ea1a2d01e622dfaae4fee2b353bab7912c2fb2235aa05bea0863f2f4cb829b33

Analysis

max time kernel
89s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/03/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
winPEAS.bat
Size 38KB
Sample260321-a51eysfy6q
SHA256 ea1a2d01e622dfaae4fee2b353bab7912c2fb2235aa05bea0863f2f4cb829b33
MD5 eeb43a531026c27753188ab562cf2271
SHA1 93592c884c37edb1c520ef0b570b4c1fe57a6e34
SHA512 f594bead6d1754846759f87d349b58c2a4cb0393cdd2b85375ec6f82f08de22d948ff39bcd76da586b9d1bcbd1f6a2ed1357f2a94ccecb895d049296b782d67f
SSDEEP 768:THw3hDBRQ6u54v8Vg7EkRVlB1Zmw6CMUM4LvfnCMOaHLhqghCPzr0Ih5ITOx1Zoh:7w3hDBRRu54v8i7TRVlB1Zmw6CMUM4Lp
TLSH
T10D03C68635141C1843F6E7B7AA414B80137311B72D176ACE3ADDA9BD9B2E1EE1B710CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4060	netsh.exe
3964	netsh.exe

Clipboard Data 1 TTPs 1 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
240	powershell.exe

Modifies file permissions 1 TTPs 43 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3356	icacls.exe
3536	icacls.exe
3656	Process not Found
4932	icacls.exe
1496	icacls.exe
3976	icacls.exe
2756	icacls.exe
4380	icacls.exe
1836	Process not Found
3568	Process not Found
1120	icacls.exe
2908	icacls.exe
892	icacls.exe
3280	icacls.exe
900	icacls.exe
5096	icacls.exe
644	Process not Found
1196	Process not Found
3368	icacls.exe
2072	icacls.exe
1168	icacls.exe
2868	Process not Found
4044	Process not Found
2520	icacls.exe
1324	icacls.exe
1604	icacls.exe
420	icacls.exe
1080	icacls.exe
2596	Process not Found
460	Process not Found
4696	icacls.exe
4596	icacls.exe
3528	Process not Found
4828	icacls.exe
5048	icacls.exe
1780	icacls.exe
4824	icacls.exe
1336	icacls.exe
4880	icacls.exe
1864	icacls.exe
3408	Process not Found
1720	Process not Found
784	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
844	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3588	tasklist.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2632	Process not Found
3784	Process not Found
4208	Process not Found
2012	Process not Found
3928	Process not Found
2328	Process not Found
2264	Process not Found
1120	Process not Found
2288	Process not Found
3184	Process not Found
1876	Process not Found
4876	Process not Found
3696	Process not Found
3228	Process not Found
4992	Process not Found
2992	Process not Found
3588	Process not Found
4240	Process not Found
632	Process not Found
1656	Process not Found
2948	Process not Found
2032	Process not Found
2204	Process not Found
4928	Process not Found
648	Process not Found
2312	Process not Found
4596	Process not Found
3284	Process not Found
3784	Process not Found
4880	Process not Found
3404	Process not Found
1704	Process not Found
2176	Process not Found
984	Process not Found
4236	Process not Found
3212	Process not Found
3928	Process not Found
1704	Process not Found
3656	Process not Found
2524	Process not Found
1868	Process not Found
2956	Process not Found
4772	Process not Found
2292	Process not Found
5044	Process not Found
2180	Process not Found
3140	Process not Found
3244	Process not Found
1196	Process not Found
4772	Process not Found
888	Process not Found
420	Process not Found
4628	Process not Found
572	Process not Found
4952	Process not Found
1972	Process not Found
3656	Process not Found
3368	Process not Found
1128	Process not Found
2592	Process not Found
2592	Process not Found
1688	Process not Found
2352	Process not Found
1656	Process not Found

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
1984	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1444	Process not Found
2072	Process not Found

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2228	cmd.exe
4452	Process not Found
2408	Process not Found
1916	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
396	cmd.exe
1392	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4400	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
756	WMIC.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3568	ipconfig.exe
4400	NETSTAT.EXE
2988	ipconfig.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3588	systeminfo.exe
2008	systeminfo.exe

Modifies registry key 1 TTPs 11 IoCs

Modify Registry

T1112

pid	Process
4828	reg.exe
4196	reg.exe
2896	reg.exe
4348	reg.exe
4460	Process not Found
4408	reg.exe
1836	reg.exe
460	Process not Found
1056	Process not Found
4236	Process not Found
4728	Process not Found

