eee5eeeab0f437a3f2a4f65da3fe38c17ccaa6fc398af3c36fb261c09c88b319

Analysis

user interaction
yes
max time kernel
148s
max time network
45s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EXM Free Tweaking Utility V9.1.cmd
Size 644KB
Sample260718-abyn9sdx4x
SHA256 eee5eeeab0f437a3f2a4f65da3fe38c17ccaa6fc398af3c36fb261c09c88b319
MD5 1364fa26b836330c99892ab01c712b1d
SHA1 2345d492557d4ebfff9397d360cb243ae0bfc4f5
SHA512 e401f860a3b1e8ac5d916b05777dfaf484cd2ae4514fdaadd0f33008642c4f4cbde26c9c5ef0e15c2921ab5bd7b72552153acc3449c7603c80b6a030a7fbed3a
SSDEEP 3072:SqrWMAw74szKs4R3EWMudb1WXLs6NnKOfziOew746bDENV:SqKdb1WXLs6NnKOfzvbDENV
TLSH
T125E4FB36B52A2332C69DAE106672DD2E6B766EC3E1304A40F4EF20C91F77481DC7A9D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution lateral_movement persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 7 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5932	bcdedit.exe
5284	bcdedit.exe
3060	bcdedit.exe
2564	bcdedit.exe
4380	bcdedit.exe
2036	bcdedit.exe
572	bcdedit.exe

Executes dropped EXE 1 IoCs

pid	Process
4180	MSI_Utility.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com
6	raw.githubusercontent.com
8	raw.githubusercontent.com
10	raw.githubusercontent.com
12	raw.githubusercontent.com
1	raw.githubusercontent.com

Maps connected drives based on registry 3 TTPs 12 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	reg.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance	reg.exe

Remote Services: SMB/Windows Admin Shares 1 TTPs 2 IoCs

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

lateral_movement

SMB/Windows Admin Shares

T1021.002

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\NullSessionPipes	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\NullSessionPipes	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3912	powershell.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4536	cmd.exe
4332	cmd.exe
4104	cmd.exe
5040	cmd.exe
2780	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2780	cmd.exe
4360	reg.exe
4284	reg.exe

