.exe
1580	sc.exe
2488	sc.exe
2348	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000d00000001946b-10.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powercfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
912	timeout.exe
608	timeout.exe
2636	timeout.exe
1796	timeout.exe
2384	timeout.exe
2884	timeout.exe
2776	timeout.exe
1944	timeout.exe
448	timeout.exe
2392	timeout.exe
2528	timeout.exe
1648	timeout.exe
2180	timeout.exe
2384	timeout.exe
1628	timeout.exe
2676	timeout.exe
2188	timeout.exe
2992	timeout.exe
536	timeout.exe
2072	timeout.exe
2800	timeout.exe
2816	timeout.exe
2568	timeout.exe
1324	timeout.exe
1548	timeout.exe
2068	timeout.exe
928	timeout.exe
1752	timeout.exe
2256	timeout.exe
2424	timeout.exe
2624	timeout.exe
2432	timeout.exe
736	timeout.exe
1484	timeout.exe
1512	timeout.exe
1548	timeout.exe
3004	timeout.exe
2716	timeout.exe
1688	timeout.exe
2640	timeout.exe
2724	timeout.exe
1984	timeout.exe
1384	timeout.exe
484	timeout.exe
596	timeout.exe
1088	timeout.exe
1960	timeout.exe
1492	timeout.exe
2276	timeout.exe
2764	timeout.exe
2712	timeout.exe
1260	timeout.exe
2380	timeout.exe
2980	timeout.exe
684	timeout.exe
2704	timeout.exe
2424	timeout.exe
2416	timeout.exe
2000	timeout.exe
1436	timeout.exe
2360	timeout.exe
2928	timeout.exe
2128	timeout.exe
1788	timeout.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators = "80000002"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1476	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1624	powershell.exe
2084	powershell.exe
804	powershell.exe
1748	powershell.exe
2208	powershell.exe
2616	powershell.exe
2084	powershell.exe
980	powershell.exe
1392	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	804	powershell.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeBackupPrivilege	304	vssvc.exe
Token: SeRestorePrivilege	304	vssvc.exe
Token: SeAuditPrivilege	304	vssvc.exe
Token: SeRestorePrivilege	2804	DrvInst.exe
Token: SeRestorePrivilege	2804	DrvInst.exe
Token: SeRestorePrivilege	2804	DrvInst.exe
Token: SeRestorePrivilege	2804	DrvInst.exe
Token: SeRestorePrivilege	2804	DrvInst.exe
Token: SeRestorePrivilege	2804	DrvInst.exe
Token: SeRestorePrivilege	2804	DrvInst.exe
Token: SeLoadDriverPrivilege	2804	DrvInst.exe
Token: SeLoadDriverPrivilege	2804	DrvInst.exe
Token: SeLoadDriverPrivilege	2804	DrvInst.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	980	powershell.exe
Token: SeShutdownPrivilege	1352	powercfg.exe
Token: SeShutdownPrivilege	1352	powercfg.exe
Token: SeShutdownPrivilege	1352	powercfg.exe
Token: SeShutdownPrivilege	1352	powercfg.exe
Token: SeShutdownPrivilege	1352	powercfg.exe
Token: SeCreatePagefilePrivilege	1352	powercfg.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	2236	taskmgr.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe
Token: 33	2352	mmc.exe
Token: SeIncBasePriorityPrivilege	2352	mmc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe
2236	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2352	mmc.exe
2352	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2912	1180	TWEAK NVDIA.exe	30
PID 1180 wrote to memory of 2912	1180	TWEAK NVDIA.exe	30
PID 1180 wrote to memory of 2912	1180	TWEAK NVDIA.exe	30
PID 1180 wrote to memory of 2912	1180	TWEAK NVDIA.exe	30
PID 1180 wrote to memory of 2808	1180	TWEAK NVDIA.exe	32
PID 1180 wrote to memory of 2808	1180	TWEAK NVDIA.exe	32
PID 1180 wrote to memory of 2808	1180	TWEAK NVDIA.exe	32
PID 1180 wrote to memory of 2808	1180	TWEAK NVDIA.exe	32
PID 2808 wrote to memory of 1640	2808	Update.exe	33
PID 2808 wrote to memory of 1640	2808	Update.exe	33
PID 2808 wrote to memory of 1640	2808	Update.exe	33
PID 2912 wrote to memory of 1440	2912	cmd.exe	34
PID 2912 wrote to memory of 1440	2912	cmd.exe	34
PID 2912 wrote to memory of 1440	2912	cmd.exe	34
PID 2912 wrote to memory of 1440	2912	cmd.exe	34
PID 2912 wrote to memory of 1812	2912	cmd.exe	35
PID 2912 wrote to memory of 1812	2912	cmd.exe	35
PID 2912 wrote to memory of 1812	2912	cmd.exe	35
PID 2912 wrote to memory of 1812	2912	cmd.exe	35
PID 1812 wrote to memory of 2480	1812	cmd.exe	36
PID 1812 wrote to memory of 2480	1812	cmd.exe	36
PID 1812 wrote to memory of 2480	1812	cmd.exe	36
PID 1812 wrote to memory of 2480	1812	cmd.exe	36
PID 1812 wrote to memory of 1524	1812	cmd.exe	37
PID 1812 wrote to memory of 1524	1812	cmd.exe	37
PID 1812 wrote to memory of 1524	1812	cmd.exe	37
PID 1812 wrote to memory of 1524	1812	cmd.exe	37
PID 2912 wrote to memory of 1624	2912	cmd.exe	38
PID 2912 wrote to memory of 1624	2912	cmd.exe	38
PID 2912 wrote to memory of 1624	2912	cmd.exe	38
PID 2912 wrote to memory of 1624	2912	cmd.exe	38
PID 2912 wrote to memory of 2084	2912	cmd.exe	39
PID 2912 wrote to memory of 2084	2912	cmd.exe	39
PID 2912 wrote to memory of 2084	2912	cmd.exe	39
PID 2912 wrote to memory of 2084	2912	cmd.exe	39
PID 2912 wrote to memory of 2000	2912	cmd.exe	40
PID 2912 wrote to memory of 2000	2912	cmd.exe	40
PID 2912 wrote to memory of 2000	2912	cmd.exe	40
PID 2912 wrote to memory of 2000	2912	cmd.exe	40
PID 2912 wrote to memory of 2156	2912	cmd.exe	41
PID 2912 wrote to memory of 2156	2912	cmd.exe	41
PID 2912 wrote to memory of 2156	2912	cmd.exe	41
PID 2912 wrote to memory of 2156	2912	cmd.exe	41
PID 2912 wrote to memory of 2360	2912	cmd.exe	42
PID 2912 wrote to memory of 2360	2912	cmd.exe	42
PID 2912 wrote to memory of 2360	2912	cmd.exe	42
PID 2912 wrote to memory of 2360	2912	cmd.exe	42
PID 2912 wrote to memory of 2136	2912	cmd.exe	43
PID 2912 wrote to memory of 2136	2912	cmd.exe	43
PID 2912 wrote to memory of 2136	2912	cmd.exe	43
PID 2912 wrote to memory of 2136	2912	cmd.exe	43
PID 2912 wrote to memory of 2196	2912	cmd.exe	44
PID 2912 wrote to memory of 2196	2912	cmd.exe	44
PID 2912 wrote to memory of 2196	2912	cmd.exe	44
PID 2912 wrote to memory of 2196	2912	cmd.exe	44
PID 2196 wrote to memory of 1492	2196	net.exe	45
PID 2196 wrote to memory of 1492	2196	net.exe	45
PID 2196 wrote to memory of 1492	2196	net.exe	45
PID 2196 wrote to memory of 1492	2196	net.exe	45
PID 2912 wrote to memory of 1944	2912	cmd.exe	46
PID 2912 wrote to memory of 1944	2912	cmd.exe	46
PID 2912 wrote to memory of 1944	2912	cmd.exe	46
PID 2912 wrote to memory of 1944	2912	cmd.exe	46
PID 2912 wrote to memory of 2512	2912	cmd.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\TWEAK NVDIA.exe
"C:\Users\Admin\AppData\Local\Temp\TWEAK NVDIA.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\Oneclick-V7.0.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\fltMC.exe
    fltmc
    3⤵
    PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild" 2>nul | findstr "REG_SZ"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuild"
      4⤵
      PID:2480
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "REG_SZ"
      4⤵
      PID:1524
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Write-Host 'Windows 11 not detected, we recommend running *Win 11 22H2 or 23H2* for the best results' -ForegroundColor White -BackgroundColor Red"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1624
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Write-Host 'Although this doesn''t mean you have to use Win 11.' -ForegroundColor White -BackgroundColor Red"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- - C:\Windows\SysWOW64\sc.exe
    sc qc "TrustedInstaller"
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\find.exe
    find "START_TYPE"
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\find.exe
    find "DISABLED"
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\sc.exe
    sc config TrustedInstaller start=auto
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\net.exe
    net start TrustedInstaller