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
240	powershell.exe
240	powershell.exe
1444	Process not Found
1444	Process not Found
2072	Process not Found
2072	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4440	WMIC.exe
Token: SeSecurityPrivilege	4440	WMIC.exe
Token: SeTakeOwnershipPrivilege	4440	WMIC.exe
Token: SeLoadDriverPrivilege	4440	WMIC.exe
Token: SeSystemProfilePrivilege	4440	WMIC.exe
Token: SeSystemtimePrivilege	4440	WMIC.exe
Token: SeProfSingleProcessPrivilege	4440	WMIC.exe
Token: SeIncBasePriorityPrivilege	4440	WMIC.exe
Token: SeCreatePagefilePrivilege	4440	WMIC.exe
Token: SeBackupPrivilege	4440	WMIC.exe
Token: SeRestorePrivilege	4440	WMIC.exe
Token: SeShutdownPrivilege	4440	WMIC.exe
Token: SeDebugPrivilege	4440	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4440	WMIC.exe
Token: SeRemoteShutdownPrivilege	4440	WMIC.exe
Token: SeUndockPrivilege	4440	WMIC.exe
Token: SeManageVolumePrivilege	4440	WMIC.exe
Token: 33	4440	WMIC.exe
Token: 34	4440	WMIC.exe
Token: 35	4440	WMIC.exe
Token: 36	4440	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4440	WMIC.exe
Token: SeSecurityPrivilege	4440	WMIC.exe
Token: SeTakeOwnershipPrivilege	4440	WMIC.exe
Token: SeLoadDriverPrivilege	4440	WMIC.exe
Token: SeSystemProfilePrivilege	4440	WMIC.exe
Token: SeSystemtimePrivilege	4440	WMIC.exe
Token: SeProfSingleProcessPrivilege	4440	WMIC.exe
Token: SeIncBasePriorityPrivilege	4440	WMIC.exe
Token: SeCreatePagefilePrivilege	4440	WMIC.exe
Token: SeBackupPrivilege	4440	WMIC.exe
Token: SeRestorePrivilege	4440	WMIC.exe
Token: SeShutdownPrivilege	4440	WMIC.exe
Token: SeDebugPrivilege	4440	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4440	WMIC.exe
Token: SeRemoteShutdownPrivilege	4440	WMIC.exe
Token: SeUndockPrivilege	4440	WMIC.exe
Token: SeManageVolumePrivilege	4440	WMIC.exe
Token: 33	4440	WMIC.exe
Token: 34	4440	WMIC.exe
Token: 35	4440	WMIC.exe
Token: 36	4440	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1176	WMIC.exe
Token: SeSecurityPrivilege	1176	WMIC.exe
Token: SeTakeOwnershipPrivilege	1176	WMIC.exe
Token: SeLoadDriverPrivilege	1176	WMIC.exe
Token: SeSystemProfilePrivilege	1176	WMIC.exe
Token: SeSystemtimePrivilege	1176	WMIC.exe
Token: SeProfSingleProcessPrivilege	1176	WMIC.exe
Token: SeIncBasePriorityPrivilege	1176	WMIC.exe
Token: SeCreatePagefilePrivilege	1176	WMIC.exe
Token: SeBackupPrivilege	1176	WMIC.exe
Token: SeRestorePrivilege	1176	WMIC.exe
Token: SeShutdownPrivilege	1176	WMIC.exe
Token: SeDebugPrivilege	1176	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1176	WMIC.exe
Token: SeRemoteShutdownPrivilege	1176	WMIC.exe
Token: SeUndockPrivilege	1176	WMIC.exe
Token: SeManageVolumePrivilege	1176	WMIC.exe
Token: 33	1176	WMIC.exe
Token: 34	1176	WMIC.exe
Token: 35	1176	WMIC.exe
Token: 36	1176	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1176	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 2532	3876	cmd.exe	82
PID 2532 wrote to memory of 2376	2532	cmd.exe	83
PID 2532 wrote to memory of 2592	2532	cmd.exe	84
PID 3876 wrote to memory of 3588	3876	cmd.exe	86
PID 3876 wrote to memory of 1056	3876	cmd.exe	89
PID 3876 wrote to memory of 4440	3876	cmd.exe	90
PID 3876 wrote to memory of 3960	3876	cmd.exe	91
PID 3876 wrote to memory of 3400	3876	cmd.exe	92
PID 3400 wrote to memory of 2008	3400	cmd.exe	93
PID 3876 wrote to memory of 4424	3876	cmd.exe	94
PID 3876 wrote to memory of 4840	3876	cmd.exe	95
PID 3876 wrote to memory of 1492	3876	cmd.exe	96
PID 3876 wrote to memory of 1456	3876	cmd.exe	97
PID 3876 wrote to memory of 1224	3876	cmd.exe	98
PID 3876 wrote to memory of 3656	3876	cmd.exe	99
PID 3876 wrote to memory of 3408	3876	cmd.exe	100
PID 3876 wrote to memory of 4536	3876	cmd.exe	101
PID 3876 wrote to memory of 464	3876	cmd.exe	102
PID 3876 wrote to memory of 1096	3876	cmd.exe	103
PID 3876 wrote to memory of 2416	3876	cmd.exe	104
PID 3876 wrote to memory of 4928	3876	cmd.exe	105
PID 3876 wrote to memory of 2016	3876	cmd.exe	106
PID 3876 wrote to memory of 3616	3876	cmd.exe	107
PID 3876 wrote to memory of 1468	3876	cmd.exe	108
PID 3876 wrote to memory of 2564	3876	cmd.exe	109
PID 3876 wrote to memory of 272	3876	cmd.exe	110
PID 3876 wrote to memory of 232	3876	cmd.exe	111
PID 3876 wrote to memory of 2032	3876	cmd.exe	112
PID 3876 wrote to memory of 3832	3876	cmd.exe	113
PID 3876 wrote to memory of 3680	3876	cmd.exe	114
PID 3876 wrote to memory of 2632	3876	cmd.exe	115
PID 3876 wrote to memory of 772	3876	cmd.exe	116
PID 3876 wrote to memory of 2800	3876	cmd.exe	117
PID 3876 wrote to memory of 1044	3876	cmd.exe	118
PID 3876 wrote to memory of 2164	3876	cmd.exe	119
PID 3876 wrote to memory of 4768	3876	cmd.exe	120
PID 3876 wrote to memory of 1076	3876	cmd.exe	121
PID 3876 wrote to memory of 420	3876	cmd.exe	122
PID 3876 wrote to memory of 892	3876	cmd.exe	123
PID 3876 wrote to memory of 2960	3876	cmd.exe	124
PID 3876 wrote to memory of 2556	3876	cmd.exe	125
PID 3876 wrote to memory of 1500	3876	cmd.exe	126
PID 3876 wrote to memory of 900	3876	cmd.exe	127
PID 3876 wrote to memory of 3944	3876	cmd.exe	128
PID 3876 wrote to memory of 1376	3876	cmd.exe	129
PID 3876 wrote to memory of 4284	3876	cmd.exe	130
PID 3876 wrote to memory of 4272	3876	cmd.exe	131
PID 3876 wrote to memory of 1676	3876	cmd.exe	132
PID 3876 wrote to memory of 3424	3876	cmd.exe	133
PID 3876 wrote to memory of 1696	3876	cmd.exe	134
PID 3876 wrote to memory of 4308	3876	cmd.exe	135
PID 3876 wrote to memory of 5080	3876	cmd.exe	136
PID 3876 wrote to memory of 4412	3876	cmd.exe	137
PID 3876 wrote to memory of 4876	3876	cmd.exe	138
PID 3876 wrote to memory of 1692	3876	cmd.exe	139
PID 3876 wrote to memory of 4960	3876	cmd.exe	140
PID 3876 wrote to memory of 3500	3876	cmd.exe	141
PID 3876 wrote to memory of 4596	3876	cmd.exe	142
PID 3876 wrote to memory of 3156	3876	cmd.exe	143
PID 3876 wrote to memory of 1444	3876	cmd.exe	144
PID 3876 wrote to memory of 3924	3876	cmd.exe	145
PID 3876 wrote to memory of 3352	3876	cmd.exe	146
PID 3876 wrote to memory of 3360	3876	cmd.exe	147
PID 3876 wrote to memory of 1176	3876	cmd.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\winPEAS.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:2376
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2592
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:3588
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:1056
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\system32\more.com
  more
  2⤵
  PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c systeminfo
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."BFFC-PC " "
  2⤵
  PID:4424
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."BFFC-PC " "
  2⤵
  PID:1492
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Microsoft Windows 11 Pro " "
  2⤵
  PID:1224
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Microsoft Windows 11 Pro " "
  2⤵
  PID:3408
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."10.0.22000 N/A Build 22000 " "
  2⤵
  PID:464
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."10.0.22000 N/A Build 22000 " "
  2⤵
  PID:2416
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Microsoft Corporation " "
  2⤵
  PID:2016
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Microsoft Corporation " "
  2⤵
  PID:1468
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Standalone Workstation " "
  2⤵
  PID:272
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Standalone Workstation " "
  2⤵
  PID:2032
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Type: Multiprocessor Free " "
  2⤵
  PID:3680
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Type: Multiprocessor Free " "
  2⤵
  PID:772
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."BFBC " "
  2⤵
  PID:1044
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."BFBC " "
  2⤵
  PID:4768
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."00331-10000-00001-AA316 " "
  2⤵
  PID:420
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."00331-10000-00001-AA316 " "
  2⤵
  PID:2960
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Date: 11/4/2022, 5:44:14 AM " "
  2⤵
  PID:1500
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Date: 11/4/2022, 5:44:14 AM " "
  2⤵
  PID:3944
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Time: 11/4/2022, 7:18:35 AM " "
  2⤵
  PID:4284
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Time: 11/4/2022, 7:18:35 AM " "
  2⤵
  PID:1676
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Gigabyte Technology Co., Ltd. " "
  2⤵
  PID:1696
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Gigabyte Technology Co., Ltd. " "
  2⤵
  PID:5080
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."B660M GAMING X DDR4 " "
  2⤵
  PID:4876
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."B660M GAMING X DDR4 " "
  2⤵
  PID:4960
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."x64-based PC " "
  2⤵
  PID:4596
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."x64-based PC " "
  2⤵
  PID:1444
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Processor(s) Installed. " "
  2⤵
  PID:3352
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Processor(s) Installed. " "
  2⤵
  PID:1176
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Family 6 Model 151 Stepping 2 GenuineIntel" "
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1916
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Family 6 Model 151 Stepping 2 GenuineIntel" "
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2228
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."SeaBIOS rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org, 4/1/2014 " "
  2⤵
  PID:3280
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."SeaBIOS rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org, 4/1/2014 " "
  2⤵
  PID:2512
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."C:\Windows " "
  2⤵
  PID:5084
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."C:\Windows " "
  2⤵
  PID:1836
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."C:\Windows\system32 " "
  2⤵
  PID:5008
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."C:\Windows\system32 " "
  2⤵
  PID:5024
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."\Device\HarddiskVolume1 " "
  2⤵
  PID:5100
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."\Device\HarddiskVolume1 " "
  2⤵
  PID:428
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."en-us;English (United States) " "
  2⤵
  PID:4212
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."en-us;English (United States) " "
  2⤵
  PID:3600
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."en-us;English (United States) " "
  2⤵
  PID:632
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."en-us;English (United States) " "
  2⤵
  PID:1436
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."(UTC+00:00) Dublin, Edinburgh, Lisbon, London " "
  2⤵
  PID:3588
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."(UTC+00:00) Dublin, Edinburgh, Lisbon, London " "
  2⤵
  PID:3148
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Memory: 16,154 MB " "
  2⤵
  PID:4252
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Memory: 16,154 MB " "
  2⤵
  PID:4440
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Memory: 12,100 MB " "
  2⤵
  PID:2136
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Memory: 12,100 MB " "
  2⤵
  PID:4424
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Max Size: 19,098 MB " "
  2⤵
  PID:1640
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Max Size: 19,098 MB " "
  2⤵
  PID:1224
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Available: 15,351 MB " "
  2⤵
  PID:4076
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Available: 15,351 MB " "
  2⤵
  PID:4864
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."In Use: 3,747 MB " "
  2⤵
  PID:2416
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."In Use: 3,747 MB " "
  2⤵
  PID:1048
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Location(s): C:\pagefile.sys " "
  2⤵
  PID:32
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Location(s): C:\pagefile.sys " "
  2⤵
  PID:4464
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."\\CRRTOJJN " "
  2⤵
  PID:3668
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."\\CRRTOJJN " "
  2⤵
  PID:1144
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."1 NIC(s) Installed. " "
  2⤵
  PID:1420
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."1 NIC(s) Installed. " "
  2⤵
  PID:1732
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."RTL8139C+ Fast Ethernet NIC " "
  2⤵
  PID:4768
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."RTL8139C+ Fast Ethernet NIC " "
  2⤵
  PID:2468
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Ethernet " "
  2⤵
  PID:2960
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Ethernet " "
  2⤵
  PID:1500
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."No " "
  2⤵
  PID:4208
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."No " "
  2⤵
  PID:4284
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."VM Monitor Mode Extensions: Yes " "
  2⤵
  PID:4824
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."VM Monitor Mode Extensions: Yes " "
  2⤵
  PID:1696
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."In Firmware: Yes " "
  2⤵
  PID:4016
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."In Firmware: Yes " "
  2⤵
  PID:4876
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Address Translation: Yes " "
  2⤵
  PID:4960
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Address Translation: Yes " "
  2⤵
  PID:4596
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Prevention Available: Yes " "
  2⤵
  PID:1444
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Prevention Available: Yes " "
  2⤵
  PID:3352
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4792
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1176
- C:\Windows\system32\findstr.exe
  findstr /C:"KB2592799"
  2⤵
  PID:1092
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:4264
- C:\Windows\system32\findstr.exe
  findstr /C:"KB3143141"
  2⤵
  PID:3536
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:2472
