6cb65fab613c2bd67aa7de55af45ae5a833256ea3dbedde39b5f592ccc336f6f

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tool.exe
Size 156KB
Sample260509-3kn6eahv8l
SHA256 6cb65fab613c2bd67aa7de55af45ae5a833256ea3dbedde39b5f592ccc336f6f
MD5 6ac252178ca45951ce89a5f30df1562c
SHA1 67a1ddc6a6f48195ce4ff9050b42365b762d96ae
SHA512 334aa26171e52649136137bf7e1633098e468062f5f60380ecd6d0f3fd3be6af012d0a39310531045c0d1a9f0600da6430a4e9666470e31741d03776240b6ac0
SSDEEP 3072:HxxrvsXgiPM3gDgPUvBST4EHBjxJ/zc9QlMb+TKwHwPARwqb3QVJQ:HxxrvsXgiPMwDgPUvBST4EHBjxJ/zc9T
TLSH
T1C1F31D4827FD2614F7FA5F76AA3559188A37BC259E22CA6D0125044D08FAFA4CD70F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1464	2524	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 3984	2524	Tool.exe	97
PID 2524 wrote to memory of 5888	2524	Tool.exe	99
PID 2524 wrote to memory of 5372	2524	Tool.exe	101
PID 2524 wrote to memory of 1228	2524	Tool.exe	103
PID 2524 wrote to memory of 412	2524	Tool.exe	105
PID 2524 wrote to memory of 2776	2524	Tool.exe	107
PID 2524 wrote to memory of 4444	2524	Tool.exe	109
PID 2524 wrote to memory of 1576	2524	Tool.exe	111
PID 2524 wrote to memory of 3188	2524	Tool.exe	113
PID 2524 wrote to memory of 2344	2524	Tool.exe	115
PID 2524 wrote to memory of 368	2524	Tool.exe	117
PID 2524 wrote to memory of 3324	2524	Tool.exe	119
PID 2524 wrote to memory of 1480	2524	Tool.exe	121
PID 2524 wrote to memory of 5188	2524	Tool.exe	123
PID 2524 wrote to memory of 3948	2524	Tool.exe	125
PID 2524 wrote to memory of 3392	2524	Tool.exe	127
PID 2524 wrote to memory of 5148	2524	Tool.exe	129
PID 2524 wrote to memory of 4708	2524	Tool.exe	131
PID 2524 wrote to memory of 5136	2524	Tool.exe	133
PID 2524 wrote to memory of 4336	2524	Tool.exe	135
PID 2524 wrote to memory of 1996	2524	Tool.exe	137
PID 2524 wrote to memory of 3036	2524	Tool.exe	139
PID 2524 wrote to memory of 5308	2524	Tool.exe	141
PID 2524 wrote to memory of 896	2524	Tool.exe	143
PID 2524 wrote to memory of 6020	2524	Tool.exe	145
PID 2524 wrote to memory of 540	2524	Tool.exe	147
PID 2524 wrote to memory of 1148	2524	Tool.exe	149
PID 2524 wrote to memory of 4872	2524	Tool.exe	151
PID 2524 wrote to memory of 4284	2524	Tool.exe	153
PID 2524 wrote to memory of 1188	2524	Tool.exe	155
PID 2524 wrote to memory of 1744	2524	Tool.exe	157
PID 2524 wrote to memory of 4232	2524	Tool.exe	159
PID 2524 wrote to memory of 2480	2524	Tool.exe	161
PID 2524 wrote to memory of 1564	2524	Tool.exe	163
PID 2524 wrote to memory of 5012	2524	Tool.exe	165
PID 2524 wrote to memory of 4712	2524	Tool.exe	167
PID 2524 wrote to memory of 4960	2524	Tool.exe	169
PID 2524 wrote to memory of 4632	2524	Tool.exe	171
PID 2524 wrote to memory of 4496	2524	Tool.exe	173
PID 2524 wrote to memory of 4936	2524	Tool.exe	175
PID 2524 wrote to memory of 4256	2524	Tool.exe	177
PID 2524 wrote to memory of 3640	2524	Tool.exe	179
PID 2524 wrote to memory of 4300	2524	Tool.exe	181
PID 2524 wrote to memory of 4672	2524	Tool.exe	183
PID 2524 wrote to memory of 4184	2524	Tool.exe	185
PID 2524 wrote to memory of 5248	2524	Tool.exe	187
PID 2524 wrote to memory of 5216	2524	Tool.exe	189
PID 2524 wrote to memory of 4992	2524	Tool.exe	191
PID 2524 wrote to memory of 3372	2524	Tool.exe	193
PID 2524 wrote to memory of 4432	2524	Tool.exe	195
PID 2524 wrote to memory of 5300	2524	Tool.exe	197
PID 2524 wrote to memory of 6104	2524	Tool.exe	199
PID 2524 wrote to memory of 2404	2524	Tool.exe	201
PID 2524 wrote to memory of 2640	2524	Tool.exe	203
PID 2524 wrote to memory of 1136	2524	Tool.exe	205
PID 2524 wrote to memory of 3804	2524	Tool.exe	207
PID 2524 wrote to memory of 3772	2524	Tool.exe	209
PID 2524 wrote to memory of 1812	2524	Tool.exe	211
PID 2524 wrote to memory of 5144	2524	Tool.exe	213
PID 2524 wrote to memory of 3760	2524	Tool.exe	215
PID 2524 wrote to memory of 3188	2524	Tool.exe	217
PID 2524 wrote to memory of 4156	2524	Tool.exe	219
PID 2524 wrote to memory of 4088	2524	Tool.exe	221
PID 2524 wrote to memory of 3704	2524	Tool.exe	223

C:\Users\Admin\AppData\Local\Temp\Tool.exe
"C:\Users\Admin\AppData\Local\Temp\Tool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableInstallerDetection" /t REG_DWORD /d 0 /f
  2⤵
  PID:5888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableSecureUIAPaths" /t REG_DWORD /d 0 /f
  2⤵
  PID:1228
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:412
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableUIADesktopToggle" /t REG_DWORD /d 0 /f
  2⤵
  PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ValidateAdminCodeSignatures" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.549981C3F5F10_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.BingNews_8wekyb3d8bbwe" /f
  2⤵
  PID:3188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ECApp_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.GetHelp_8wekyb3d8bbwe" /f
  2⤵
  PID:3324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Getstarted_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1480
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" /f
  2⤵
  PID:5188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftEdge_8wekyb3d8bbwe" /f
  2⤵
  PID:3948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe" /f
  2⤵
  PID:3392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\EdgeUpdate" /v "DoNotUpdateToEdgeWithChromium" /t REG_DWORD /d 1 /f
  2⤵
  PID:5148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe" /f
  2⤵
  PID:4708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.People_8wekyb3d8bbwe" /f
  2⤵
  PID:4336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe" /f
  2⤵
  PID:1996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Todos_8wekyb3d8bbwe" /f
  2⤵
  PID:3036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5308
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" /f
  2⤵
  PID:896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy" /f
  2⤵
  PID:6020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.Photos_8wekyb3d8bbwe" /f
  2⤵
  PID:540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy" /f
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsAlarms_8wekyb3d8bbwe" /f
  2⤵
  PID:4872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCamera_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsMaps_8wekyb3d8bbwe" /f
  2⤵
  PID:1744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe" /f
  2⤵
  PID:2480
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe" /f
  2⤵
  PID:1564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\microsoft.windowscommunicationsapps_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Advertising.Xaml_8wekyb3d8bbwe" /f
  2⤵
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe" /f
  2⤵
  PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MixedReality.Portal_8wekyb3d8bbwe" /f
  2⤵
  PID:4496
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MSPaint_8wekyb3d8bbwe" /f
  2⤵
  PID:4936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Paint_8wekyb3d8bbwe" /f
  2⤵
  PID:4256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsNotepad_8wekyb3d8bbwe" /f
  2⤵
  PID:3640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\clipchamp.clipchamp_yxz26nhyzhsrt" /f
  2⤵
  PID:4300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.SecHealthUI_8wekyb3d8bbwe" /f
  2⤵
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.WindowsCalculator_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\MicrosoftCorporationII.MicrosoftFamily_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Whiteboard_8wekyb3d8bbwe" /f
  2⤵
  PID:4992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\microsoft.microsoftskydrive_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftTeamsforSurfaceHub_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\MicrosoftCorporationII.MailforSurfaceHub_8wekyb3d8bbwe" /f
  2⤵
  PID:5300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftPowerBIForWindows_8wekyb3d8bbwe" /f
  2⤵
  PID:6104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.SkypeApp_kzf8qxf38zg5c" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.OneNote_8wekyb3d8bbwe" /f
  2⤵
  PID:1136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.Excel_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.PowerPoint_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Office.Word_8wekyb3d8bbwe" /f
  2⤵
  PID:1812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Windows.DevHome_8wekyb3d8bbwe" /f
  2⤵
  PID:5144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.OutlookForWindows_8wekyb3d8bbwe" /f
  2⤵
  PID:3760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\MSTeams_8wekyb3d8bbwe" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SYSTEM\ControlSet001\Control\CrashControl" /v "AutoReboot" /t REG_DWORD /d 0 /f
  2⤵
  PID:4156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SYSTEM\ControlSet001\Control\CrashControl" /v "CrashDumpEnabled" /t REG_DWORD /d 3 /f
  2⤵
  PID:4088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "LaunchTo" /t REG_DWORD /d 1 /f
  2⤵