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TrustedInstaller
      4⤵
      PID:1492
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1944
- - C:\Windows\SysWOW64\sc.exe
    sc query "WinDefend"
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\find.exe
    find "STATE"
    3⤵
    PID:1088
- - C:\Windows\SysWOW64\find.exe
    find "RUNNING"
    3⤵
    PID:952
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:736
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:832
- - C:\Windows\SysWOW64\chcp.com
    chcp 437
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Write-Host 'Recommended!' -ForegroundColor White -BackgroundColor Red"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:804
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:608
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Checkpoint-Computer -Description 'OneClick V7.0 Restore Point'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:2764
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2704
- - C:\Windows\SysWOW64\chcp.com
    chcp 437
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /t REG_DWORD /d 0 /f
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "PublishUserActivities" /t REG_DWORD /d 0 /f
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "UploadUserActivities" /t REG_DWORD /d 0 /f
    3⤵
    PID:1180
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1648
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location" /v "Value" /t REG_SZ /d "Deny" /f
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" /v "SensorPermissionState" /t REG_DWORD /d 0 /f
    3⤵
    PID:1224
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\lfsvc\Service\Configuration" /v "Status" /t REG_DWORD /d 0 /f
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\Maps" /v "AutoUpdateEnabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1960
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1752
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Remove-Item -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy' -Recurse -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2712
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2864
- - C:\Windows\SysWOW64\reg.exe
    reg.exe add "HKU\.DEFAULT\Control Panel\Keyboard" /v InitialKeyboardIndicators /t REG_DWORD /d 80000002 /f
    3⤵
    - Modifies data under HKEY_USERS
    PID:2876
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1484
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "New-Item -Path 'HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}' -Name 'InprocServer32' -Force -Value ''"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2424
- - C:\Windows\SysWOW64\reg.exe
    reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 0 /f
    3⤵
    - Modifies visibility of file extensions in Explorer
    PID:2972
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2072
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 1 /f
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2416
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarDa /t REG_DWORD /d 0 /f
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:448
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v "DragFullWindows" /t REG_SZ /d "0" /f
    3⤵
    PID:1132
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "200" /f
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop\WindowMetrics" /v "MinAnimate" /t REG_SZ /d "0" /f
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Keyboard" /v "KeyboardDelay" /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2980
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewAlphaSelect" /t REG_DWORD /d 0 /f
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewShadow" /t REG_DWORD /d 0 /f
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d 0 /f
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /t REG_DWORD /d 3 /f
    3⤵
    PID:324
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\DWM" /v "EnableAeroPeek" /t REG_DWORD /d 0 /f
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
    3⤵
    PID:568
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
    3⤵
    PID:536
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
    3⤵
    PID:316
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name 'UserPreferencesMask' -Type Binary -Value ([byte[]](144,18,3,128,16,0,0,0))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:980
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2180
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\System\GameConfigStore" /v GameDVR_FSEBehavior /t REG_DWORD /d 2 /f
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\System\GameConfigStore" /v GameDVR_Enabled /t REG_DWORD /d 0 /f
    3⤵
    PID:1324
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\System\GameConfigStore" /v GameDVR_DXGIHonorFSEWindowsCompatible /t REG_DWORD /d 1 /f
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\System\GameConfigStore" /v GameDVR_HonorUserFSEBehaviorMode /t REG_DWORD /d 1 /f
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\System\GameConfigStore" /v GameDVR_EFSEFeatureFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2060
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f
    3⤵
    PID:2224
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v BingSearchEnabled /t REG_DWORD /d 0 /f
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2128
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\GameBar" /v "AllowAutoGameMode" /t REG_DWORD /d 0 /f
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\Microsoft\GameBar" /v "AutoGameModeEnabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:928
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v "HwSchMode" /t REG_DWORD /d 2 /f
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2000
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:1476
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2384
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1944
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Power" /v HibernateEnabled /t REG_DWORD /d 0 /f
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FlyoutMenuSettings" /v ShowHibernateOption /t REG_DWORD /d 0 /f
    3⤵
    PID:1088
- - C:\Windows\SysWOW64\powercfg.exe
    powercfg.exe /hibernate off
    3⤵
    - Power Settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1352
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1512
- - C:\Windows\SysWOW64\sc.exe
    sc config HomeGroupListener start=demand
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\sc.exe
    sc config HomeGroupProvider start=demand
    3⤵
    PID:832
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1260
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" /v "Value" /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" /v "Value" /t REG_DWORD /d 0 /f
    3⤵
    PID:916
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:912
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 1 /f
    3⤵
    PID:904
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1628
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v "DisabledComponents" /t REG_DWORD /d 255 /f
    3⤵
    PID:1740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Disable-NetAdapterBinding -Name '*' -ComponentID ms_tcpip6"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /f /v EnableLUA /t REG_DWORD /d 0
    3⤵
    - UAC bypass
    PID:2552
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1548
- - C:\Windows\SysWOW64\chcp.com
    chcp 437
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:608
- - C:\Windows\SysWOW64\sc.exe
    sc config AJRouter start=disabled