- C:\Windows\system32\findstr.exe
  findstr /C:"KB2393802"
  2⤵
  PID:688
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:1876
- C:\Windows\system32\findstr.exe
  findstr /C:"KB982799"
  2⤵
  PID:3056
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:1508
- C:\Windows\system32\findstr.exe
  findstr /C:"KB979683"
  2⤵
  PID:3188
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:2376
- C:\Windows\system32\findstr.exe
  findstr /C:"KB2305420"
  2⤵
  PID:1664
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:428
- C:\Windows\system32\findstr.exe
  findstr /C:"KB981957"
  2⤵
  PID:844
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:3600
- C:\Windows\system32\findstr.exe
  findstr /C:"KB4013081"
  2⤵
  PID:5072
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:3104
- C:\Windows\system32\findstr.exe
  findstr /C:"KB977165"
  2⤵
  PID:1436
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:1108
- C:\Windows\system32\findstr.exe
  findstr /C:"KB941693"
  2⤵
  PID:1996
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:4148
- C:\Windows\system32\findstr.exe
  findstr /C:"KB920958"
  2⤵
  PID:4300
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:2736
- C:\Windows\system32\findstr.exe
  findstr /C:"KB914389"
  2⤵
  PID:4424
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:3300
- C:\Windows\system32\findstr.exe
  findstr /C:"KB908523"
  2⤵
  PID:1224
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:3916
- C:\Windows\system32\findstr.exe
  findstr /C:"KB890859"
  2⤵
  PID:3068
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:4556
- C:\Windows\system32\findstr.exe
  findstr /C:"KB842526"
  2⤵
  PID:1524
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:228
- C:\Windows\system32\findstr.exe
  findstr /C:"KB835732"
  2⤵
  PID:644
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:3680
- C:\Windows\system32\findstr.exe
  findstr /C:"KB841872"
  2⤵
  PID:3832
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:1044
- C:\Windows\system32\findstr.exe
  findstr /C:"KB2975684"
  2⤵
  PID:1324
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:4768
- C:\Windows\system32\findstr.exe
  findstr /C:"KB3136041"
  2⤵
  PID:1780
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:560
- C:\Windows\system32\findstr.exe
  findstr /C:"KB3057191"
  2⤵
  PID:2960
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:3976
- C:\Windows\system32\findstr.exe
  findstr /C:"KB2989935"
  2⤵
  PID:3944
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:2040
- C:\Windows\system32\findstr.exe
  findstr /C:"KB2778930"
  2⤵
  PID:2756
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:3720
- C:\Windows\system32\findstr.exe
  findstr /C:"KB2850851"
  2⤵
  PID:5080
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  PID:4752
- C:\Windows\system32\findstr.exe
  findstr /C:"KB2870008"
  2⤵
  PID:988
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit
  2⤵
  PID:3956
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager
  2⤵
  PID:3540
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft Services\AdmPwd" /v AdmPwdEnabled
  2⤵
  PID:1444
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Policies\LAPS" /v BackupDirectory
  2⤵
  PID:3360
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\LAPS" /v BackupDirectory
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA" /v RunAsPPL
  2⤵
  - Access Token Manipulation: Create Process with Token
  PID:1984
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA" /v LsaCfgFlags
  2⤵
  PID:4384
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential
  2⤵
  - Modifies registry key
  PID:4828
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CACHEDLOGONSCOUNT
  2⤵
  PID:3444
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA
  2⤵
  PID:4900
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:1080
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
  2⤵
  PID:2896
- C:\Windows\system32\more.com
  more
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
  2⤵
  PID:2472
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine /v PowerShellVersion
  2⤵
  PID:3376
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine /v PowerShellVersion
  2⤵
  PID:2912
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
  2⤵
  PID:4644
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging
  2⤵
  PID:3056
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
  2⤵
  PID:4460
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:4260
- C:\Windows\System32\Wbem\WMIC.exe
  wmic logicaldisk get caption
  2⤵
  - Collects information from the system
  PID:756
- C:\Windows\system32\more.com
  more
  2⤵
  PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Program Files" "C:\Program Files (x86)" "
  2⤵
  PID:1664
- C:\Windows\system32\sort.exe
  sort
  2⤵
  PID:2376
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
  2⤵
  - Modifies registry key
  PID:4196
- C:\Windows\system32\findstr.exe
  findstr InstallLocation
  2⤵
  PID:3968
- C:\Windows\system32\findstr.exe
  findstr ":\\"
  2⤵
  PID:4276
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /s
  2⤵
  - Modifies registry key
  PID:4408
- C:\Windows\system32\findstr.exe
  findstr InstallLocation
  2⤵
  PID:2988
- C:\Windows\system32\findstr.exe
  findstr ":\\"
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\
  2⤵
  PID:5072
- C:\Windows\system32\findstr.exe
  findstr /i "wuserver"
  2⤵
  PID:4660
- C:\Windows\system32\findstr.exe
  findstr /i "http://"
  2⤵
  PID:1056
- C:\Windows\system32\tasklist.exe
  tasklist /SVC
  2⤵
  - Enumerates processes with tasklist
  PID:3588
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:3848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process list full |find /i "executablepath"|find /i /v "system32"|find ":"
  2⤵
  PID:4252
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process list full
    3⤵
    PID:4512
- - C:\Windows\system32\find.exe
    find /i "executablepath"
    3⤵
    PID:1996
- - C:\Windows\system32\find.exe
    find /i /v "system32"
    3⤵
    PID:5028
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\Explorer.EXE
  2⤵
  PID:1740
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\Explorer.EXE"
  2⤵
  - Modifies file permissions
  PID:3356
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:2140
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:4424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
  2⤵
  PID:3408
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"
  2⤵
  - Modifies file permissions
  PID:2520
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:3656
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  2⤵
  PID:4164
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"
  2⤵
  - Modifies file permissions
  PID:3368
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4864
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:32
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
  2⤵
  PID:2292
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"
  2⤵
  - Modifies file permissions
  PID:4932
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:1048
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:3396
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:1360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process list full |find /i "executablepath"|find /i /v "system32"|find ":"
  2⤵
  PID:4464
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process list full
    3⤵
    PID:1420
- - C:\Windows\system32\find.exe
    find /i "executablepath"
    3⤵
    PID:1560
- - C:\Windows\system32\find.exe
    find /i /v "system32"
    3⤵
    PID:2632
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\Explorer.EXE
  2⤵
  PID:3088
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\\"
  2⤵
  - Modifies file permissions
  PID:1324
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:664
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
  2⤵
  PID:420
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\"
  2⤵
  - Modifies file permissions
  PID:1780
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:2972
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  2⤵
  PID:560
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\"
  2⤵
  - Modifies file permissions
  PID:2072
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:244
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
  2⤵
  PID:3976
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Common Files\microsoft shared\ClickToRun\\"
  2⤵
  - Modifies file permissions
  PID:1120
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4268
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:4972
- C:\Windows\system32\icacls.exe
  icacls "C:\Documents and Settings\All Users\Start Menu\Programs\Startup"
  2⤵
  - Modifies file permissions
  PID:4824
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:3424
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:2352
- C:\Windows\system32\icacls.exe
  icacls "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\*"
  2⤵
  - Modifies file permissions
  PID:2908
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:1692
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:3720
- C:\Windows\system32\icacls.exe
  icacls "C:\Documents and Settings\Admin\Start Menu\Programs\Startup"
  2⤵
  - Modifies file permissions
  PID:1604
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:3500
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:4964
- C:\Windows\system32\icacls.exe
  icacls "C:\Documents and Settings\Admin\Start Menu\Programs\Startup\*"
  2⤵
  - Modifies file permissions
  PID:892
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:3140
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:3156
- C:\Windows\system32\icacls.exe
  icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
  2⤵
  - Modifies file permissions
  PID:1168
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:1676
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:4816
- C:\Windows\system32\icacls.exe
  icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*"
  2⤵
  - Modifies file permissions
  PID:1496
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:1984
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:1916
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
  2⤵
  - Modifies file permissions
  PID:4828
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:1092
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:1408
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*"
  2⤵
  - Modifies file permissions
  PID:3280
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:2924
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:3540
- C:\Windows\system32\schtasks.exe
  schtasks /query /fo TABLE /nh
  2⤵
  PID:3840
- C:\Windows\system32\findstr.exe
  findstr /v /i "disable deshab informa")
  2⤵
  PID:4296
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
  2⤵
  - Modifies registry key
  PID:1836
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
  2⤵
  - Modifies registry key
  PID:2896
- C:\Windows\system32\net.exe
  net share
  2⤵
  PID:3376
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share
    3⤵
    PID:2912
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:3568
- C:\Windows\system32\NETSTAT.EXE
  netstat -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  PID:4400
- C:\Windows\system32\findstr.exe
  findstr /i listen
  2⤵
  PID:4404
- C:\Windows\system32\netsh.exe
  netsh firewall show state
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4060
- C:\Windows\system32\netsh.exe
  netsh firewall show config
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3964
- C:\Windows\system32\ARP.EXE
  arp -A
  2⤵
  - Network Service Discovery
  PID:844
- C:\Windows\system32\ROUTE.EXE
  route print
  2⤵
  PID:3968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" type C:\WINDOWS\System32\drivers\etc\hosts "
  2⤵
  PID:4276
- C:\Windows\system32\findstr.exe
  findstr /v "^#"
  2⤵
  PID:632
- C:\Windows\system32\ipconfig.exe
  ipconfig /displaydns
  2⤵
  - Gathers network information
  PID:2988
- C:\Windows\system32\findstr.exe
  findstr "Record"
  2⤵
  PID:4408
- C:\Windows\system32\findstr.exe
  findstr "Name Host"
  2⤵
  PID:4716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profiles | find "Profile "
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:396
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1392
- - C:\Windows\system32\find.exe
    find "Profile "
    3⤵
    PID:4728
- C:\Windows\system32\net.exe
  net user Admin
  2⤵
  PID:2112
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Admin
    3⤵
    PID:1456
- C:\Windows\system32\net.exe
  net user Admin /domain
  2⤵
  PID:2492
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Admin /domain
    3⤵
    PID:3736
- C:\Windows\system32\whoami.exe
  whoami /all
  2⤵
  PID:2108
- C:\Windows\system32\net.exe
  net user
  2⤵
  PID:3148
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:1640
- C:\Windows\system32\net.exe
  net localgroup
  2⤵
  PID:2736
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup
    3⤵
    PID:4904
- C:\Windows\system32\net.exe
  net localgroup Administrators
  2⤵
  PID:4424
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators
    3⤵
    PID:1776
- C:\Windows\system32\net.exe
  net localgroup Administradores
  2⤵
  PID:1212
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administradores
    3⤵
    PID:2748
- C:\Windows\system32\quser.exe
  quser
  2⤵
  PID:5112
- C:\Windows\system32\klist.exe
  klist
  2⤵
  PID:4020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Get-Clipboard"
  2⤵
  - Clipboard Data
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c wmic service list full | findstr /i "pathname" |findstr /i /v "system32"
  2⤵
  PID:3384
- - C:\Windows\system32\cmd.exe
    cmd.exe /c wmic service list full
    3⤵
    PID:1144
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic service list full
      4⤵
      PID:1420
- - C:\Windows\system32\findstr.exe
    findstr /i "pathname"
    3⤵
    PID:572
- - C:\Windows\system32\findstr.exe
    findstr /i /v "system32"
    3⤵
    PID:4372
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"
  2⤵
  - Modifies file permissions
  PID:420
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4112
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:4684
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
  2⤵
  - Modifies file permissions
  PID:1336
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:648
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:2416
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
  2⤵
  - Modifies file permissions
  PID:4696
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:1376
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:244
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe"
  2⤵
  - Modifies file permissions
  PID:3976
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4456
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:3296
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
  2⤵
  - Modifies file permissions
  PID:2756
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:2096
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:2300
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\updater.exe"
  2⤵
  - Modifies file permissions
  PID:4596
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:1008
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:5080
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\updater.exe"
  2⤵
  - Modifies file permissions
  PID:5048
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:3312
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:2160
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
  2⤵
  - Modifies file permissions
  PID:900
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:2620
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:3956
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
  2⤵
  - Modifies file permissions
  PID:4880
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:3228
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:3360
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
  2⤵
  - Modifies file permissions
  PID:5096
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4384
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:1696
- C:\Windows\system32\icacls.exe
  icacls "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
  2⤵
  - Modifies file permissions
  PID:1864
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:2572
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:3444
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SysWow64\perfhost.exe"
  2⤵
  - Modifies file permissions
  PID:1080
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:5116
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:1112
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\servicing\TrustedInstaller.exe"
  2⤵
  - Modifies file permissions
  PID:3536
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:3040
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:4264
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe"
  2⤵
  - Modifies file permissions
  PID:4380
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:2336
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:3840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query hklm\system\currentcontrolset\services
  2⤵
  PID:3056
- - C:\Windows\system32\reg.exe
    reg query hklm\system\currentcontrolset\services
    3⤵
    - Modifies registry key
    PID:4348
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2560
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4404
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3188
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1208
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:404
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3380
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NETFramework C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4648
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NETFramework C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3784
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\1394ohci C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\1394ohci C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\3ware C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\3ware C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1700
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AarSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AarSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AarSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AarSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4628
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ACPI C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ACPI C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2548
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpials C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3588
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpials C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2244
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AcpiDev C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3104
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AcpiDev C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1056
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpiex C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpiex C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpipagr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5028
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpipagr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3736
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AcpiPmi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1108
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AcpiPmi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpitime C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4280
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpitime C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2176
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Acx01000 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1440
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Acx01000 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ADOVMPPackage C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ADOVMPPackage C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ADP80XX C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ADP80XX C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\adsi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3916
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\adsi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AFD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1524
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AFD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3936
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\afunix C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3616
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\afunix C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2292
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ahcache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:232
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ahcache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:228
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AJRouter C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3044
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AJRouter C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:432
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ALG C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:464
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ALG C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1560
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdgpio2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4128
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdgpio2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdi2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1420
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdi2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:772
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AmdK8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4044
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AmdK8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AmdPPM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:420
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AmdPPM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:560
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdsata C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdsata C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2816
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdsbs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4208
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdsbs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdxata C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdxata C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3860
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppID C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2216
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppID C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3976
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppIDSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2040
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppIDSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4016
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Appinfo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2352
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Appinfo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:488
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppleSSD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4412
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppleSSD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4596
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\applockerfltr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:988
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\applockerfltr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3500
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppMgmt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1512
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppMgmt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppReadiness C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3140
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppReadiness C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3156
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppVClient C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppVClient C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3228
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvStrm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3360
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvStrm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvVemgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4384
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvVemgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1696
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvVfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvVfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:940
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppXSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2228
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppXSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\arcsas C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\arcsas C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4296
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AssignedAccessManagerSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3040
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AssignedAccessManagerSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AsyncMac C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2044
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AsyncMac C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2336
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\atapi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3840
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\atapi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5008
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AudioEndpointBuilder C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1744
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AudioEndpointBuilder C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2592
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Audiosrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1508
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Audiosrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4772
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\autotimesvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4640
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\autotimesvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3660
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AxInstSV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1864
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AxInstSV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4648
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\b06bdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3784
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\b06bdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bam C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bam C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BasicDisplay C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1700
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BasicDisplay C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BasicRender C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BasicRender C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BattC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4628