Delays execution with timeout.exe 10 IoCs

defense_evasion

pid	Process
5504	timeout.exe
5752	timeout.exe
2420	timeout.exe
1000	timeout.exe
2184	timeout.exe
4916	timeout.exe
1924	timeout.exe
1176	timeout.exe
6020	timeout.exe
2724	timeout.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4580	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
4580	WMIC.exe
3912	powershell.exe
3912	powershell.exe
3912	powershell.exe
5020	powershell.exe
5020	powershell.exe
5460	powershell.exe
5460	powershell.exe
5460	powershell.exe
4256	powershell.exe
4256	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2056	SystemPropertiesPerformance.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4580	WMIC.exe
Token: SeSecurityPrivilege	4580	WMIC.exe
Token: SeTakeOwnershipPrivilege	4580	WMIC.exe
Token: SeLoadDriverPrivilege	4580	WMIC.exe
Token: SeSystemProfilePrivilege	4580	WMIC.exe
Token: SeSystemtimePrivilege	4580	WMIC.exe
Token: SeProfSingleProcessPrivilege	4580	WMIC.exe
Token: SeIncBasePriorityPrivilege	4580	WMIC.exe
Token: SeCreatePagefilePrivilege	4580	WMIC.exe
Token: SeBackupPrivilege	4580	WMIC.exe
Token: SeRestorePrivilege	4580	WMIC.exe
Token: SeShutdownPrivilege	4580	WMIC.exe
Token: SeDebugPrivilege	4580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4580	WMIC.exe
Token: SeRemoteShutdownPrivilege	4580	WMIC.exe
Token: SeUndockPrivilege	4580	WMIC.exe
Token: SeManageVolumePrivilege	4580	WMIC.exe
Token: 33	4580	WMIC.exe
Token: 34	4580	WMIC.exe
Token: 35	4580	WMIC.exe
Token: 36	4580	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4580	WMIC.exe
Token: SeSecurityPrivilege	4580	WMIC.exe
Token: SeTakeOwnershipPrivilege	4580	WMIC.exe
Token: SeLoadDriverPrivilege	4580	WMIC.exe
Token: SeSystemProfilePrivilege	4580	WMIC.exe
Token: SeSystemtimePrivilege	4580	WMIC.exe
Token: SeProfSingleProcessPrivilege	4580	WMIC.exe
Token: SeIncBasePriorityPrivilege	4580	WMIC.exe
Token: SeCreatePagefilePrivilege	4580	WMIC.exe
Token: SeBackupPrivilege	4580	WMIC.exe
Token: SeRestorePrivilege	4580	WMIC.exe
Token: SeShutdownPrivilege	4580	WMIC.exe
Token: SeDebugPrivilege	4580	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4580	WMIC.exe
Token: SeRemoteShutdownPrivilege	4580	WMIC.exe
Token: SeUndockPrivilege	4580	WMIC.exe
Token: SeManageVolumePrivilege	4580	WMIC.exe
Token: 33	4580	WMIC.exe
Token: 34	4580	WMIC.exe
Token: 35	4580	WMIC.exe
Token: 36	4580	WMIC.exe
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	5460	powershell.exe
Token: SeSecurityPrivilege	4148	auditpol.exe
Token: SeSecurityPrivilege	1332	auditpol.exe
Token: SeSecurityPrivilege	4888	auditpol.exe
Token: SeSecurityPrivilege	2288	auditpol.exe
Token: SeSecurityPrivilege	8	auditpol.exe
Token: SeSecurityPrivilege	4844	auditpol.exe
Token: SeSecurityPrivilege	2468	auditpol.exe
Token: SeSecurityPrivilege	5504	auditpol.exe
Token: SeSecurityPrivilege	2176	auditpol.exe
Token: SeDebugPrivilege	4256	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4332	4536	cmd.exe	90
PID 4332 wrote to memory of 4892	4332	cmd.exe	92
PID 4332 wrote to memory of 4104	4332	cmd.exe	93
PID 4104 wrote to memory of 4580	4104	cmd.exe	94
PID 4104 wrote to memory of 2548	4104	cmd.exe	95
PID 4332 wrote to memory of 1548	4332	cmd.exe	97
PID 4332 wrote to memory of 3912	4332	cmd.exe	98
PID 4332 wrote to memory of 2776	4332	cmd.exe	100
PID 4332 wrote to memory of 5300	4332	cmd.exe	101
PID 4332 wrote to memory of 4432	4332	cmd.exe	102
PID 4332 wrote to memory of 5180	4332	cmd.exe	103
PID 4332 wrote to memory of 1000	4332	cmd.exe	104
PID 4332 wrote to memory of 2724	4332	cmd.exe	105
PID 4332 wrote to memory of 5464	4332	cmd.exe	106
PID 4332 wrote to memory of 5020	4332	cmd.exe	107
PID 4332 wrote to memory of 1332	4332	cmd.exe	108
PID 4332 wrote to memory of 2216	4332	cmd.exe	109
PID 4332 wrote to memory of 5928	4332	cmd.exe	110
PID 4332 wrote to memory of 5656	4332	cmd.exe	111
PID 4332 wrote to memory of 5504	4332	cmd.exe	112
PID 4332 wrote to memory of 3340	4332	cmd.exe	113
PID 4332 wrote to memory of 3248	4332	cmd.exe	114
PID 4332 wrote to memory of 2340	4332	cmd.exe	116
PID 4332 wrote to memory of 2184	4332	cmd.exe	117
PID 4332 wrote to memory of 2132	4332	cmd.exe	118
PID 4332 wrote to memory of 2956	4332	cmd.exe	119
PID 4332 wrote to memory of 4996	4332	cmd.exe	120
PID 4332 wrote to memory of 4916	4332	cmd.exe	121
PID 4332 wrote to memory of 6020	4332	cmd.exe	122
PID 4332 wrote to memory of 4976	4332	cmd.exe	123
PID 4332 wrote to memory of 2996	4332	cmd.exe	124
PID 4332 wrote to memory of 5752	4332	cmd.exe	125
PID 4332 wrote to memory of 5556	4332	cmd.exe	126
PID 4332 wrote to memory of 552	4332	cmd.exe	127
PID 4332 wrote to memory of 2796	4332	cmd.exe	128
PID 4332 wrote to memory of 1924	4332	cmd.exe	129
PID 4332 wrote to memory of 1260	4332	cmd.exe	130
PID 4332 wrote to memory of 5768	4332	cmd.exe	131
PID 4332 wrote to memory of 2420	4332	cmd.exe	132
PID 4332 wrote to memory of 5460	4332	cmd.exe	133
PID 4332 wrote to memory of 676	4332	cmd.exe	134
PID 4332 wrote to memory of 4388	4332	cmd.exe	135
PID 4332 wrote to memory of 5932	4332	cmd.exe	136
PID 4332 wrote to memory of 5284	4332	cmd.exe	137
PID 4332 wrote to memory of 3060	4332	cmd.exe	138
PID 4332 wrote to memory of 4956	4332	cmd.exe	139
PID 4332 wrote to memory of 3804	4332	cmd.exe	140
PID 4332 wrote to memory of 1456	4332	cmd.exe	141
PID 4332 wrote to memory of 6004	4332	cmd.exe	142
PID 4332 wrote to memory of 3408	4332	cmd.exe	143
PID 4332 wrote to memory of 4128	4332	cmd.exe	144
PID 4332 wrote to memory of 4980	4332	cmd.exe	145
PID 4332 wrote to memory of 3464	4332	cmd.exe	146
PID 4332 wrote to memory of 3632	4332	cmd.exe	147
PID 4332 wrote to memory of 204	4332	cmd.exe	148
PID 4332 wrote to memory of 5824	4332	cmd.exe	149
PID 4332 wrote to memory of 4584	4332	cmd.exe	150
PID 4332 wrote to memory of 5640	4332	cmd.exe	151
PID 4332 wrote to memory of 5544	4332	cmd.exe	152
PID 4332 wrote to memory of 5332	4332	cmd.exe	153
PID 4332 wrote to memory of 5612	4332	cmd.exe	154
PID 4332 wrote to memory of 5616	4332	cmd.exe	155
PID 4332 wrote to memory of 5936	4332	cmd.exe	156
PID 4332 wrote to memory of 4268	4332	cmd.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\EXM Free Tweaking Utility V9.1.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\system32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\EXM Free Tweaking Utility V9.1.cmd" max
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
    3⤵
    PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_UserAccount where name="Admin" get sid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4580
  - - C:\Windows\system32\findstr.exe
      findstr "S-"
      4⤵
      PID:2548
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile Enable-ComputerRestore -Drive 'C:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- - C:\Windows\system32\reg.exe
    Reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
    3⤵
    PID:2776
- - C:\Windows\system32\reg.exe
    Reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
    3⤵
    PID:5300
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
    3⤵
    PID:4432
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5180
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1000
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2724
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Resources Not found or out of date, Press "OK" To download them', 'Exm Tweaking Utility', 'Ok', [System.Windows.Forms.MessageBoxIcon]::Information);}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1332
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2216
- - C:\Windows\system32\curl.exe
    curl -g -k -L -# -o "C:\exm\Exm_Free_Power_Plan_V7.pow" "https://raw.githubusercontent.com/exm4L/9.1-resources/refs/heads/main/EXM_Free_Power_Plan_V7.pow"
    3⤵
    PID:5928
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5656
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:5504
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3340
- - C:\Windows\system32\curl.exe
    curl -g -k -L -# -o "C:\exm\Autoruns.exe" "https://raw.githubusercontent.com/exm4L/9.1-resources/refs/heads/main/Autoruns.exe"
    3⤵
    PID:3248
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2340
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2184
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:2132
- - C:\Windows\system32\curl.exe
    curl -g -k -L -# -o "C:\exm\Nvidia_Porfile_Inspector_2.4.0.19.exe" "https://raw.githubusercontent.com/exm4L/9.1-resources/refs/heads/main/Nvidia_Porfile_Inspector_2.4.0.19.exe"
    3⤵
    PID:2956
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4996
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4916
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:6020
- - C:\Windows\system32\curl.exe
    curl -g -k -L -# -o "C:\exm\EXM_Free_NVPI_V7.nip" "https://raw.githubusercontent.com/exm4L/9.1-resources/refs/heads/main/EXM_Free_NVPI_V7.nip"
    3⤵
    PID:4976
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2996
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:5752
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5556
- - C:\Windows\system32\curl.exe
    curl -g -k -L -# -o "C:\exm\Windows_Update_Blocker.exe" "https://raw.githubusercontent.com/exm4L/9.1-resources/refs/heads/main/Windows_Update_Blocker.exe"
    3⤵
    PID:552
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2796
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1924
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:1260
- - C:\Windows\system32\curl.exe
    curl -g -k -L -# -o "C:\exm\MSI_Utility.exe" "https://raw.githubusercontent.com/exm4L/9.1-resources/refs/heads/main/MSI_Utility.exe"
    3⤵
    PID:5768
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Downloaded resources successfully, Press "OK" To continue to the menu', 'Exm Tweaking Utility', 'Ok', [System.Windows.Forms.MessageBoxIcon]::Information);}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5460
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:676
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4388
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set Disabledynamictick yes
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5932
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue useplatformclock
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5284
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set useplatformtick yes
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3060
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Low Latency" /v "Affinity" /t REG_DWORD /d "0" /f
    3⤵
    PID:4956
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Low Latency" /v "Background Only" /t REG_SZ /d "False" /f
    3⤵
    PID:3804
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Low Latency" /v "BackgroundPriority" /t REG_DWORD /d "0" /f
    3⤵
    PID:1456
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Low Latency" /v "Clock Rate" /t REG_DWORD /d "10000" /f
    3⤵
    PID:6004
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Low Latency" /v "GPU Priority" /t REG_DWORD /d "8" /f
    3⤵
    PID:3408
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Low Latency" /v "Priority" /t REG_DWORD /d "2" /f
    3⤵
    PID:4128
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Low Latency" /v "Scheduling Category" /t REG_SZ /d "Medium" /f
    3⤵
    PID:4980
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Low Latency" /v "SFIO Priority" /t REG_SZ /d "High" /f
    3⤵
    PID:3464
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Low Latency" /v "Latency Sensitive" /t REG_SZ /d "True" /f
    3⤵
    PID:3632
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Affinity" /t REG_DWORD /d "0" /f
    3⤵
    PID:204
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Background Only" /t REG_SZ /d "False" /f
    3⤵
    PID:5824
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "BackgroundPriority" /t REG_DWORD /d "0" /f
    3⤵
    PID:4584
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Clock Rate" /t REG_DWORD /d "10000" /f
    3⤵
    PID:5640
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "GPU Priority" /t REG_DWORD /d "8" /f
    3⤵
    PID:5544
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Priority" /t REG_DWORD /d "2" /f
    3⤵
    PID:5332
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Scheduling Category" /t REG_SZ /d "High" /f
    3⤵
    PID:5612
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "SFIO Priority" /t REG_SZ /d "High" /f
    3⤵
    PID:5616
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Latency Sensitive" /t REG_SZ /d "True" /f
    3⤵
    PID:5936
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "Win32PrioritySeparation" /t REG_DWORD /d "38" /f
    3⤵
    PID:4268
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Control Panel\Desktop" /v "AutoEndTasks" /t REG_SZ /d "1" /f
    3⤵
    PID:2104
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Control Panel\Desktop" /v "HungAppTimeout" /t REG_SZ /d "1000" /f
    3⤵
    PID:5428
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Control Panel\Desktop" /v "WaitToKillAppTimeout" /t REG_SZ /d "1000" /f
    3⤵
    PID:5980
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Control Panel\Desktop" /v "LowLevelHooksTimeout" /t REG_SZ /d "1000" /f
    3⤵
    PID:3128
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "0" /f
    3⤵
    PID:4248
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "1000" /f
    3⤵
    PID:3180
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability" /v "TimeStampInterval" /t REG_DWORD /d "1" /f
    3⤵
    PID:2900
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability" /v "IoPriority" /t REG_DWORD /d "3" /f
    3⤵
    PID:5996
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set configaccesspolicy Default
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2564
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set MSI Default
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4380
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set usephysicaldestination No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2036
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set usefirmwarepcisettings No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:572
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v "MonitorLatencyTolerance" /t REG_DWORD /d "1" /f
    3⤵
    PID:364
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /v "MonitorRefreshLatencyTolerance" /t REG_DWORD /d "1" /f
    3⤵
    PID:4344
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "ExitLatency" /t REG_DWORD /d "1" /f
    3⤵
    PID:5560
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "ExitLatencyCheckEnabled" /t REG_DWORD /d "1" /f
    3⤵
    PID:4416
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "Latency" /t REG_DWORD /d "1" /f
    3⤵
    PID:1276
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyToleranceDefault" /t REG_DWORD /d "1" /f
    3⤵
    PID:1536
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyToleranceFSVP" /t REG_DWORD /d "1" /f
    3⤵
    PID:5052
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyTolerancePerfOverride" /t REG_DWORD /d "1" /f
    3⤵
    PID:4140
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyToleranceScreenOffIR" /t REG_DWORD /d "1" /f
    3⤵
    PID:4544
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "LatencyToleranceVSyncEnabled" /t REG_DWORD /d "1" /f
    3⤵
    PID:5924
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "RtlCapabilityCheckLatency" /t REG_DWORD /d "1" /f
    3⤵
    PID:3912
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyActivelyUsed" /t REG_DWORD /d "1" /f
    3⤵
    PID:2776
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleLongTime" /t REG_DWORD /d "1" /f
    3⤵
    PID:828
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleMonitorOff" /t REG_DWORD /d "1" /f
    3⤵
    PID:1740
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleNoContext" /t REG_DWORD /d "1" /f
    3⤵
    PID:5180
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleShortTime" /t REG_DWORD /d "1" /f
    3⤵
    PID:2964
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultD3TransitionLatencyIdleVeryLongTime" /t REG_DWORD /d "1" /f
    3⤵
    PID:2972
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle0" /t REG_DWORD /d "1" /f
    3⤵
    PID:5064
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle0MonitorOff" /t REG_DWORD /d "1" /f
    3⤵
    PID:1320
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle1" /t REG_DWORD /d "1" /f
    3⤵
    PID:2108
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceIdle1MonitorOff" /t REG_DWORD /d "1" /f
    3⤵
    PID:1000
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceMemory" /t REG_DWORD /d "1" /f
    3⤵
    PID:3528
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceNoContext" /t REG_DWORD /d "1" /f
    3⤵
    PID:4816
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceNoContextMonitorOff" /t REG_DWORD /d "1" /f
    3⤵
    PID:1080
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceOther" /t REG_DWORD /d "1" /f
    3⤵
    PID:6008
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultLatencyToleranceTimerPeriod" /t REG_DWORD /d "1" /f
    3⤵
    PID:5776
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultMemoryRefreshLatencyToleranceActivelyUsed" /t REG_DWORD /d "1" /f
    3⤵
    PID:4848
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultMemoryRefreshLatencyToleranceMonitorOff" /t REG_DWORD /d "1" /f
    3⤵
    PID:756
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "DefaultMemoryRefreshLatencyToleranceNoContext" /t REG_DWORD /d "1" /f
    3⤵
    PID:4284
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "Latency" /t REG_DWORD /d "1" /f
    3⤵
    PID:1176
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MaxIAverageGraphicsLatencyInOneBucket" /t REG_DWORD /d "1" /f
    3⤵
    PID:5868
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MiracastPerfTrackGraphicsLatency" /t REG_DWORD /d "1" /f
    3⤵
    PID:5700
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MonitorLatencyTolerance" /t REG_DWORD /d "1" /f
    3⤵
    PID:4124
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "MonitorRefreshLatencyTolerance" /t REG_DWORD /d "1" /f
    3⤵
    PID:2044
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "TransitionLatency" /t REG_DWORD /d "1" /f
    3⤵
    PID:2284
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Biometrics" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:3220
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v "SystemResponsiveness" /t REG_DWORD /d "0" /f
    3⤵
    PID:4208
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "BingSearchEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:2480
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\InputPersonalization" /v "RestrictImplicitInkCollection" /t REG_DWORD /d "1" /f
    3⤵
    PID:4408
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\InputPersonalization" /v "RestrictImplicitTextCollection" /t REG_DWORD /d "1" /f
    3⤵
    PID:4968
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\Personalization\Settings" /v "AcceptedPrivacyPolicy" /t REG_DWORD /d "0" /f
    3⤵
    PID:4784
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "CortanaCapabilities" /t REG_SZ /d "" /f
    3⤵
    PID:5316
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "IsAssignedAccess" /t REG_DWORD /d "0" /f
    3⤵
    PID:5136
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "IsWindowsHelloActive" /t REG_DWORD /d "0" /f
    3⤵
    PID:1212
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowSearchToUseLocation" /t REG_DWORD /d 0 /f
    3⤵
    PID:4856
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchPrivacy" /t REG_DWORD /d 3 /f
    3⤵
    PID:2832
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchSafeSearch" /t REG_DWORD /d 3 /f
    3⤵
    PID:3976
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchUseWeb" /t REG_DWORD /d 0 /f
    3⤵
    PID:3732
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchUseWebOverMeteredConnections" /t REG_DWORD /d 0 /f
    3⤵
    PID:3444
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Microsoft\PolicyManager\default\Experience\AllowCortana" /v "value" /t REG_DWORD /d "0" /f
    3⤵
    PID:2724
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\SearchCompanion" /v "DisableContentFileUpdates" /t REG_DWORD /d "1" /f
    3⤵
    PID:3144
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v "AllowCloudSearch" /t REG_DWORD /d "0" /f
    3⤵
    PID:5592
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v "AllowCortanaAboveLock" /t REG_DWORD /d "0" /f
    3⤵
    PID:5912
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v "AllowSearchToUseLocation" /t REG_DWORD /d "0" /f
    3⤵
    PID:1500
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchPrivacy" /t REG_DWORD /d "3" /f
    3⤵
    PID:5072
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchUseWeb" /t REG_DWORD /d "0" /f
    3⤵
    PID:1704
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v "ConnectedSearchUseWebOverMeteredConnections" /t REG_DWORD /d "0" /f
    3⤵
    PID:4364
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v "DisableWebSearch" /t REG_DWORD /d "1" /f
    3⤵
    PID:4700
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\Windows Search" /v "DoNotUseWebResults" /t REG_DWORD /d "1" /f
    3⤵
    PID:2824
- - C:\Windows\system32\auditpol.exe
    Auditpol /set /subcategory:"Process Termination" /failure:Disable /failure:Enable
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- - C:\Windows\system32\auditpol.exe
    Auditpol /set /subcategory:"RPC Events" /failure:Disable /failure:Enable
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- - C:\Windows\system32\auditpol.exe
    Auditpol /set /subcategory:"Filtering Platform Connection" /failure:Disable /failure:Enable
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- - C:\Windows\system32\auditpol.exe
    Auditpol /set /subcategory:"DPAPI Activity" /failure:Disable /failure:Disable
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- - C:\Windows\system32\auditpol.exe
    Auditpol /set /subcategory:"IPsec Driver" /success: /failure:Enable
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- - C:\Windows\system32\auditpol.exe
    Auditpol /set /subcategory:"Other System Events" /failure:Disable /failure:Enable
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- - C:\Windows\system32\auditpol.exe
    Auditpol /set /subcategory:"Security State Change" /failure:Disable /failure:Enable
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- - C:\Windows\system32\auditpol.exe
    Auditpol /set /subcategory:"Security System Extension" /failure:Disable /failure:Enable
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5504
- - C:\Windows\system32\auditpol.exe
    Auditpol /set /subcategory:"System Integrity" /failure:Disable /failure:Enable
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:400
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DiagLog" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:2084
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\Diagtrack-Listener" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:1044
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\WiFiSession" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:1808
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\System" /v "AllowExperimentation" /t REG_DWORD /d "0" /f
    3⤵
    PID:3248
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\System\AllowExperimentation" /v "value" /t REG_DWORD /d "0" /f
    3⤵
    PID:6052
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Feeds" /v "EnableFeeds" /t REG_DWORD /d "0" /f
    3⤵
    PID:2184
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft" /v "AllowNewsAndInterests" /t REG_DWORD /d "0" /f
    3⤵
    PID:2892
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /t REG_DWORD /d "0" /f
    3⤵
    PID:5600
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Control Panel\International\User Profile" /v "HttpAcceptLanguageOptOut" /t REG_DWORD /d "1" /f
    3⤵
    PID:4424
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:5872
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /t REG_DWORD /d "0" /f
    3⤵
    PID:4756
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v "MaintenanceDisabled" /t REG_DWORD /d "1" /f
    3⤵
    PID:3120
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:4996
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v "NOC_GLOBAL_SETTING_ALLOW_NOTIFICATION_SOUND" /t REG_DWORD /d "0" /f
    3⤵
    PID:6060
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v "NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS_ABOVE_LOCK" /t REG_DWORD /d "0" /f
    3⤵
    PID:5196
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\QuietHours" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:6020
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\windows.immersivecontrolpanel_cw5n1h2txyewymicrosoft.windows.immersivecontrolpanel" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:1932
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.AutoPlay" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:5028
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.LowDisk" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:1096
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.Print.Notification" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:4976
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:3660
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.WiFiNetworkManager" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:3112
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f
    3⤵
    PID:5556
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CDP" /v "CdpSessionUserAuthzPolicy" /t REG_DWORD /d "0" /f
    3⤵
    PID:5236
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CDP" /v "NearShareChannelUserAuthzPolicy" /t REG_DWORD /d "0" /f
    3⤵
    PID:1840
- - C:\Windows\system32\reg.exe
    reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync" /v "SyncPolicy" /t Reg_DWORD /d "5" /f
    3⤵
    PID:1696
- - C:\Windows\system32\reg.exe
    reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Accessibility" /v "Enabled" /t Reg_DWORD /d "0" /f
    3⤵
    PID:552
- - C:\Windows\system32\reg.exe
    reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\AppSync" /v "Enabled" /t Reg_DWORD /d "0" /f
    3⤵
    PID:3604
- - C:\Windows\system32\reg.exe
    reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\BrowserSettings" /v "Enabled" /t Reg_DWORD /d "0" /f
    3⤵
    PID:1204
- - C:\Windows\system32\reg.exe
    reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Credentials" /v "Enabled" /t Reg_DWORD /d ""0"" /f
    3⤵
    PID:2372
- - C:\Windows\system32\reg.exe
    reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\DesktopTheme" /v "Enabled" /t Reg_DWORD /d "0" /f
    3⤵
    PID:264
- - C:\Windows\system32\reg.exe
    reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Language" /v "Enabled" /t Reg_DWORD /d "0" /f
    3⤵
    PID:2508
- - C:\Windows\system32\reg.exe
    reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\PackageState" /v "Enabled" /t Reg_DWORD /d "0" /f
    3⤵
    PID:1900
- - C:\Windows\system32\reg.exe
    reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Personalization" /v "Enabled" /t Reg_DWORD /d "0" /f
    3⤵
    PID:4708
- - C:\Windows\system32\reg.exe
    reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\StartLayout" /v "Enabled" /t Reg_DWORD /d "0" /f
    3⤵
    PID:5768
- - C:\Windows\system32\reg.exe
    reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Windows" /v "Enabled" /t Reg_DWORD /d "0" /f
    3⤵
    PID:4648
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableSettingSync" /t Reg_DWORD /d "2" /f
    3⤵
    PID:4532
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableSettingSyncUserOverride" /t Reg_DWORD /d "1" /f
    3⤵
    PID:2248
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableAppSyncSettingSync" /t Reg_DWORD /d "2" /f
    3⤵
    PID:1152
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableAppSyncSettingSyncUserOverride" /t Reg_DWORD /d "1" /f
    3⤵
    PID:3308
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableApplicationSettingSync" /t Reg_DWORD /d "2" /f
    3⤵
    PID:988
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableApplicationSettingSyncUserOverride" /t Reg_DWORD /d "1" /f
    3⤵
    PID:5460
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableCredentialsSettingSync" /t Reg_DWORD /d "2" /f
    3⤵
    PID:2660
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableCredentialsSettingSyncUserOverride" /t Reg_DWORD /d "2" /f
    3⤵
    PID:1132
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableDesktopThemeSettingSync" /t Reg_DWORD /d "2" /f
    3⤵
    PID:4508
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableDesktopThemeSettingSyncUserOverride" /t Reg_DWORD /d "2" /f
    3⤵
    PID:5884
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisablePersonalizationSettingSync" /t Reg_DWORD /d "2" /f
    3⤵
    PID:800
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisablePersonalizationSettingSyncUserOverride" /t Reg_DWORD /d "2" /f
    3⤵
    PID:1168
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableStartLayoutSettingSync" /t Reg_DWORD /d "2" /f
    3⤵
    PID:4412
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableStartLayoutSettingSyncUserOverride" /t Reg_DWORD /d "2" /f
    3⤵
    PID:700
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableSyncOnPaidNetwork" /t Reg_DWORD /d "2" /f
    3⤵
    PID:1036
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableWebBrowserSettingSync" /t Reg_DWORD /d "2" /f
    3⤵
    PID:6140
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableWebBrowserSettingSyncUserOverride" /t Reg_DWORD /d "2" /f
    3⤵
    PID:1192
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableWindowsSettingSync" /t Reg_DWORD /d "2" /f
    3⤵
    PID:3432
- - C:\Windows\system32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\SettingSync" /v "DisableWindowsSettingSyncUserOverride" /t Reg_DWORD /d "2" /f
    3⤵
    PID:5968
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:4348
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:5836
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OemPreInstalledAppsEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:4164
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d "0" /f
    3⤵
    PID:2120
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContentEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:5640
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:5544
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKU\S-1-5-21-1875162379-3804078649-638427191-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications" /v "GlobalUserDisabled" /t REG_DWORD /d "1" /f
    3⤵
    PID:5332
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKU\S-1-5-21-1875162379-3804078649-638427191-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v "BackgroundAppGlobalToggle" /t REG_DWORD /d "0" /f
    3⤵
    PID:5612
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\bam" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:5616
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\dam" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:5936
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "EnableTransparency" /t REG_DWORD /d "0" /f
    3⤵
    PID:4268
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\AppCompat" /v "AITEnable" /t REG_DWORD /d "0" /f
    3⤵
    PID:5428
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\AppCompat" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
    3⤵
    PID:5980
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\AppCompat" /v "DisableInventory" /t REG_DWORD /d "1" /f
    3⤵
    PID:3128
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\AppCompat" /v "DisableUAR" /t REG_DWORD /d "1" /f
    3⤵
    PID:4248
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\AppCompat" /v "DisableEngine" /t REG_DWORD /d "1" /f
    3⤵
    PID:3180
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\AppCompat" /v "DisablePCA" /t REG_DWORD /d "1" /f
    3⤵
    PID:2900
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Privacy" /v "TailoredExperiencesWithDiagnosticDataEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:5996
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack" /v "ShowedToastAtLevel" /t REG_DWORD /d "1" /f
    3⤵
    PID:2564
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Input\TIPC" /v "Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:4380
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\System" /v "UploadUserActivities" /t REG_DWORD /d "0" /f
    3⤵
    PID:2036
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\System" /v "PublishUserActivities" /t REG_DWORD /d "0" /f
    3⤵
    PID:572
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKEY_CURRENT_USER\Control Panel\International\User Profile" /v "HttpAcceptLanguageOptOut" /t REG_DWORD /d "1" /f
    3⤵
    PID:364
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "1" /f
    3⤵
    PID:4344
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\System\CurrentControlSet\Control\Diagnostics\Performance" /v "DisablediagnosticTracing" /t REG_DWORD /d "1" /f
    3⤵
    PID:5560
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d}" /v "ScenarioExecutionEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:4416
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /Disable
    3⤵
    PID:1276
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"
    3⤵
    PID:4640
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable
    3⤵
    PID:4140
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver"
    3⤵
    PID:4704
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /Disable
    3⤵
    PID:1760
- - C:\Windows\system32\schtasks.exe
    schtasks /end /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"
    3⤵
    PID:2776
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /Disable
    3⤵
    PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SYSTEM\CurrentControlSet\Services" /S /F "IoLatencyCap"| FINDSTR /V "IoLatencyCap"
    3⤵
    - Executes a command shell one-liner
    PID:5040
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SYSTEM\CurrentControlSet\Services" /S /F "IoLatencyCap"
      4⤵
      Maps connected drives based on registry
      Remote Services: SMB/Windows Admin Shares
      PID:1504
  - - C:\Windows\system32\findstr.exe
      FINDSTR /V "IoLatencyCap"
      4⤵
      PID:2540
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStorAVC\Parameters" /F /V "IoLatencyCap" /T REG_DWORD /d 0
    3⤵
    PID:3244
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storahci\Parameters" /F /V "IoLatencyCap" /T REG_DWORD /d 0
    3⤵
    PID:3000
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DmaGuard\DeviceEnumerationPolicy" /v "value" /t REG_DWORD /d "2" /f
    3⤵
    PID:3512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible | find /i "Services\"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2780
  - - C:\Windows\system32\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible
      4⤵
      Maps connected drives based on registry
      Remote Services: SMB/Windows Admin Shares
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4360
  - - C:\Windows\system32\find.exe
      find /i "Services\"
      4⤵
      PID:5776
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\devmap\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4284
- - C:\Windows\system32\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1176
- - C:\Windows\system32\SystemPropertiesPerformance.exe
    C:\Windows\system32\SystemPropertiesPerformance.exe
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2056
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SYSTEM\GameConfigStore" /v "GameDVR_DSEBehavior" /t REG_DWORD /d "0" /f
    3⤵
    PID:1128
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SYSTEM\GameConfigStore" /v "GameDVR_FSEBehaviorMode" /t REG_DWORD /d "0" /f
    3⤵
    PID:3412
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SYSTEM\GameConfigStore" /v "GameDVR_EFSEFeatureFlags" /t REG_DWORD /d "0" /f
    3⤵
    PID:1068
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SYSTEM\GameConfigStore" /v "GameDVR_DXGIHonorFSEWindowsCompatible" /t REG_DWORD /d "0" /f
    3⤵
    PID:5736
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SYSTEM\GameConfigStore" /v "GameDVR_HonorUserFSEBehaviorMode" /t REG_DWORD /d "1" /f
    3⤵
    PID:4492
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings" /t REG_SZ /d "VRROptimizeEnable=0;SwapEffectUpgradeEnable=1;" /f
    3⤵
    PID:4304
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v "OverlayTestMode" /f
    3⤵
    PID:5688
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\GameBar" /v "AllowAutoGameMode" /t REG_DWORD /d "1" /f
    3⤵
    PID:5676
- - C:\Windows\system32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\Microsoft\GameBar" /v "AutoGameModeEnabled" /t REG_DWORD /d "1" /f
    3⤵
    PID:5048
- - C:\exm\MSI_Utility.exe
    C:\exm\MSI_Utility.exe
    3⤵
    - Executes dropped EXE
    PID:4180
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:984
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:5168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "& {Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Do NOT do these if your pc has bad overheating issues', 'Exm Tweaking Utility', 'Ok', [System.Windows.Forms.MessageBoxIcon]::Information);}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:6020
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Services

T1021

SMB/Windows Admin Shares

T1021.002

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1dc014ae71bae56db839e125468e8d693a4b569e68debde951499621335b231b
MD5 5d8e0f70203fde6a1430f5b5c28e8cee
SHA1 cc3bc878e3c3418129061f50682478671a88039d
SHA512 ca7b18fff985b25b949a5af89dec6fea6ae7582ab2cb174e61d8cc5376bfa8501df6ffa535e37a93950d2b114395d18ba2575caeef7b09dc18da9e0ee5de17de
TLSH
T14F215773F3CD8615D899403A50CEAC1036B597DB40DECE5BAB84D549B43F599CEA05A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fe59d0ee3b4849c10fd850a2ca80c709ae0343c083324603d9704efd98a6c593
MD5 8bb2f8e0e2723cbb4c59cc4e4b61c91b
SHA1 59b6f4c701ce2605daa2f38ee5e0eb92612768df
SHA512 b9a9707939408e8c95b2b539467125645b29a19f743ea6ace2e649d1b1b2740477861bf07691370eca8b973e8046390a7ec4f04e4d9c6cc62b81baa6e6d07813
TLSH
T19C115733B3CC8624C89A403650CEAC1137B587DB90DEDF6BBB84D149B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xzgd1zaa.pqt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xzgd1zaa.pqt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MSI_Utility.exe

Path C:\exm\MSI_Utility.exe
Size 45KB
SHA256 695800afad96f858a3f291b7df21c16649528f13d39b63fb7c233e5676c8df6f
MD5 6c748415c350f14fd5b78fa5c37173a5
SHA1 332d64f5885a738d6ce968172b79b1101303cb5b
SHA512 c53c5d8ab355d950ae27022dc79f168def1aaeeb64398a553bb96f73d5f1c4df2e085b977a3c558329979b86f99a940fa94e33e671c9dcc5cd7a1310d2eb7461
SSDEEP 768:1AthLhXIHo+tMCXCBU4copfP4xSwpPO0zsU9RXMJmiuofnC8+d:2kztMCSBU4copwVXz9dMYKfz+d
TLSH
T1D1234B0177DD4B3BE1FE0AB85472100507B2F5BA6531FBCE5D9960DE5CA3B808A61B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3912-2-0x000002C1FC820000-0x000002C1FC842000-memory.dmp

Download

memory/4180-22-0x0000021A63F50000-0x0000021A63F62000-memory.dmp

Download

memory/4180-23-0x0000021A7F0E0000-0x0000021A7F2AA000-memory.dmp

Download