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\sc.exe
    sc config ALG start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2308
- - C:\Windows\SysWOW64\sc.exe
    sc config AppIDSvc start=demand
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\sc.exe
    sc config AppMgmt start=demand
    3⤵
    PID:1372
- - C:\Windows\SysWOW64\sc.exe
    sc config AppReadiness start=demand
    3⤵
    - Launches sc.exe
    PID:1256
- - C:\Windows\SysWOW64\sc.exe
    sc config AppVClient start=disabled
    3⤵
    - Launches sc.exe
    PID:1580
- - C:\Windows\SysWOW64\sc.exe
    sc config AppXSvc start=demand
    3⤵
    - Launches sc.exe
    PID:1848
- - C:\Windows\SysWOW64\sc.exe
    sc config Appinfo start=demand
    3⤵
    - Launches sc.exe
    PID:2760
- - C:\Windows\SysWOW64\sc.exe
    sc config AssignedAccessManagerSvc start=disabled
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\sc.exe
    sc config AudioEndpointBuilder start=auto
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\sc.exe
    sc config AudioSrv start=auto
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\sc.exe
    sc config Audiosrv start=auto
    3⤵
    PID:1332
- - C:\Windows\SysWOW64\sc.exe
    sc config AxInstSV start=demand
    3⤵
    - Launches sc.exe
    PID:2160
- - C:\Windows\SysWOW64\sc.exe
    sc config BDESVC start=demand
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\sc.exe
    sc config BFE start=auto
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\sc.exe
    sc config BITS start=delayed-auto
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\sc.exe
    sc config BTAGService start=demand
    3⤵
    - Launches sc.exe
    PID:2700
- - C:\Windows\SysWOW64\sc.exe
    sc config BcastDVRUserService_dc2a4 start=demand
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\sc.exe
    sc config BluetoothUserService_dc2a4 start=demand
    3⤵
    - Launches sc.exe
    PID:2028
- - C:\Windows\SysWOW64\sc.exe
    sc config BrokerInfrastructure start=auto
    3⤵
    PID:1828
- - C:\Windows\SysWOW64\sc.exe
    sc config Browser start=demand
    3⤵
    PID:1680
- - C:\Windows\SysWOW64\sc.exe
    sc config BthAvctpSvc start=auto
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\sc.exe
    sc config BthHFSrv start=auto
    3⤵
    - Launches sc.exe
    PID:2672
- - C:\Windows\SysWOW64\sc.exe
    sc config CDPSvc start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2728
- - C:\Windows\SysWOW64\sc.exe
    sc config CDPUserSvc_dc2a4 start=auto
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\sc.exe
    sc config COMSysApp start=demand
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc config CaptureService_dc2a4 start=demand
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\sc.exe
    sc config CertPropSvc start=demand
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\sc.exe
    sc config ClipSVC start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1652
- - C:\Windows\SysWOW64\sc.exe
    sc config ConsentUxUserSvc_dc2a4 start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1788
- - C:\Windows\SysWOW64\sc.exe
    sc config CoreMessagingRegistrar start=auto
    3⤵
    - Launches sc.exe
    PID:1752
- - C:\Windows\SysWOW64\sc.exe
    sc config CredentialEnrollmentManagerUserSvc_dc2a4 start=demand
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\sc.exe
    sc config CryptSvc start=auto
    3⤵
    - Launches sc.exe
    PID:2404
- - C:\Windows\SysWOW64\sc.exe
    sc config CscService start=demand
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\sc.exe
    sc config DPS start=auto
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\sc.exe
    sc config DcomLaunch start=auto
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\sc.exe
    sc config DcpSvc start=demand
    3⤵
    - Launches sc.exe
    PID:2528
- - C:\Windows\SysWOW64\sc.exe
    sc config DevQueryBroker start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1708
- - C:\Windows\SysWOW64\sc.exe
    sc config DeviceAssociationBrokerSvc_dc2a4 start=demand
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\sc.exe
    sc config DeviceAssociationService start=demand
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\sc.exe
    sc config DeviceInstall start=demand
    3⤵
    - Launches sc.exe
    PID:1996
- - C:\Windows\SysWOW64\sc.exe
    sc config DevicePickerUserSvc_dc2a4 start=demand
    3⤵
    PID:548
- - C:\Windows\SysWOW64\sc.exe
    sc config DevicesFlowUserSvc_dc2a4 start=demand
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1384
- - C:\Windows\SysWOW64\sc.exe
    sc config Dhcp start=auto
    3⤵
    PID:1004
- - C:\Windows\SysWOW64\sc.exe
    sc config DiagTrack start=disabled
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\sc.exe
    sc config DialogBlockingService start=disabled
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\sc.exe
    sc config DispBrokerDesktopSvc start=auto
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\sc.exe
    sc config DisplayEnhancementService start=demand
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\sc.exe
    sc config DmEnrollmentSvc start=demand
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\sc.exe
    sc config Dnscache start=auto
    3⤵
    - Launches sc.exe
    PID:1644
- - C:\Windows\SysWOW64\sc.exe
    sc config DoSvc start=delayed-auto
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\sc.exe
    sc config DsSvc start=demand
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\sc.exe
    sc config DsmSvc start=demand
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\sc.exe
    sc config DusmSvc start=auto
    3⤵
    - Launches sc.exe
    PID:2488
- - C:\Windows\SysWOW64\sc.exe
    sc config EFS start=demand
    3⤵
    PID:556
- - C:\Windows\SysWOW64\sc.exe
    sc config EapHost start=demand
    3⤵
    - Launches sc.exe
    PID:2008
- - C:\Windows\SysWOW64\sc.exe
    sc config EntAppSvc start=demand
    3⤵
    - Launches sc.exe
    PID:2332
- - C:\Windows\SysWOW64\sc.exe
    sc config EventLog start=auto
    3⤵
    PID:2844
- - C:\Windows\SysWOW64\sc.exe
    sc config EventSystem start=auto
    3⤵
    - Launches sc.exe
    PID:1796
- - C:\Windows\SysWOW64\sc.exe
    sc config FDResPub start=demand
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\sc.exe
    sc config Fax start=demand
    3⤵
    PID:2624
- - C:\Windows\SysWOW64\sc.exe
    sc config FontCache start=auto
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\sc.exe
    sc config FrameServer start=demand
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\sc.exe
    sc config FrameServerMonitor start=demand
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\sc.exe
    sc config GraphicsPerfSvc start=demand
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\sc.exe
    sc config HomeGroupListener start=demand
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\sc.exe
    sc config HomeGroupProvider start=demand
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\sc.exe
    sc config HvHost start=demand
    3⤵
    PID:320
- - C:\Windows\SysWOW64\sc.exe
    sc config IEEtwCollectorService start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:324
- - C:\Windows\SysWOW64\sc.exe
    sc config IKEEXT start=demand
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\sc.exe
    sc config InstallService start=demand
    3⤵
    PID:568
- - C:\Windows\SysWOW64\sc.exe
    sc config InventorySvc start=demand
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\sc.exe
    sc config IpxlatCfgSvc start=demand
    3⤵
    - Launches sc.exe
    PID:776
- - C:\Windows\SysWOW64\sc.exe