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BattC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BcastDVRUserService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2548
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BcastDVRUserService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3588
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BcastDVRUserService_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2244
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BcastDVRUserService_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3104
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bcmfn2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1056
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bcmfn2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BDESVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BDESVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5028
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Beep C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3736
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Beep C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1108
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BFE C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BFE C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4280
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bindflt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2176
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bindflt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1440
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BITS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BITS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BluetoothUserService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5112
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BluetoothUserService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BluetoothUserService_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BluetoothUserService_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3916
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bowser C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bowser C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1524
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BrokerInfrastructure C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3936
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BrokerInfrastructure C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3616
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTAGService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2292
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTAGService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:232
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthA2dp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:228
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthA2dp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3044
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthAvctpSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:432
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthAvctpSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:464
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1560
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4128
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthHFEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthHFEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1420
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthLEEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:772
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthLEEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4044
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthMini C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthMini C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:420
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHMODEM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:560
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHMODEM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHPORT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2816
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHPORT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4208
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bthserv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bthserv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHUSB C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3860
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHUSB C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2216
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bttflt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3976
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bttflt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\buttonconverter C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2300
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\buttonconverter C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1848
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CAD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3720
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CAD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4960
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\camsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\camsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5048
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CaptureService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CaptureService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:892
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CaptureService_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:900
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CaptureService_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cbdhsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4792
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cbdhsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cbdhsvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3228
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cbdhsvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3360
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cdfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cdfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4384
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1696
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:940
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2228
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPUserSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPUserSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cdrom C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4296
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cdrom C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3040
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CertPropSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CertPropSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2044
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cht4iscsi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2336
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cht4iscsi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3840
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cht4vbd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5008
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cht4vbd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1744
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CimFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2592
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CimFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1508
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\circlass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4772
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\circlass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4640
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CldFlt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3660
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CldFlt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1864
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CLFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4648
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CLFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3784
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ClickToRunSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ClickToRunSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ClipSVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ClipSVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1700
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cloudidsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cloudidsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v2.0.50727_32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v2.0.50727_32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4628
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v2.0.50727_64 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v2.0.50727_64 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2408
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v4.0.30319_32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4872
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v4.0.30319_32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4728
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v4.0.30319_64 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1164
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v4.0.30319_64 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1548
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CmBatt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4300
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CmBatt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2136
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CNG C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4440
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CNG C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2108
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cnghwassist C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4448
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cnghwassist C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3688
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CompositeBus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3212
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CompositeBus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3300
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\COMSysApp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2140
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\COMSysApp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:784
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\condrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2748
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\condrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2016
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ConsentUxUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1612
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ConsentUxUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3184
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ConsentUxUserSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1048
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ConsentUxUserSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2564
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CoreMessagingRegistrar C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4864
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CoreMessagingRegistrar C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1468
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CoreUI C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4928
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CoreUI C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3396
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1732
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4744
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4796
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2180
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\crypt32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3088
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\crypt32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CryptSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:572
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CryptSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2124
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CSC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4372
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CSC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4652
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CscService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1780
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CscService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2012
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dam C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dam C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1336
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DCLocator C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:668
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DCLocator C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2072
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DcomLaunch C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DcomLaunch C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:244
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\defragsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3240
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\defragsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3084
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationBrokerSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3296
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationBrokerSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1688
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationBrokerSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3424
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationBrokerSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4824
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2908
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3496
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceInstall C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1692
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceInstall C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4752
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicePickerUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicePickerUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3924
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicePickerUserSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1912
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicePickerUserSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4844
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicesFlowUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3156
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicesFlowUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1676
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicesFlowUserSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicesFlowUserSvc_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3228
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevQueryBroker C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3360
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevQueryBroker C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1984
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dfsc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4384
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dfsc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1696
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dhcp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dhcp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:940
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\diagnosticshub.standardcollector.service C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2228
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\diagnosticshub.standardcollector.service C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\diagsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\diagsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4296
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DiagTrack C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3040
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DiagTrack C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2348
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DialogBlockingService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4380
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DialogBlockingService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3568
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\disk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4348
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\disk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DispBrokerDesktopSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3672
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DispBrokerDesktopSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DisplayEnhancementService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1464
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DisplayEnhancementService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:404
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DmEnrollmentSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1532
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DmEnrollmentSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3464
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dmvsc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3880
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dmvsc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4168
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dmwappushservice C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2992
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dmwappushservice C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:936
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dnscache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:428
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dnscache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3600
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DoSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2948
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DoSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dot3svc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2288
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dot3svc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:652
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DPS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3940
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DPS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\drmkaud C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2548
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\drmkaud C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4872
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DsmSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4728
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DsmSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1164
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DsSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1548
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DsSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4300
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DusmSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2136
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DusmSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4440
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DXGKrnl C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DXGKrnl C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EapHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3408
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EapHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3928
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ebdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1440
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ebdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1224
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ebdrv0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ebdrv0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3068
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\edgeupdate C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\edgeupdate C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3668
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\edgeupdatem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1360
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\edgeupdatem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2224
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4932
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EhStorClass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1116
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EhStorClass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EhStorTcgDrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:232
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EhStorTcgDrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:240
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\embeddedmode C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1044
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\embeddedmode C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2008
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EntAppSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4736
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EntAppSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:644
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ErrDev C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4584
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ErrDev C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ESENT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ESENT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2556
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EventLog C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:840
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EventLog C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4284
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EventSystem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:656
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EventSystem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4272
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ExecutionContext C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ExecutionContext C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1376
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\exfat C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4268
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\exfat C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fastfat C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fastfat C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Fax C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4876
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Fax C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2596
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fdc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2352
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fdc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2300
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fdPHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4412
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fdPHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5080
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FDResPub C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2976
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FDResPub C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3312
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fhsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1512
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fhsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3016
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FileCrypt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2620
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FileCrypt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1444
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FileInfo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FileInfo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4792
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Filetrace C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1676
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Filetrace C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\flpydisk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1340
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\flpydisk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5096
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FltMgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1972
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FltMgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FontCache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3444
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FontCache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3540
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FontCache3.0.0.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1080
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FontCache3.0.0.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1728
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FrameServer C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2472
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FrameServer C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:836
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FrameServerMonitor C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2896
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FrameServerMonitor C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3040
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FsDepends C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4260
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FsDepends C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5024
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Fs_Rec C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3840
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Fs_Rec C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4404
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fvevol C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3188
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fvevol C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1208