  PID:3704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "ShowRecent" /t REG_DWORD /d 1 /f
  2⤵
  PID:5660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "ShowFrequent" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState" /v "FullPath" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 0 /f
  2⤵
  PID:4512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSyncProviderNotifications" /t REG_DWORD /d 0 /f
  2⤵
  PID:828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "MultipleInvokePromptMinimum" /t REG_DWORD /d 100 /f
  2⤵
  PID:2636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Winaero.com\Winaero Tweaker\Changes" /v "pageContextMenuSelectionLimit" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Control Panel\Desktop" /v "JPEGImportQuality" /t REG_DWORD /d 100 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Control Panel\Sound" /v "Beep" /t REG_SZ /d no /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "link" /t REG_BINARY /d 00000000 /f
  2⤵
  PID:876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\OperationStatusManager" /v "EnthusiastMode" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" /v "DisableAutoplay" /t REG_DWORD /d 1 /f
  2⤵
  PID:4004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoDriveTypeAutoRun" /t REG_DWORD /d 255 /f
  2⤵
  PID:540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SYSTEM\ControlSet001\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d 1500 /f
  2⤵
  PID:2216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableSearchBoxSuggestions" /t REG_DWORD /d 1 /f
  2⤵
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Feeds" /v "EnableFeeds" /t REG_DWORD /d 0 /f
  2⤵
  PID:2448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Dsh" /v "AllowNewsAndInterests" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d Off /f
  2⤵
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe" /v "Debugger" /t REG_SZ /d %windir%\System32\taskkill.exe /f
  2⤵
  PID:5504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AggregatorHost.exe" /v "Debugger" /t REG_SZ /d %windir%\System32\taskkill.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeviceCensus.exe" /v "Debugger" /t REG_SZ /d %windir%\System32\taskkill.exe /f
  2⤵
  PID:1652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FeatureLoader.exe" /v "Debugger" /t REG_SZ /d %windir%\System32\taskkill.exe /f
  2⤵
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BingChatInstaller.exe" /v "Debugger" /t REG_SZ /d %windir%\System32\taskkill.exe /f
  2⤵
  PID:3244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BGAUpsell.exe" /v "Debugger" /t REG_SZ /d %windir%\System32\taskkill.exe /f
  2⤵
  PID:2052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BCILauncher.exe" /v "Debugger" /t REG_SZ /d %windir%\System32\taskkill.exe /f
  2⤵
  PID:4776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 5 /f
  2⤵
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 5 /f
  2⤵
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fontdrvhost.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fontdrvhost.exe\PerfOptions" /v "IoPriority" /t REG_DWORD /d 0 /f
  2⤵
  PID:6060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sihost.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 1 /f
  2⤵
  PID:4924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sihost.exe\PerfOptions" /v "IoPriority" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 1 /f
  2⤵
  PID:3940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions" /v "IoPriority" /t REG_DWORD /d 0 /f
  2⤵
  PID:5616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\InfoDelivery\Restrictions" /v "NoUpdateCheck" /t REG_DWORD /d 1 /f
  2⤵
  PID:5924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\Main" /v "EnableAutoUpgrade" /t REG_DWORD /d 0 /f
  2⤵
  PID:4920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v "HomePage" /t REG_DWORD /d 1 /f
  2⤵
  PID:4068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Main" /v "Check_Associations" /t REG_SZ /d no /f
  2⤵
  PID:5328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_EUPP_GLOBAL_FORCE_DISABLE" /v "iexplore.exe" /t REG_DWORD /d 1 /f
  2⤵
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes" /v "DefaultScope" /t REG_SZ /d {0633EE93-D776-472f-A0FF-E1416B8B2E3A} /f
  2⤵
  PID:2484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d 1 /f
  2⤵
  PID:1128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d 1 /f
  2⤵