    sc config KeyIso start=auto
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\sc.exe
    sc config KtmRm start=demand
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\sc.exe
    sc config LSM start=auto
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\sc.exe
    sc config LanmanServer start=auto
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\sc.exe
    sc config LanmanWorkstation start=auto
    3⤵
    PID:684
- - C:\Windows\SysWOW64\sc.exe
    sc config LicenseManager start=demand
    3⤵
    - Launches sc.exe
    PID:2180
- - C:\Windows\SysWOW64\sc.exe
    sc config LxpSvc start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2116
- - C:\Windows\SysWOW64\sc.exe
    sc config MSDTC start=disabled
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\sc.exe
    sc config MSiSCSI start=demand
    3⤵
    - Launches sc.exe
    PID:2352
- - C:\Windows\SysWOW64\sc.exe
    sc config MapsBroker start=delayed-auto
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2224
- - C:\Windows\SysWOW64\sc.exe
    sc config McpManagementService start=demand
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\sc.exe
    sc config MessagingService_dc2a4 start=demand
    3⤵
    - Launches sc.exe
    PID:2348
- - C:\Windows\SysWOW64\sc.exe
    sc config MicrosoftEdgeElevationService start=demand
    3⤵
    PID:924
- - C:\Windows\SysWOW64\sc.exe
    sc config MixedRealityOpenXRSvc start=demand
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start=auto
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\sc.exe
    sc config MsKeyboardFilter start=demand
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\sc.exe
    sc config NPSMSvc_dc2a4 start=demand
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\sc.exe
    sc config NaturalAuthentication start=demand
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\sc.exe
    sc config NcaSvc start=demand
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\sc.exe
    sc config NcbService start=demand
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\sc.exe
    sc config NcdAutoSetup start=demand
    3⤵
    - Launches sc.exe
    PID:952
- - C:\Windows\SysWOW64\sc.exe
    sc config NetSetupSvc start=demand
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\sc.exe
    sc config NetTcpPortSharing start=disabled
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\sc.exe
    sc config Netlogon start=demand
    3⤵
    - Launches sc.exe
    PID:832
- - C:\Windows\SysWOW64\sc.exe
    sc config Netman start=demand
    3⤵
    - Launches sc.exe
    PID:1008
- - C:\Windows\SysWOW64\sc.exe
    sc config NgcCtnrSvc start=demand
    3⤵
    PID:916
- - C:\Windows\SysWOW64\sc.exe
    sc config NgcSvc start=demand
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\sc.exe
    sc config NlaSvc start=demand
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\sc.exe
    sc config OneSyncSvc_dc2a4 start=auto
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\sc.exe
    sc config P9RdrService_dc2a4 start=demand
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\sc.exe
    sc config PNRPAutoReg start=demand
    3⤵
    PID:1856
- - C:\Windows\SysWOW64\sc.exe
    sc config PNRPsvc start=demand
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\sc.exe
    sc config PcaSvc start=demand
    3⤵
    - Launches sc.exe
    PID:1540
- - C:\Windows\SysWOW64\sc.exe
    sc config PeerDistSvc start=demand
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\sc.exe
    sc config PenService_dc2a4 start=demand
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\sc.exe
    sc config PerfHost start=demand
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\sc.exe
    sc config PhoneSvc start=demand
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\sc.exe
    sc config PimIndexMaintenanceSvc_dc2a4 start=demand
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\sc.exe
    sc config PlugPlay start=demand
    3⤵
    - Launches sc.exe
    PID:1052
- - C:\Windows\SysWOW64\sc.exe
    sc config PolicyAgent start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2948
- - C:\Windows\SysWOW64\sc.exe
    sc config Power start=auto
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\sc.exe
    sc config PrintNotify start=demand
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2260
- - C:\Windows\SysWOW64\sc.exe
    sc config PrintWorkflowUserSvc_dc2a4 start=demand
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\sc.exe
    sc config ProfSvc start=auto
    3⤵
    PID:2884
- - C:\Windows\SysWOW64\sc.exe
    sc config PushToInstall start=demand
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\sc.exe
    sc config QWAVE start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1292
- - C:\Windows\SysWOW64\sc.exe
    sc config RasAuto start=demand
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\sc.exe
    sc config RasMan start=demand
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\sc.exe
    sc config RemoteAccess start=disabled
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\sc.exe
    sc config RemoteRegistry start=disabled
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\sc.exe
    sc config RetailDemo start=demand
    3⤵
    PID:2788
- - C:\Windows\SysWOW64\sc.exe
    sc config RmSvc start=demand
    3⤵
    - Launches sc.exe
    PID:2800
- - C:\Windows\SysWOW64\sc.exe
    sc config RpcEptMapper start=auto
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc config RpcLocator start=demand
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\sc.exe
    sc config RpcSs start=auto
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\sc.exe
    sc config SCPolicySvc start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2004
- - C:\Windows\SysWOW64\sc.exe
    sc config SCardSvr start=demand
    3⤵
    PID:396
- - C:\Windows\SysWOW64\sc.exe
    sc config SDRSVC start=demand
    3⤵
    PID:864
- - C:\Windows\SysWOW64\sc.exe
    sc config SEMgrSvc start=demand
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\sc.exe
    sc config SENS start=auto
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc config SNMPTRAP start=demand
    3⤵
    PID:1992
- - C:\Windows\SysWOW64\sc.exe
    sc config SNMPTrap start=demand
    3⤵
    - Launches sc.exe
    PID:2420
- - C:\Windows\SysWOW64\sc.exe
    sc config SSDPSRV start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1804
- - C:\Windows\SysWOW64\sc.exe
    sc config SamSs start=auto
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\sc.exe
    sc config ScDeviceEnum start=demand
    3⤵
    - Launches sc.exe
    PID:1224
- - C:\Windows\SysWOW64\sc.exe
    sc config Schedule start=auto
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\sc.exe
    sc config SecurityHealthService start=demand
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\sc.exe
    sc config Sense start=demand
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\sc.exe
    sc config SensorDataService start=demand
    3⤵
    PID:2584
- - C:\Windows\SysWOW64\sc.exe
    sc config SensorService start=demand
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\sc.exe
    sc config SensrSvc start=demand
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\sc.exe
    sc config SessionEnv start=demand
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\sc.exe
    sc config SgrmBroker start=auto
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start=demand
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedRealitySvc start=demand
    3⤵
    - Launches sc.exe
    PID:1272
- - C:\Windows\SysWOW64\sc.exe
    sc config ShellHWDetection start=auto
    3⤵
    - Launches sc.exe
    PID:1624
- - C:\Windows\SysWOW64\sc.exe
    sc config SmsRouter start=demand
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\sc.exe
    sc config Spooler start=auto
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\sc.exe
    sc config SstpSvc start=demand
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\sc.exe
    sc config StateRepository start=demand
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\sc.exe
    sc config StiSvc start=demand
    3⤵
    - Launches sc.exe
    PID:1336
- - C:\Windows\SysWOW64\sc.exe
    sc config StorSvc start=demand
    3⤵
    - Launches sc.exe
    PID:1152
- - C:\Windows\SysWOW64\sc.exe
    sc config SysMain start=auto
    3⤵
    - Launches sc.exe
    PID:2876
- - C:\Windows\SysWOW64\sc.exe
    sc config SystemEventsBroker start=auto
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\sc.exe
    sc config TabletInputService start=demand
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2872
- - C:\Windows\SysWOW64\sc.exe
    sc config TapiSrv start=demand
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\sc.exe
    sc config TermService start=auto
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\sc.exe
    sc config TextInputManagementService start=demand
    3⤵
    - Launches sc.exe
    PID:2320
- - C:\Windows\SysWOW64\sc.exe
    sc config Themes start=auto
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1640
- - C:\Windows\SysWOW64\sc.exe
    sc config TieringEngineService start=demand
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\sc.exe
    sc config TimeBroker start=demand
    3⤵
    PID:2532
- - C:\Windows\SysWOW64\sc.exe
    sc config TimeBrokerSvc start=demand
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\sc.exe
    sc config TokenBroker start=demand
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\sc.exe
    sc config TrkWks start=auto
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\sc.exe
    sc config TroubleshootingSvc start=demand
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\sc.exe
    sc config TrustedInstaller start=demand
    3⤵
    - Launches sc.exe
    PID:2284
- - C:\Windows\SysWOW64\sc.exe
    sc config UI0Detect start=demand
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\sc.exe
    sc config UdkUserSvc_dc2a4 start=demand
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\sc.exe
    sc config UevAgentService start=disabled
    3⤵
    PID:448
- - C:\Windows\SysWOW64\sc.exe
    sc config UmRdpService start=demand
    3⤵
    PID:1132
- - C:\Windows\SysWOW64\sc.exe
    sc config UnistoreSvc_dc2a4 start=demand
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\sc.exe
    sc config UserDataSvc_dc2a4 start=demand
    3⤵
    - Launches sc.exe
    PID:2980
- - C:\Windows\SysWOW64\sc.exe
    sc config UserManager start=auto
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2380
- - C:\Windows\SysWOW64\sc.exe
    sc config UsoSvc start=demand
    3⤵
    - Launches sc.exe
    PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc config VGAuthService start=auto
    3⤵
    - Launches sc.exe
    PID:2444
- - C:\Windows\SysWOW64\sc.exe
    sc config VMTools start=auto
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\sc.exe
    sc config VSS start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:536
- - C:\Windows\SysWOW64\sc.exe
    sc config VacSvc start=demand
    3⤵
    PID:596
- - C:\Windows\SysWOW64\sc.exe
    sc config VaultSvc start=auto
    3⤵
    PID:868
- - C:\Windows\SysWOW64\sc.exe
    sc config W32Time start=demand
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\sc.exe
    sc config WEPHOSTSVC start=demand
    3⤵
    PID:808
- - C:\Windows\SysWOW64\sc.exe
    sc config WFDSConMgrSvc start=demand
    3⤵
    - Launches sc.exe
    PID:1576
- - C:\Windows\SysWOW64\sc.exe
    sc config WMPNetworkSvc start=demand
    3⤵
    PID:332
- - C:\Windows\SysWOW64\sc.exe
    sc config WManSvc start=demand
    3⤵
    - Launches sc.exe
    PID:980
- - C:\Windows\SysWOW64\sc.exe
    sc config WPDBusEnum start=demand
    3⤵
    - Launches sc.exe
    PID:1100
- - C:\Windows\SysWOW64\sc.exe
    sc config WSService start=demand
    3⤵
    PID:1324
- - C:\Windows\SysWOW64\sc.exe
    sc config WSearch start=delayed-auto
    3⤵
    - Launches sc.exe
    PID:2232
- - C:\Windows\SysWOW64\sc.exe
    sc config WaaSMedicSvc start=demand
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\sc.exe
    sc config WalletService start=demand
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\sc.exe
    sc config WarpJITSvc start=demand
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\sc.exe
    sc config WbioSrvc start=demand
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\sc.exe
    sc config Wcmsvc start=auto
    3⤵
    PID:928
- - C:\Windows\SysWOW64\sc.exe
    sc config WcsPlugInService start=demand
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\sc.exe
    sc config WdNisSvc start=demand
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\sc.exe
    sc config WdiServiceHost start=demand
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\sc.exe
    sc config WdiSystemHost start=demand
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\sc.exe
    sc config WebClient start=demand
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\sc.exe
    sc config Wecsvc start=demand
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\sc.exe
    sc config WerSvc start=demand
    3⤵
    PID:1088
- - C:\Windows\SysWOW64\sc.exe
    sc config WiaRpc start=demand
    3⤵
    - Launches sc.exe
    PID:1352
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start=auto
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\sc.exe
    sc config WinHttpAutoProxySvc start=demand
    3⤵
    PID:2092
- - C:\Windows\SysWOW64\sc.exe
    sc config WinRM start=demand
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\sc.exe
    sc config Winmgmt start=auto
    3⤵
    PID:948
- - C:\Windows\SysWOW64\sc.exe
    sc config WlanSvc start=auto
    3⤵
    PID:912
- - C:\Windows\SysWOW64\sc.exe
    sc config WpcMonSvc start=demand
    3⤵
    PID:904
- - C:\Windows\SysWOW64\sc.exe
    sc config WpnService start=demand
    3⤵
    - Launches sc.exe
    PID:2340
- - C:\Windows\SysWOW64\sc.exe
    sc config WpnUserService_dc2a4 start=auto
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\sc.exe
    sc config WwanSvc start=demand
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\sc.exe
    sc config XblAuthManager start=demand
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\sc.exe
    sc config XblGameSave start=demand
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\sc.exe
    sc config XboxGipSvc start=demand
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:824
- - C:\Windows\SysWOW64\sc.exe
    sc config XboxNetApiSvc start=demand
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\sc.exe
    sc config autotimesvc start=demand
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\sc.exe
    sc config bthserv start=demand
    3⤵
    PID:756
- - C:\Windows\SysWOW64\sc.exe
    sc config camsvc start=demand
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\sc.exe
    sc config cbdhsvc_dc2a4 start=demand
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\sc.exe
    sc config cloudidsvc start=demand
    3⤵
    PID:1760
- - C:\Windows\SysWOW64\sc.exe
    sc config dcsvc start=demand
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\sc.exe
    sc config defragsvc start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1372
- - C:\Windows\SysWOW64\sc.exe
    sc config diagnosticshub.standardcollector.service start=demand
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\sc.exe
    sc config diagsvc start=demand
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\sc.exe
    sc config dmwappushservice start=demand
    3⤵
    PID:1848
- - C:\Windows\SysWOW64\sc.exe
    sc config dot3svc start=demand
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\sc.exe
    sc config edgeupdate start=demand
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\sc.exe
    sc config edgeupdatem start=demand
    3⤵
    - Launches sc.exe
    PID:2900
- - C:\Windows\SysWOW64\sc.exe
    sc config embeddedmode start=demand
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\sc.exe
    sc config fdPHost start=demand
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\sc.exe
    sc config fhsvc start=demand
    3⤵
    - Launches sc.exe
    PID:2680
- - C:\Windows\SysWOW64\sc.exe
    sc config gpsvc start=auto
    3⤵
    PID:2788
- - C:\Windows\SysWOW64\sc.exe
    sc config hidserv start=demand
    3⤵
    - Launches sc.exe
    PID:2800
- - C:\Windows\SysWOW64\sc.exe
    sc config icssvc start=demand
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc config iphlpsvc start=auto
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\sc.exe
    sc config lfsvc start=demand
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\sc.exe
    sc config lltdsvc start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2004
- - C:\Windows\SysWOW64\sc.exe
    sc config lmhosts start=demand
    3⤵
    PID:396
- - C:\Windows\SysWOW64\sc.exe
    sc config mpssvc start=auto
    3⤵
    PID:864
- - C:\Windows\SysWOW64\sc.exe
    sc config msiserver start=demand
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\sc.exe
    sc config netprofm start=demand
    3⤵
    - Launches sc.exe
    PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc config nsi start=auto
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1992
- - C:\Windows\SysWOW64\sc.exe
    sc config p2pimsvc start=demand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2420
- - C:\Windows\SysWOW64\sc.exe
    sc config p2psvc start=demand
    3⤵
    - Launches sc.exe
    PID:1804
- - C:\Windows\SysWOW64\sc.exe
    sc config perceptionsimulation start=demand
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\sc.exe
    sc config pla start=demand
    3⤵
    - Launches sc.exe
    PID:1224
- - C:\Windows\SysWOW64\sc.exe
    sc config seclogon start=demand
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1524
- - C:\Windows\SysWOW64\sc.exe
    sc config shpamsvc start=disabled
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\sc.exe
    sc config smphost start=disabled
    3⤵
    - Launches sc.exe
    PID:2776
- - C:\Windows\SysWOW64\sc.exe
    sc config spectrum start=demand
    3⤵
    PID:2584
- - C:\Windows\SysWOW64\sc.exe
    sc config sppsvc start=delayed-auto
    3⤵
    - Launches sc.exe
    PID:2564
- - C:\Windows\SysWOW64\sc.exe
    sc config ssh-agent start=disabled
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\sc.exe
    sc config svsvc start=demand
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\sc.exe
    sc config swprv start=demand
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc config tiledatamodelsvc start=auto
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\sc.exe
    sc config tzautoupdate start=disabled
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\sc.exe
    sc config uhssvc start=disabled
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\sc.exe
    sc config upnphost start=demand
    3⤵
    - Launches sc.exe
    PID:548
- - C:\Windows\SysWOW64\sc.exe
    sc config vds start=demand
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\sc.exe
    sc config vm3dservice start=demand
    3⤵
    PID:1004
- - C:\Windows\SysWOW64\sc.exe
    sc config vmicguestinterface start=demand
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\sc.exe
    sc config vmicheartbeat start=demand
    3⤵
    PID:588
- - C:\Windows\SysWOW64\sc.exe
    sc config vmickvpexchange start=demand
    3⤵
    - Launches sc.exe
    PID:2256
- - C:\Windows\SysWOW64\sc.exe
    sc config vmicrdv start=demand
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\sc.exe
    sc config vmicshutdown start=demand
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\sc.exe
    sc config vmictimesync start=demand
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\sc.exe
    sc config vmicvmsession start=demand
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\sc.exe
    sc config vmicvss start=demand
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\sc.exe
    sc config vmvss start=demand
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\sc.exe
    sc config wbengine start=demand
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\sc.exe
    sc config wcncsvc start=demand
    3⤵
    - Launches sc.exe
    PID:556
- - C:\Windows\SysWOW64\sc.exe
    sc config webthreatdefsvc start=demand
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\sc.exe
    sc config webthreatdefusersvc_dc2a4 start=auto
    3⤵
    PID:992
- - C:\Windows\SysWOW64\sc.exe
    sc config wercplsupport start=demand
    3⤵
    - Launches sc.exe
    PID:2844
- - C:\Windows\SysWOW64\sc.exe
    sc config wisvc start=demand
    3⤵
    - Launches sc.exe
    PID:2072
- - C:\Windows\SysWOW64\sc.exe
    sc config wlidsvc start=demand
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\sc.exe
    sc config wlpasvc start=demand
    3⤵
    - Launches sc.exe
    PID:2016
- - C:\Windows\SysWOW64\sc.exe
    sc config wmiApSrv start=demand
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\sc.exe
    sc config workfolderssvc start=demand
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\sc.exe
    sc config wscsvc start=delayed-auto
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start=demand
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\sc.exe
    sc config wudfsvc start=demand
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable
    3⤵
    PID:484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Autochk\Proxy" /Disable
    3⤵
    PID:772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable
    3⤵
    PID:568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable
    3⤵
    PID:264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable
    3⤵
    PID:776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClient" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /Disable
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Error Reporting\QueueReporting" /Disable
    3⤵
    PID:580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Application Experience\MareBackup" /Disable
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /Disable
    3⤵
    PID:2068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Application Experience\PcaPatchDbTask" /Disable
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Maps\MapsUpdateTask" /Disable
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:544
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v ContentDeliveryAllowed /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1388
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v OemPreInstalledAppsEnabled /t REG_DWORD /d 0 /f
    3⤵
    PID:940
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v PreInstalledAppsEnabled /t REG_DWORD /d 0 /f
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v PreInstalledAppsEverEnabled /t REG_DWORD /d 0 /f
    3⤵
    PID:932
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SilentInstalledAppsEnabled /t REG_DWORD /d 0 /f
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338387Enabled /t REG_DWORD /d 0 /f
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338388Enabled /t REG_DWORD /d 0 /f
    3⤵
    PID:924
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338389Enabled /t REG_DWORD /d 0 /f
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-353698Enabled /t REG_DWORD /d 0 /f
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SystemPaneSuggestionsEnabled /t REG_DWORD /d 0 /f
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
    3⤵
    PID:672
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Siuf\Rules" /v NumberOfSIUFInPeriod /t REG_DWORD /d 0 /f
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableTailoredExperiencesWithDiagnosticData /t REG_DWORD /d 1 /f
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" /v DisabledByGroupPolicy /t REG_DWORD /d 1 /f
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" /v DODownloadMode /t REG_DWORD /d 1 /f
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v fAllowToGetHelp /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1088
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\OperationStatusManager" /v EnthusiastMode /t REG_DWORD /d 1 /f
    3⤵
    PID:736
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowTaskViewButton /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2432
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People" /v PeopleBand /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2220
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v LaunchTo /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1260
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v LongPathsEnabled /t REG_DWORD /d 1 /f
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching" /v SearchOrderConfig /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness /t REG_DWORD /d 0 /f
    3⤵
    PID:1820
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex /t REG_DWORD /d 4294967295 /f
    3⤵
    PID:288
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v MenuShowDelay /t REG_DWORD /d 1 /f
    3⤵
    PID:912
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v AutoEndTasks /t REG_DWORD /d 1 /f
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v ClearPageFileAtShutdown /t REG_DWORD /d 0 /f
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\ControlSet001\Services\Ndu" /v Start /t REG_DWORD /d 2 /f
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Control Panel\Mouse" /v MouseHoverTime /t REG_SZ /d 400 /f
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v IRPStackSize /t REG_DWORD /d 30 /f
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Feeds" /v EnableFeeds /t REG_DWORD /d 0 /f
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Feeds" /v ShellFeedsTaskbarViewMode /t REG_DWORD /d 2 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2412
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HideSCAMeetNow /t REG_DWORD /d 1 /f
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "GPU Priority" /t REG_DWORD /d 8 /f
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v Priority /t REG_DWORD /d 6 /f
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Scheduling Category" /t REG_SZ /d High /f
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement" /v "ScoobeSystemSettingEnabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild 2>nul | findstr /r /c:"CurrentBuild"
    3⤵
    PID:608
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
      4⤵
      PID:756
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /r /c:"CurrentBuild"
      4⤵
      PID:2372
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Start-Process taskmgr.exe -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
  - - C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2236
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2884
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3004
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2676
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2800
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2280
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2188
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1828
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1680
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2816
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:864
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2724
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2716
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1180
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2392
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1436
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2480
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1788
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1752
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2776
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2568
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2528
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1984
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1384
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1336
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    PID:1152
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2256
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1924
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1688
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    - System Location Discovery: System Language Discovery
    PID:280
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2640
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1724
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2636
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2424
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2844
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1796
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2624
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1792
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:448
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2992
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1132
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2980
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    PID:324
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:484
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:536
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:568
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:596
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:580
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:684
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2108
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2068
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1324
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    - System Location Discovery: System Language Discovery
    PID:924
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2360
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:672
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2384
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1492
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1088
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
    3⤵
    PID:736
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2432
- C:\Users\Admin\AppData\Local\Temp\Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Update.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\Update.exe
    "C:\Users\Admin\AppData\Local\Temp\Update.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1640

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:304

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000320" "0000000000000494"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Oneclick-V7.0.bat

Filesize
201KB

MD5
061be0f53c7febeb3e363c867b9c128d

SHA1
3629f358e24dddc04c05fdd4b9899f57a8091286

SHA256
58729cdacc6ce4ea7e168a598fd3e29a1d3d017adbf85badbfb6de818b0de45c

SHA512
d1c520e4565ed492f312e8fe611913f013fe2e05539e42f9185271e8a811b50af8a1cd2e5445959c068c5d4adf1633c06d6a387d3b6cb1fa5c5fa84faff31e2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28082\python311.dll

Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
46b5d6953d94627432afed7aa366c29d

SHA1
1a96f7b134b7cc19ccbfb3e8808e163f50d45ba1

SHA256
3ae83dd776edc6e1bd0f87509713a7428c0bddcb0047530664ae7cc2c4443e85

SHA512
229f71c958d698a619ccda69e8621e9779a98e64105efdc1ab98e69a55ae603d1fbb72bd62dc37d85c5c5da339d14f46f04ee4d87e0f0219ac73860389097657

Download Submit
\Users\Admin\AppData\Local\Temp\Update.exe

Filesize
10.8MB

MD5
325bc1091d3aa90371df0e8f9095ab63

SHA1
28084aa70ddd36fe43e9c2078c5438c5048ab0cb

SHA256
097826ecce3278e1da5f0bee44a75a35ef38ca4c56e1f64c43a40c7b47cd9c17

SHA512
3f67b1bd376f3246900be4c7324e82cc71b3c890a87b76c51ea282d8f04db615435152063405c5ed402c88f44ef75b4c0f4260dd958044f96fb7775b11634996

Download Submit
memory/1640-65-0x000007FEF5D60000-0x000007FEF6348000-memory.dmp

Filesize
5.9MB

Download
memory/2352-172-0x00000000026E0000-0x00000000026FE000-memory.dmp

Filesize
120KB

Download
memory/2352-173-0x000000001D580000-0x000000001D8C6000-memory.dmp

Filesize
3.3MB

Download