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\gencounter C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4060
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\gencounter C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4868
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\genericusbfn C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2660
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\genericusbfn C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3660
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleChromeElevationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3632
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleChromeElevationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1664
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleUpdaterInternalService141.0.7340.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2412
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleUpdaterInternalService141.0.7340.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:936
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleUpdaterService141.0.7340.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4196
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleUpdaterService141.0.7340.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GPIOClx0101 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3968
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GPIOClx0101 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3696
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\gpsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\gpsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GpuEnergyDrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3848
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GpuEnergyDrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3960
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GraphicsPerfSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2408
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GraphicsPerfSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2244
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HdAudAddService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4156
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HdAudAddService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4088
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HDAudBus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4952
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HDAudBus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:916
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidBatt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5028
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidBatt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidBth C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4448
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidBth C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3688
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidi2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2580
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidi2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4536
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidinterrupt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3300
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidinterrupt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3656
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidIr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidIr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3152
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidserv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5112
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidserv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1612
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidspi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3220
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidspi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1048
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidSpiCx C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1360
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidSpiCx C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidUsb C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2224
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidUsb C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4932
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HpSAMD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1116
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HpSAMD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Hsp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:232
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Hsp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:240
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HTTP C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1044
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HTTP C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2008
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hvcrash C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4736
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hvcrash C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:644
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HvHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4584
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HvHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hvservice C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hvservice C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2556
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HwNClx0101 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:840
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HwNClx0101 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4284
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hwpolicy C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:656
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hwpolicy C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4272
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hyperkbd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3404
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hyperkbd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1376
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HyperVideo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4268
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HyperVideo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\i8042prt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\i8042prt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3084
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iagpio C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3296
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iagpio C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1688
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iai2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2756
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iai2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4824
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1848
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3720
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_BXT_P C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1692
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_BXT_P C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4964
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_CNL C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3264
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_CNL C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1512
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_GLK C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3016
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_GLK C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3140
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:900
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1168
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_BXT_P C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4880
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_BXT_P C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_CNL C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_CNL C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1340
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_GLK C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5096
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_GLK C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1972
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSSi_GPIO C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSSi_GPIO C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1528
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSSi_I2C C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2924
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSSi_I2C C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1112
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorAV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorAV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorAVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorAVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1880
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2044
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ibbus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4416
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ibbus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2560
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\icssvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5008
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\icssvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1744
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IKEEXT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2592
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IKEEXT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1464
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IndirectKmd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4772
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IndirectKmd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1924
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\inetaccs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3464
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\inetaccs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\InstallService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3964
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\InstallService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:844
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelide C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelide C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:428
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelpep C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1700
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelpep C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2948
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelpmax C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelpmax C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2988
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IntelPMT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2956
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IntelPMT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4452
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelppm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3588
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelppm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1436
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iorate C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5072
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iorate C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IpFilterDriver C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3648
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IpFilterDriver C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4344
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iphlpsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4300
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iphlpsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2136
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPMIDRV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4440
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPMIDRV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1076
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPNAT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1640
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPNAT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3212
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3528
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IpxlatCfgSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2176
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IpxlatCfgSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:784
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\isapnp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2748
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\isapnp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2016
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iScsiPrt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4020
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iScsiPrt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3184
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ItSas35i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2248
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ItSas35i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2032
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbdclass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:32
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbdclass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:272
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbdhid C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5000
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbdhid C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4928
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbldfltr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbldfltr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2800
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kdnic C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4840
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kdnic C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1704
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KeyIso C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2180
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KeyIso C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:464
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KSecDD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1560
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KSecDD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1716
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KSecPkg C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1500
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KSecPkg C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4192
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ksthunk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4652
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ksthunk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1780
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KtmRm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KtmRm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:420
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LanmanServer C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:560
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LanmanServer C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1504
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LanmanWorkstation C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2072
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LanmanWorkstation C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ldap C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:244
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ldap C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4972
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lfsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2380
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lfsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LicenseManager C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4876
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LicenseManager C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2596
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lltdio C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2096
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lltdio C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3564
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lltdsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3912
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lltdsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2300
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lmhosts C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4596
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lmhosts C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:988
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4752
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS2i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2160
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS2i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:892
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS3i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3956
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS3i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4816
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4792
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\luafv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4836
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\luafv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4848
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LxpSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LxpSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1340
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MapsBroker C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5096
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MapsBroker C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1972
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mausbhost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4496
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mausbhost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1528
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mausbip C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2924
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mausbip C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1112
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MbbCx C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MbbCx C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\McpManagementService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\McpManagementService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1880
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasas2i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasas2i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2044
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasas35i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasas35i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3672
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2888
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4212
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MessagingService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1508
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MessagingService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1464
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MessagingService_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3380
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MessagingService_1f799 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2660
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MicrosoftEdgeElevationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3660
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MicrosoftEdgeElevationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3632
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Microsoft_Bluetooth_AvrcpTransport C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1664
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Microsoft_Bluetooth_AvrcpTransport C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MixedRealityOpenXRSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2992
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MixedRealityOpenXRSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4196
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mlx4_bus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3600
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mlx4_bus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MMCSS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3696
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MMCSS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Modem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Modem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3940
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\monitor C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\monitor C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3900
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mouclass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2244
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mouclass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4728
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mouhid C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1548
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mouhid C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mountmgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:916
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mountmgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4564
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MozillaMaintenance C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3736
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MozillaMaintenance C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1076
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpi3drvi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1640
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpi3drvi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpsdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3212
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpsdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3528
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpssvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2176
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpssvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:784
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MRxDAV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2748
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MRxDAV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2016
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mrxsmb C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4020
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mrxsmb C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3184
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mrxsmb20 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2248
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mrxsmb20 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2032
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MsBridge C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:32
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MsBridge C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:272
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5000
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4928
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2800
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4744
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:240
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Msfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1044
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Msfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2632
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\msgpiowin32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3708
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\msgpiowin32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:644
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mshidkmdf C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4584
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mshidkmdf C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mshidumdf C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 2c42785f059fe30db95b10a87f8cb64a16abc3aa47cb655443bdec747244ec36
MD5 74e4a39ae145a98de20041613220dfed
SHA1 ac5dd2331ae591d7d361e8947e1a8fba2c6bea12
SHA512 96ba3135875b0fe7a07a3cf26ad86e0df438730c8f38df8f10138184dacd84b8e0cded7e3e84475d11057ceefe2e357136762b9c9452fbb938c094323c6b729b
TLSH
T1C571CC713375B0D889163F47192C5AC423BF8365F994AF4CB698624ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3695122fb2f029f013ca0c1433f94dc4066bcd136323249381ee87ff3c2e3236
MD5 82e9683e8bbeb4c139dc2abf6a478e95
SHA1 c96e2f7150ed977da71e002d3f88f4a19ae2ab0b
SHA512 733691050bf0ffe5886ba0d90c95202b1d22d885b6dba4284347e5a2816e3a1ef5700acacd85470e4444664eabc0a493467cfbb9739ee8b531768e5c2cf5635c
TLSH
T1E5215733B39CC125C8D9057A1089AD0075B4C7D7009ECE8BBB84C519E93F9AADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5a6c0f74e2c7aaddb1fb8863917d14a2844fd79c3060b9e5cda42aceab2e5b55
MD5 732b6688757d7c422bcaea4be6930844
SHA1 39b0d7196b5a7925a13f7157b8bf639ba1fc1813
SHA512 a6a073642bd4b51348e899892f41b79faca6a2f54a135086e671bfeca93a06ab4a3470d8b6937d398e983f4de70429e7bcd4133c33086852d56ea720a21019b9
TLSH
T196115333B79CC134C8E915BA1088AD11B1B1C3CB049EDE8B7A84C119E67F99AEB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ql2emd3x.vak.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ql2emd3x.vak.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-11-0x000001DA28140000-0x000001DA2814C000-memory.dmp

Download

memory/240-13-0x000001DA29A90000-0x000001DA29AA2000-memory.dmp

Download

memory/240-2-0x000001DA42090000-0x000001DA420B2000-memory.dmp

Download

memory/240-12-0x000001DA28190000-0x000001DA28198000-memory.dmp

Download

memory/1444-24-0x000002415D530000-0x000002415D538000-memory.dmp

Download

memory/1444-25-0x000002415DA90000-0x000002415DAA2000-memory.dmp

Download

memory/1444-23-0x000002415BC30000-0x000002415BC3C000-memory.dmp

Download

memory/2072-36-0x000001EB1AB50000-0x000001EB1AB58000-memory.dmp

Download

memory/2072-35-0x000001EB1AB30000-0x000001EB1AB42000-memory.dmp

Download

memory/2072-34-0x000001EB028E0000-0x000001EB028EC000-memory.dmp

Download

memory/5112-1-0x000002B15F440000-0x000002B15F4DE000-memory.dmp

Download