  PID:5124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" /v "NewTabPageShow" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" /v "NewTabPageShow" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Internet Explorer\MINIE" /v "ShowTabsBelowAddressBar" /t REG_DWORD /d 0 /f
  2⤵
  PID:1484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer" /v "NoSearchBox" /t REG_DWORD /d 1 /f
  2⤵
  PID:1984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer" /v "NoSearchBox" /t REG_DWORD /d 1 /f
  2⤵
  PID:620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions" /v "NoHelpItemSendFeedback" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Show_FullURL" /t REG_SZ /d yes /f
  2⤵
  PID:368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Play_Background_Sounds" /t REG_SZ /d no /f
  2⤵
  PID:3324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Suggested Sites" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Main" /v "HideNewEdgeButton" /t REG_DWORD /d 1 /f
  2⤵
  PID:3960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\Main" /v "HideNewEdgeButton" /t REG_DWORD /d 1 /f
  2⤵
  PID:3948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "TabShutdownDelay" /t REG_DWORD /d 0 /f
  2⤵
  PID:5264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\SQM" /v "DisableCustomerImprovementProgram" /t REG_DWORD /d 1 /f
  2⤵
  PID:6088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\SQM" /v "DisableCustomerImprovementProgram" /t REG_DWORD /d 1 /f
  2⤵
  PID:4708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer" /v "DisableFlashInIE" /t REG_DWORD /d 1 /f
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer" /v "DisableFlashInIE" /t REG_DWORD /d 1 /f
  2⤵
  PID:3112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Download" /v "RunInvalidSignatures" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Main" /v "DoNotTrack" /t REG_DWORD /d 1 /f
  2⤵
  PID:4428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\Main" /v "DoNotTrack" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Feed Discovery" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\Feed Discovery" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:5704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions" /v "NoCrashDetection" /t REG_DWORD /d 1 /f
  2⤵
  PID:3532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions" /v "NoCrashDetection" /t REG_DWORD /d 1 /f
  2⤵
  PID:1424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery" /v "AutoRecover" /t REG_DWORD /d 0 /f
  2⤵
  PID:4224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\Recovery" /v "AutoRecover" /t REG_DWORD /d 0 /f
  2⤵
  PID:5256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Internet Explorer\Recovery" /v "NoReopenLastSession" /t REG_DWORD /d 1 /f
  2⤵
  PID:5952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Microsoft\Internet Explorer\Recovery" /v "NoReopenLastSession" /t REG_DWORD /d 1 /f
  2⤵
  PID:5960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "DisablePasswordCaching" /t REG_DWORD /d 1 /f
  2⤵
  PID:5296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" /v "AllowServicePoweredQSA" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Explorer\AutoComplete" /v "AutoSuggest" /t REG_SZ /d no /f
  2⤵
  PID:5904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Geolocation" /v "PolicyDisableGeolocation" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation" /v "MSCompatibilityMode" /t REG_DWORD /d 0 /f
  2⤵
  PID:5652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\FlipAhead" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds" /v "BackgroundSyncStatus" /t REG_DWORD /d 0 /f
  2⤵
  PID:4644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\DomainSuggestion" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:3560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\DomainSuggestion" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:4248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Main" /v "Use FormSuggest" /t REG_SZ /d no /f
  2⤵
  PID:1388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Main" /v "FormSuggest Passwords" /t REG_SZ /d no /f
  2⤵
  PID:2796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Main" /v "FormSuggest PW Ask" /t REG_SZ /d no /f
  2⤵
  PID:1460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Privacy" /v "EnableInPrivateBrowsing" /t REG_DWORD /d 1 /f
  2⤵
  PID:5992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy" /v "EnableInPrivateBrowsing" /t REG_DWORD /d 1 /f
  2⤵
  PID:5844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache" /v "Persistent" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache" /v "Persistent" /t REG_DWORD /d 0 /f
  2⤵
  PID:396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SYSTEM\ControlSet001\Control\Session Manager\Kernel" /v "DisableTsx" /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\WindowsStore" /v "AutoDownload" /t REG_DWORD /d 4 /f
  2⤵
  PID:4948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKCU\Software\Policies\Microsoft\WindowsStore" /v "DisableOSUpgrade" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\WindowsStore" /v "DisableOSUpgrade" /t REG_DWORD /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v "NetworkThrottlingIndex" /t REG_DWORD /d 10 /f
  2⤵
  PID:1088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "HideOnlineAccountScreens" /t REG_DWORD /d "1" /f
  2⤵
  PID:1192
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "HideOnlineAccountScreens" /t REG_DWORD /d "1" /f
  2⤵
  PID:3808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "HideEULAPage" /t REG_DWORD /d "1" /f
  2⤵
  PID:3696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "HideEULAPage" /t REG_DWORD /d "1" /f
  2⤵
  PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "SkipMachineOOBE" /t REG_DWORD /d "0" /f
  2⤵
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "SkipMachineOOBE" /t REG_DWORD /d "0" /f
  2⤵
  PID:1576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "SkipUserOOBE" /t REG_DWORD /d "0" /f
  2⤵
  PID:708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "SkipUserOOBE" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "HideWirelessSetupInOOBE" /t REG_DWORD /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "HideWirelessSetupInOOBE" /t REG_DWORD /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "NetworkLocation" /t REG_SZ /d "Home" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "NetworkLocation" /t REG_SZ /d "Home" /f
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "ProtectYourPC" /t REG_DWORD /d "3" /f
  2⤵
  PID:5660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "ProtectYourPC" /t REG_DWORD /d "3" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "HideLocalAccountScreen" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "HideLocalAccountScreen" /t REG_DWORD /d "0" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "DisablePrivacyExperience" /t REG_DWORD /d "1" /f
  2⤵
  PID:624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "DisablePrivacyExperience" /t REG_DWORD /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "HideOEMRegistrationScreen" /t REG_DWORD /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "HideOEMRegistrationScreen" /t REG_DWORD /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "EnableCortanaVoice" /t REG_DWORD /d "0" /f
  2⤵
  PID:1572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "EnableCortanaVoice" /t REG_DWORD /d "0" /f
  2⤵
  PID:6120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" /v "DisableVoice" /t REG_DWORD /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE" /v "DisableVoice" /t REG_DWORD /d "1" /f
  2⤵
  PID:5080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\Software\Policies\Microsoft\Windows\System" /v "HiberbootEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SYSTEM\ControlSet001\Control\Session Manager\Power" /v "HiberbootEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FlyoutMenuSettings" /v "ShowHibernateOption" /t REG_DWORD /d "0" /f
  2⤵
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FlyoutMenuSettings" /v "ShowSleepOption" /t REG_DWORD /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ShutdownWithoutLogon" /t REG_DWORD /d "1" /f
  2⤵
  PID:6012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c C:\NSudoLC.exe -U:T -P:E -M:S reg add "HKLM\SYSTEM\ControlSet001\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 1304
  2⤵
  - Program crash
  PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2524 -ip 2524
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-0-0x00000000009F0000-0x0000000000A1E000-memory.dmp

Download

memory/2524-1-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/2524-3-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/2524-2-0x00000000051B0000-0x0000000005431000-memory.dmp

Download

memory/2524-5-0x00000000051B0000-0x0000000005431000-memory.dmp

Download

memory/2524-7-0x00000000051B0000-0x0000000005431000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads