11e4ea92ce2465f3d30c5a56fd4aeba2aecaf4d1c2670ac42bd61c4db2becf87

Analysis

max time kernel
76s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
winPEAS.bat
Size 39KB
Sample260727-w9qbfayerg
SHA256 11e4ea92ce2465f3d30c5a56fd4aeba2aecaf4d1c2670ac42bd61c4db2becf87
MD5 bee84e4ad555fc6a97a344e0102a94b8
SHA1 1d3966afb3f5c75d428180d8cb15a5c47d4757dc
SHA512 3035288a321df8cfd67777f56ed28640340f36fc6a3b4d861c6d5fb3279aef3ab80e944acce24dc0727d71379852d093a61356c4e36aac15b8e195fb50181469
SSDEEP 768:THSAhDBRQ6u54v8VgqEkQVlB1Zmw6CMUM4LvfnCMOaHLhqghCPzr0Ih5I3TOx1Zn:7SAhDBRRu54v8iqTQVlB1Zmw6CMUM4Lm
TLSH
T16B03C68635141C1843F6E7B7AA414B8013B311B72D176ACE3ADD99BD9B2E1EE1B710CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5820	netsh.exe
5764	netsh.exe

Clipboard Data 1 TTPs 1 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
6044	powershell.exe

Modifies file permissions 1 TTPs 46 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1956	icacls.exe
1260	icacls.exe
3744	icacls.exe
5932	icacls.exe
2080	Process not Found
3708	icacls.exe
1160	icacls.exe
2224	icacls.exe
4236	icacls.exe
3216	icacls.exe
5604	icacls.exe
4972	icacls.exe
5332	icacls.exe
3536	icacls.exe
2612	Process not Found
2776	Process not Found
968	Process not Found
1128	icacls.exe
2408	icacls.exe
3492	icacls.exe
4076	icacls.exe
5996	icacls.exe
4372	icacls.exe
2308	icacls.exe
4524	Process not Found
3380	Process not Found
2624	Process not Found
2076	Process not Found
5032	Process not Found
4700	icacls.exe
1304	Process not Found
2388	icacls.exe
5480	icacls.exe
4368	icacls.exe
5060	icacls.exe
2776	icacls.exe
424	icacls.exe
4132	icacls.exe
900	icacls.exe
1980	icacls.exe
6032	icacls.exe
1160	icacls.exe
2412	Process not Found
4408	Process not Found
5908	Process not Found
3092	icacls.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4560	ARP.EXE

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5996	tasklist.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3640	Process not Found
2776	Process not Found
5344	Process not Found
612	Process not Found
5080	Process not Found
3160	Process not Found
2940	Process not Found
2216	Process not Found
2128	Process not Found
4856	Process not Found
1440	Process not Found
2632	Process not Found
5780	Process not Found
2412	Process not Found
2028	Process not Found
2568	Process not Found
1980	Process not Found
2112	Process not Found
2948	Process not Found
2864	Process not Found
1272	Process not Found
3144	Process not Found
1368	Process not Found
2832	Process not Found
1724	Process not Found
2128	Process not Found
4180	Process not Found
2752	Process not Found
1316	Process not Found
1168	Process not Found
2964	Process not Found
3156	Process not Found
2800	Process not Found
4904	Process not Found
1316	Process not Found
2180	Process not Found
5584	Process not Found
5376	Process not Found
4796	Process not Found
4968	Process not Found
2432	Process not Found
3556	Process not Found
2560	Process not Found
2432	Process not Found
1788	Process not Found
1980	Process not Found
5152	Process not Found
5136	Process not Found
3336	Process not Found
5072	Process not Found
4520	Process not Found
3060	Process not Found
5332	Process not Found
5032	Process not Found
4368	Process not Found
2568	Process not Found
2112	Process not Found
4860	Process not Found
804	Process not Found
4244	Process not Found
1404	Process not Found
3008	Process not Found
2996	Process not Found
688	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
692	Process not Found
4112	Process not Found
5248	Process not Found

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6124	Process not Found
3728	Process not Found
2944	Process not Found
4156	Process not Found
3484	Process not Found
4328	Process not Found
3688	Process not Found
292	Process not Found
2424	Process not Found
1492	Process not Found
916	Process not Found
1744	Process not Found
4904	Process not Found
1388	Process not Found
2208	Process not Found
4464	Process not Found
4276	Process not Found
1944	Process not Found
5080	Process not Found
4216	Process not Found
4840	Process not Found
4476	Process not Found
748	Process not Found
936	Process not Found
5808	Process not Found
4440	Process not Found
1508	Process not Found
1520	Process not Found
596	Process not Found
2036	Process not Found
1424	Process not Found
3292	Process not Found
6128	Process not Found
2676	Process not Found
1076	Process not Found
4636	Process not Found
2308	Process not Found
2060	Process not Found
5844	Process not Found
5972	Process not Found
1940	Process not Found
2476	Process not Found
1680	Process not Found
4552	Process not Found
4896	Process not Found
1604	Process not Found
5816	Process not Found
4756	Process not Found
3736	Process not Found
3448	cmd.exe
2448	Process not Found
4524	Process not Found
4800	Process not Found
2592	Process not Found
1756	Process not Found
1444	Process not Found
6020	Process not Found
2572	Process not Found
1704	cmd.exe
3188	cmd.exe
4992	Process not Found
1336	Process not Found
1316	Process not Found
5532	Process not Found

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4948	cmd.exe
4404	cmd.exe
6044	Process not Found
3336	Process not Found

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6084	cmd.exe
4816	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1320	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
1664	WMIC.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1796	ipconfig.exe
1320	NETSTAT.EXE
1828	ipconfig.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4268	systeminfo.exe
4496	systeminfo.exe

Modifies registry key 1 TTPs 11 IoCs

Modify Registry

T1112

pid	Process
5276	reg.exe
5884	Process not Found
3396	Process not Found
4356	Process not Found
4320	Process not Found
4696	reg.exe
3008	reg.exe
1248	reg.exe
2948	reg.exe
5584	reg.exe
1924	Process not Found

Runs net.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1304	WMIC.exe
1304	WMIC.exe
1304	WMIC.exe
1304	WMIC.exe
4500	WMIC.exe
4500	WMIC.exe
4500	WMIC.exe
4500	WMIC.exe
1664	WMIC.exe
1664	WMIC.exe
1664	WMIC.exe
1664	WMIC.exe
3164	WMIC.exe
3164	WMIC.exe
3164	WMIC.exe
3164	WMIC.exe
3164	WMIC.exe
5672	WMIC.exe
5672	WMIC.exe
5672	WMIC.exe
5672	WMIC.exe
6044	powershell.exe
6044	powershell.exe
1020	WMIC.exe
1020	WMIC.exe
1020	WMIC.exe
1020	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1304	WMIC.exe
Token: SeSecurityPrivilege	1304	WMIC.exe
Token: SeTakeOwnershipPrivilege	1304	WMIC.exe
Token: SeLoadDriverPrivilege	1304	WMIC.exe
Token: SeSystemProfilePrivilege	1304	WMIC.exe
Token: SeSystemtimePrivilege	1304	WMIC.exe
Token: SeProfSingleProcessPrivilege	1304	WMIC.exe
Token: SeIncBasePriorityPrivilege	1304	WMIC.exe
Token: SeCreatePagefilePrivilege	1304	WMIC.exe
Token: SeBackupPrivilege	1304	WMIC.exe
Token: SeRestorePrivilege	1304	WMIC.exe
Token: SeShutdownPrivilege	1304	WMIC.exe
Token: SeDebugPrivilege	1304	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1304	WMIC.exe
Token: SeRemoteShutdownPrivilege	1304	WMIC.exe
Token: SeUndockPrivilege	1304	WMIC.exe
Token: SeManageVolumePrivilege	1304	WMIC.exe
Token: 33	1304	WMIC.exe
Token: 34	1304	WMIC.exe
Token: 35	1304	WMIC.exe
Token: 36	1304	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1304	WMIC.exe
Token: SeSecurityPrivilege	1304	WMIC.exe
Token: SeTakeOwnershipPrivilege	1304	WMIC.exe
Token: SeLoadDriverPrivilege	1304	WMIC.exe
Token: SeSystemProfilePrivilege	1304	WMIC.exe
Token: SeSystemtimePrivilege	1304	WMIC.exe
Token: SeProfSingleProcessPrivilege	1304	WMIC.exe
Token: SeIncBasePriorityPrivilege	1304	WMIC.exe
Token: SeCreatePagefilePrivilege	1304	WMIC.exe
Token: SeBackupPrivilege	1304	WMIC.exe
Token: SeRestorePrivilege	1304	WMIC.exe
Token: SeShutdownPrivilege	1304	WMIC.exe
Token: SeDebugPrivilege	1304	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1304	WMIC.exe
Token: SeRemoteShutdownPrivilege	1304	WMIC.exe
Token: SeUndockPrivilege	1304	WMIC.exe
Token: SeManageVolumePrivilege	1304	WMIC.exe
Token: 33	1304	WMIC.exe
Token: 34	1304	WMIC.exe
Token: 35	1304	WMIC.exe
Token: 36	1304	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4500	WMIC.exe
Token: SeSecurityPrivilege	4500	WMIC.exe
Token: SeTakeOwnershipPrivilege	4500	WMIC.exe
Token: SeLoadDriverPrivilege	4500	WMIC.exe
Token: SeSystemProfilePrivilege	4500	WMIC.exe
Token: SeSystemtimePrivilege	4500	WMIC.exe
Token: SeProfSingleProcessPrivilege	4500	WMIC.exe
Token: SeIncBasePriorityPrivilege	4500	WMIC.exe
Token: SeCreatePagefilePrivilege	4500	WMIC.exe
Token: SeBackupPrivilege	4500	WMIC.exe
Token: SeRestorePrivilege	4500	WMIC.exe
Token: SeShutdownPrivilege	4500	WMIC.exe
Token: SeDebugPrivilege	4500	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4500	WMIC.exe
Token: SeRemoteShutdownPrivilege	4500	WMIC.exe
Token: SeUndockPrivilege	4500	WMIC.exe
Token: SeManageVolumePrivilege	4500	WMIC.exe
Token: 33	4500	WMIC.exe
Token: 34	4500	WMIC.exe
Token: 35	4500	WMIC.exe
Token: 36	4500	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4500	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 5568	4140	cmd.exe	90
PID 5568 wrote to memory of 5416	5568	cmd.exe	91
PID 5568 wrote to memory of 1308	5568	cmd.exe	92
PID 4140 wrote to memory of 4268	4140	cmd.exe	93
PID 4140 wrote to memory of 2788	4140	cmd.exe	96
PID 4140 wrote to memory of 1304	4140	cmd.exe	97
PID 4140 wrote to memory of 3448	4140	cmd.exe	98
PID 3448 wrote to memory of 4496	3448	cmd.exe	99
PID 4140 wrote to memory of 4520	4140	cmd.exe	100
PID 4140 wrote to memory of 4680	4140	cmd.exe	101
PID 4140 wrote to memory of 1320	4140	cmd.exe	102
PID 4140 wrote to memory of 3576	4140	cmd.exe	103
PID 4140 wrote to memory of 2768	4140	cmd.exe	104
PID 4140 wrote to memory of 5844	4140	cmd.exe	105
PID 4140 wrote to memory of 4628	4140	cmd.exe	106
PID 4140 wrote to memory of 3392	4140	cmd.exe	107
PID 4140 wrote to memory of 1676	4140	cmd.exe	108
PID 4140 wrote to memory of 2676	4140	cmd.exe	109
PID 4140 wrote to memory of 3172	4140	cmd.exe	110
PID 4140 wrote to memory of 4560	4140	cmd.exe	111
PID 4140 wrote to memory of 5808	4140	cmd.exe	112
PID 4140 wrote to memory of 4056	4140	cmd.exe	113
PID 4140 wrote to memory of 3852	4140	cmd.exe	114
PID 4140 wrote to memory of 1436	4140	cmd.exe	115
PID 4140 wrote to memory of 3940	4140	cmd.exe	116
PID 4140 wrote to memory of 1784	4140	cmd.exe	117
PID 4140 wrote to memory of 5728	4140	cmd.exe	118
PID 4140 wrote to memory of 5324	4140	cmd.exe	119
PID 4140 wrote to memory of 2688	4140	cmd.exe	120
PID 4140 wrote to memory of 3560	4140	cmd.exe	121
PID 4140 wrote to memory of 3064	4140	cmd.exe	122
PID 4140 wrote to memory of 4580	4140	cmd.exe	123
PID 4140 wrote to memory of 292	4140	cmd.exe	124
PID 4140 wrote to memory of 248	4140	cmd.exe	125
PID 4140 wrote to memory of 2080	4140	cmd.exe	126
PID 4140 wrote to memory of 3160	4140	cmd.exe	127
PID 4140 wrote to memory of 3004	4140	cmd.exe	128
PID 4140 wrote to memory of 5936	4140	cmd.exe	129
PID 4140 wrote to memory of 5256	4140	cmd.exe	130
PID 4140 wrote to memory of 4728	4140	cmd.exe	131
PID 4140 wrote to memory of 2076	4140	cmd.exe	132
PID 4140 wrote to memory of 1232	4140	cmd.exe	133
PID 4140 wrote to memory of 1376	4140	cmd.exe	134
PID 4140 wrote to memory of 4488	4140	cmd.exe	135
PID 4140 wrote to memory of 2560	4140	cmd.exe	136
PID 4140 wrote to memory of 2644	4140	cmd.exe	137
PID 4140 wrote to memory of 2188	4140	cmd.exe	138
PID 4140 wrote to memory of 6076	4140	cmd.exe	139
PID 4140 wrote to memory of 6080	4140	cmd.exe	140
PID 4140 wrote to memory of 8	4140	cmd.exe	141
PID 4140 wrote to memory of 4968	4140	cmd.exe	142
PID 4140 wrote to memory of 4396	4140	cmd.exe	143
PID 4140 wrote to memory of 6088	4140	cmd.exe	144
PID 4140 wrote to memory of 5576	4140	cmd.exe	145
PID 4140 wrote to memory of 6108	4140	cmd.exe	146
PID 4140 wrote to memory of 2296	4140	cmd.exe	147
PID 4140 wrote to memory of 3208	4140	cmd.exe	148
PID 4140 wrote to memory of 4484	4140	cmd.exe	149
PID 4140 wrote to memory of 2884	4140	cmd.exe	150
PID 4140 wrote to memory of 6008	4140	cmd.exe	151
PID 4140 wrote to memory of 6012	4140	cmd.exe	152
PID 4140 wrote to memory of 4088	4140	cmd.exe	153
PID 4140 wrote to memory of 596	4140	cmd.exe	154
PID 4140 wrote to memory of 6024	4140	cmd.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\winPEAS.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:5416
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1308
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:4268
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:2788
- C:\Windows\System32\Wbem\WMIC.exe
  wmic qfe get Caption,Description,HotFixID,InstalledOn
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c systeminfo
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."WELLSMITHPC " "
  2⤵
  PID:4520
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."WELLSMITHPC " "
  2⤵
  PID:1320
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Microsoft Windows 11 Enterprise LTSC " "
  2⤵
  PID:2768
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Microsoft Windows 11 Enterprise LTSC " "
  2⤵
  PID:4628
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."10.0.26100 N/A Build 26100 " "
  2⤵
  PID:1676
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."10.0.26100 N/A Build 26100 " "
  2⤵
  PID:3172
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Microsoft Corporation " "
  2⤵
  PID:5808
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Microsoft Corporation " "
  2⤵
  PID:3852
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Standalone Workstation " "
  2⤵
  PID:3940
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Standalone Workstation " "
  2⤵
  PID:5728
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Type: Multiprocessor Free " "
  2⤵
  PID:2688
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Type: Multiprocessor Free " "
  2⤵
  PID:3064
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."WellSmith " "
  2⤵
  PID:292
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."WellSmith " "
  2⤵
  PID:2080
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."N/A " "
  2⤵
  PID:3004
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."N/A " "
  2⤵
  PID:5256
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."00490-10000-00000-AA671 " "
  2⤵
  PID:2076
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."00490-10000-00000-AA671 " "
  2⤵
  PID:1376
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Date: 2/28/2025, 11:22:41 AM " "
  2⤵
  PID:2560
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Date: 2/28/2025, 11:22:41 AM " "
  2⤵
  PID:2188
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:6076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Time: 2/28/2025, 1:06:07 AM " "
  2⤵
  PID:6080
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Time: 2/28/2025, 1:06:07 AM " "
  2⤵
  PID:4968
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Gigabyte Technology Co., Ltd. " "
  2⤵
  PID:6088
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:5576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Gigabyte Technology Co., Ltd. " "
  2⤵
  PID:6108
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."B660M GAMING X DDR4 " "
  2⤵
  PID:3208
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."B660M GAMING X DDR4 " "
  2⤵
  PID:2884
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."x64-based PC " "
  2⤵
  PID:6012
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."x64-based PC " "
  2⤵
  PID:596
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Processor(s) Installed. " "
  2⤵
  PID:3332
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Processor(s) Installed. " "
  2⤵
  PID:4352
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Family 6 Model 151 Stepping 2 GenuineIntel" "
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4948
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Family 6 Model 151 Stepping 2 GenuineIntel" "
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4404
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:5496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."SeaBIOS rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org, 4/1/2014 " "
  2⤵
  PID:5740
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."SeaBIOS rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org, 4/1/2014 " "
  2⤵
  PID:900
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."C:\WINDOWS " "
  2⤵
  PID:3860
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."C:\WINDOWS " "
  2⤵
  PID:1604
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."C:\WINDOWS\system32 " "
  2⤵
  PID:1048
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."C:\WINDOWS\system32 " "
  2⤵
  PID:3236
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."\Device\HarddiskVolume1 " "
  2⤵
  PID:4716
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."\Device\HarddiskVolume1 " "
  2⤵
  PID:5876
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."en-us;English (United States) " "
  2⤵
  PID:5480
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."en-us;English (United States) " "
  2⤵
  PID:5660
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."en-us;English (United States) " "
  2⤵
  PID:4152
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."en-us;English (United States) " "
  2⤵
  PID:1260
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."(UTC+00:00) Dublin, Edinburgh, Lisbon, London " "
  2⤵
  PID:6140
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."(UTC+00:00) Dublin, Edinburgh, Lisbon, London " "
  2⤵
  PID:5892
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Memory: 16,154 MB " "
  2⤵
  PID:5144
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Memory: 16,154 MB " "
  2⤵
  PID:3396
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Memory: 14,110 MB " "
  2⤵
  PID:2952
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Memory: 14,110 MB " "
  2⤵
  PID:1832
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Max Size: 19,098 MB " "
  2⤵
  PID:3304
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Max Size: 19,098 MB " "
  2⤵
  PID:4996
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Available: 17,301 MB " "
  2⤵
  PID:5984
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Available: 17,301 MB " "
  2⤵
  PID:5072
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."In Use: 1,797 MB " "
  2⤵
  PID:4588
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."In Use: 1,797 MB " "
  2⤵
  PID:4564
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:5608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Location(s): C:\pagefile.sys " "
  2⤵
  PID:5512
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Location(s): C:\pagefile.sys " "
  2⤵
  PID:1336
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."\\OAGGWFQT " "
  2⤵
  PID:5584
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."\\OAGGWFQT " "
  2⤵
  PID:1860
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."1 NIC(s) Installed. " "
  2⤵
  PID:1444
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."1 NIC(s) Installed. " "
  2⤵
  PID:2632
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."RTL8139C+ Fast Ethernet NIC " "
  2⤵
  PID:6132
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."RTL8139C+ Fast Ethernet NIC " "
  2⤵
  PID:5344
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Ethernet " "
  2⤵
  PID:5124
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Ethernet " "
  2⤵
  PID:4848
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:1308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."No " "
  2⤵
  PID:2544
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."No " "
  2⤵
  PID:3120
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Status: Not enabled " "
  2⤵
  PID:3644
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Status: Not enabled " "
  2⤵
  PID:4080
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."for Business policy: Enforced " "
  2⤵
  PID:1648
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."for Business policy: Enforced " "
  2⤵
  PID:4792
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."for Business user mode policy: Audit " "
  2⤵
  PID:1344
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."for Business user mode policy: Audit " "
  2⤵
  PID:1796
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:4576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Enabled: " "
  2⤵
  PID:1320
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Enabled: " "
  2⤵
  PID:4680
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."VM Monitor Mode Extensions: Yes " "
  2⤵
  PID:3848
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."VM Monitor Mode Extensions: Yes " "
  2⤵
  PID:5140
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."In Firmware: Yes " "
  2⤵
  PID:4904
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."In Firmware: Yes " "
  2⤵
  PID:3620
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Address Translation: Yes " "
  2⤵
  PID:1708
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:3852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Address Translation: Yes " "
  2⤵
  PID:1644
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Prevention Available: Yes " "
  2⤵
  PID:5172
- C:\Windows\system32\findstr.exe
  findstr /i "2000 XP 2003 2008 vista"
  2⤵
  PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO."Prevention Available: Yes " "
  2⤵
  PID:1404
- C:\Windows\system32\findstr.exe
  findstr /i /C:"windows 7"
  2⤵
  PID:2688
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Audit
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager
  2⤵
  PID:1764
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft Services\AdmPwd" /v AdmPwdEnabled
  2⤵
  PID:124
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Policies\LAPS" /v BackupDirectory
  2⤵
  PID:2924
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\LAPS" /v BackupDirectory
  2⤵
  PID:2080
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA" /v RunAsPPL
  2⤵
  PID:4836
- C:\Windows\system32\reg.exe
  REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA" /v LsaCfgFlags
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential
  2⤵
  - Modifies registry key
  PID:4696
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v CACHEDLOGONSCOUNT
  2⤵
  PID:5256
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v EnableLUA
  2⤵
  PID:4812
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:2076
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths"
  2⤵
  PID:2644
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine /v PowerShellVersion
  2⤵
  PID:1084
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine /v PowerShellVersion
  2⤵
  PID:2876
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
  2⤵
  PID:2236
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging
  2⤵
  PID:6044
- C:\Windows\system32\reg.exe
  REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
  2⤵
  PID:4480
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:1492
- C:\Windows\System32\Wbem\WMIC.exe
  wmic logicaldisk get caption
  2⤵
  - Collects information from the system
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Program Files" "C:\Program Files (x86)" "
  2⤵
  PID:2932
- C:\Windows\system32\sort.exe
  sort
  2⤵
  PID:5476
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
  2⤵
  - Modifies registry key
  PID:3008
- C:\Windows\system32\findstr.exe
  findstr InstallLocation
  2⤵
  PID:3696
- C:\Windows\system32\findstr.exe
  findstr ":\\"
  2⤵
  PID:2884
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ /s
  2⤵
  - Modifies registry key
  PID:1248
- C:\Windows\system32\findstr.exe
  findstr InstallLocation
  2⤵
  PID:4644
- C:\Windows\system32\findstr.exe
  findstr ":\\"
  2⤵
  PID:3748
- C:\Windows\system32\reg.exe
  reg query HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\
  2⤵
  PID:3752
- C:\Windows\system32\findstr.exe
  findstr /i "wuserver"
  2⤵
  PID:2812
- C:\Windows\system32\findstr.exe
  findstr /i "http://"
  2⤵
  PID:4352
- C:\Windows\system32\tasklist.exe
  tasklist /SVC
  2⤵
  - Enumerates processes with tasklist
  PID:5996
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:5496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process list full |find /i "executablepath"|find /i /v "system32"|find ":"
  2⤵
  PID:3376
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process list full
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3164
- - C:\Windows\system32\find.exe
    find /i "executablepath"
    3⤵
    PID:2588
- - C:\Windows\system32\find.exe
    find /i /v "system32"
    3⤵
    PID:900
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
  2⤵
  PID:1952
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"
  2⤵
  - Modifies file permissions
  PID:1980
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:1048
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\explorer.exe
  2⤵
  PID:3248
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\explorer.exe"
  2⤵
  - Modifies file permissions
  PID:1128
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4716
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:3812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
  2⤵
  - Executes a command shell one-liner
  PID:1704
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"
  2⤵
  - Modifies file permissions
  PID:5480
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4076
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  2⤵
  PID:4248
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"
  2⤵
  - Modifies file permissions
  PID:3708
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4192
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:5340
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:4312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process list full |find /i "executablepath"|find /i /v "system32"|find ":"
  2⤵
  PID:2456
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process list full
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5672
- - C:\Windows\system32\find.exe
    find /i "executablepath"
    3⤵
    PID:5892
- - C:\Windows\system32\find.exe
    find /i /v "system32"
    3⤵
    PID:1340
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
  2⤵
  PID:4992
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Common Files\microsoft shared\ClickToRun\\"
  2⤵
  - Modifies file permissions
  PID:4368
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:2800
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:1832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\explorer.exe
  2⤵
  PID:3304
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\\"
  2⤵
  - Modifies file permissions
  PID:2408
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:5792
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:2840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
  2⤵
  PID:5984
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\\"
  2⤵
  - Modifies file permissions
  PID:3092
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4136
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:5072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ECHO.C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  2⤵
  PID:3404
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\"
  2⤵
  - Modifies file permissions
  PID:1160
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:5948
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:4564
- C:\Windows\system32\icacls.exe
  icacls "C:\Documents and Settings\All Users\Start Menu\Programs\Startup"
  2⤵
  - Modifies file permissions
  PID:5060
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:1392
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:5524
- C:\Windows\system32\icacls.exe
  icacls "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\*"
  2⤵
  - Modifies file permissions
  PID:2776
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:5584
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:2944
- C:\Windows\system32\icacls.exe
  icacls "C:\Documents and Settings\Admin\Start Menu\Programs\Startup"
  2⤵
  - Modifies file permissions
  PID:5604
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:4796
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:3288
- C:\Windows\system32\icacls.exe
  icacls "C:\Documents and Settings\Admin\Start Menu\Programs\Startup\*"
  2⤵
  - Modifies file permissions
  PID:4972
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:3816
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:3796
- C:\Windows\system32\icacls.exe
  icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
  2⤵
  - Modifies file permissions
  PID:5332
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:684
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:1424
- C:\Windows\system32\icacls.exe
  icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*"
  2⤵
  - Modifies file permissions
  PID:2388
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:3212
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:2836
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
  2⤵
  - Modifies file permissions
  PID:424
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:3120
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:2140
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*"
  2⤵
  - Modifies file permissions
  PID:4132
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\"
  2⤵
  PID:2180
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos Admin"
  2⤵
  PID:3476
- C:\Windows\system32\schtasks.exe
  schtasks /query /fo TABLE /nh
  2⤵
  PID:1648
- C:\Windows\system32\findstr.exe
  findstr /v /i "disable deshab informa")
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
  2⤵
  - Modifies registry key
  PID:5276
- C:\Windows\system32\reg.exe
  reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
  2⤵
  - Modifies registry key
  PID:2948
- C:\Windows\system32\net.exe
  net share
  2⤵
  PID:4204
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share
    3⤵
    PID:2864
- C:\Windows\system32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:1796
- C:\Windows\system32\NETSTAT.EXE
  netstat -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  PID:1320
- C:\Windows\system32\findstr.exe
  findstr /i listen
  2⤵
  PID:4616
- C:\Windows\system32\netsh.exe
  netsh firewall show state
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5820
- C:\Windows\system32\netsh.exe
  netsh firewall show config
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5764
- C:\Windows\system32\ARP.EXE
  arp -A
  2⤵
  - Network Service Discovery
  PID:4560
- C:\Windows\system32\ROUTE.EXE
  route print
  2⤵
  PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" type C:\WINDOWS\System32\drivers\etc\hosts "
  2⤵
  PID:5808
- C:\Windows\system32\findstr.exe
  findstr /v "^#"
  2⤵
  PID:3620
- C:\Windows\system32\ipconfig.exe
  ipconfig /displaydns
  2⤵
  - Gathers network information
  PID:1828
- C:\Windows\system32\findstr.exe
  findstr "Record"
  2⤵
  PID:5028
- C:\Windows\system32\findstr.exe
  findstr "Name Host"
  2⤵
  PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profiles | find "Profile "
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6084
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4816
- - C:\Windows\system32\find.exe
    find "Profile "
    3⤵
    PID:5172
- C:\Windows\system32\net.exe
  net user Admin
  2⤵
  PID:256
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Admin
    3⤵
    PID:292
- C:\Windows\system32\net.exe
  net user Admin /domain
  2⤵
  PID:3516
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Admin /domain
    3⤵
    PID:3160
- C:\Windows\system32\whoami.exe
  whoami /all
  2⤵
  PID:4836
- C:\Windows\system32\net.exe
  net user
  2⤵
  PID:4768
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:4728
- C:\Windows\system32\net.exe
  net localgroup
  2⤵
  PID:5956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup
    3⤵
    PID:3640
- C:\Windows\system32\net.exe
  net localgroup Administrators
  2⤵
  PID:1764
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators
    3⤵
    PID:4488
- C:\Windows\system32\net.exe
  net localgroup Administradores
  2⤵
  PID:1192
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administradores
    3⤵
    PID:2644
- C:\Windows\system32\quser.exe
  quser
  2⤵
  PID:6076
- C:\Windows\system32\klist.exe
  klist
  2⤵
  PID:6080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Get-Clipboard"
  2⤵
  - Clipboard Data
  - Suspicious behavior: EnumeratesProcesses
  PID:6044
- C:\Windows\system32\where.exe
  where wmic
  2⤵
  PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd.exe /c wmic service list full | findstr /i "pathname" |findstr /i /v "system32"
  2⤵
  PID:5476
- - C:\Windows\system32\cmd.exe
    cmd.exe /c wmic service list full
    3⤵
    - Executes a command shell one-liner
    PID:3188
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic service list full
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1020
- - C:\Windows\system32\findstr.exe
    findstr /i "pathname"
    3⤵
    PID:6008
- - C:\Windows\system32\findstr.exe
    findstr /i /v "system32"
    3⤵
    PID:4896
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"
  2⤵
  - Modifies file permissions
  PID:5996
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:1108
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:5052
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
  2⤵
  - Modifies file permissions
  PID:1956
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:2512
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:748
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"
  2⤵
  - Modifies file permissions
  PID:900
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:3860
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:5024
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe"
  2⤵
  - Modifies file permissions
  PID:4372
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:3328
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:5236
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
  2⤵
  - Modifies file permissions
  PID:3492
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4756
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:3556
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\updater.exe"
  2⤵
  - Modifies file permissions
  PID:4700
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:1704
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:700
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\updater.exe"
  2⤵
  - Modifies file permissions
  PID:4076
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:1032
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:4152
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
  2⤵
  - Modifies file permissions
  PID:1260
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:3708
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:3532
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
  2⤵
  - Modifies file permissions
  PID:2224
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4328
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:4336
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
  2⤵
  - Modifies file permissions
  PID:3216
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:2284
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:908
- C:\Windows\system32\icacls.exe
  icacls "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
  2⤵
  - Modifies file permissions
  PID:3744
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:1520
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:2952
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SysWow64\perfhost.exe"
  2⤵
  - Modifies file permissions
  PID:2308
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:2652
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:2800
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe"
  2⤵
  - Modifies file permissions
  PID:6032
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:4264
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:716
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\servicing\TrustedInstaller.exe"
  2⤵
  - Modifies file permissions
  PID:3536
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:3688
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:2572
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Windows Defender\NisSrv.exe"
  2⤵
  - Modifies file permissions
  PID:5932
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:2832
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:3404
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Windows Defender\MsMpEng.exe"
  2⤵
  - Modifies file permissions
  PID:1160
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:1168
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:1924
- C:\Windows\system32\icacls.exe
  icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe"
  2⤵
  - Modifies file permissions
  PID:4236
- C:\Windows\system32\findstr.exe
  findstr /i "(F) (M) (W) :\\"
  2⤵
  PID:1428
- C:\Windows\system32\findstr.exe
  findstr /i ":\\ everyone authenticated users todos usuarios Admin"
  2⤵
  PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query hklm\system\currentcontrolset\services
  2⤵
  PID:5260
- - C:\Windows\system32\reg.exe
    reg query hklm\system\currentcontrolset\services
    3⤵
    - Modifies registry key
    PID:5584
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1720
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2500
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5604
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3672
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NET C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5772
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NETFramework C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4260
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\.NETFramework C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5388
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\1394ohci C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2780
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\1394ohci C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4356
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\3ware C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4872
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\3ware C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4460
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AarSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1296
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AarSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2620
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AarSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1388
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AarSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ACPI C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:424
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ACPI C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5580
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpials C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6124
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpials C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1064
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AcpiDev C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3176
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AcpiDev C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4856
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpiex C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1304
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpiex C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4216
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpipagr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpipagr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:828
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AcpiPmi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1648
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AcpiPmi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4520
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpitime C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\acpitime C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3888
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Acx01000 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5484
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Acx01000 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5008
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ADOVMPPackage C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ADOVMPPackage C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1320
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ADP80XX C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2624
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ADP80XX C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\adsi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1516
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\adsi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5140
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AFD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2676
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AFD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5764
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\afunix C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5048
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\afunix C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3172
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ahcache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ahcache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4800
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ALG C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3620
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ALG C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1708
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdgpio2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5076
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdgpio2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1828
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdi2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1436
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdi2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AmdK8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3428
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AmdK8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AmdPPM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5172
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AmdPPM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:124
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdsata C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:292
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdsata C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdsbs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3004
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdsbs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2924
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdwps C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdwps C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4836
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdxata C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:936
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\amdxata C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4684
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppID C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1232
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppID C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4812
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppIDSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1088
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppIDSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4488
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Appinfo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5796
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Appinfo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppleSSD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2644
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppleSSD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2508
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\applockerfltr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6076
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\applockerfltr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3652
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppMgmt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2168
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppMgmt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppReadiness C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2424
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppReadiness C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4272
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppVClient C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1272
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppVClient C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2964
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvStrm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1664
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvStrm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:928
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvVemgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4484
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvVemgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1248
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvVfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5720
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppvVfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4664
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppXSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2856
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AppXSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3008
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ApxSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1076
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ApxSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6008
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\arcsas C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4896
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\arcsas C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:688
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AssignedAccessManagerSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5972
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AssignedAccessManagerSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5548
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AsyncMac C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5504
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AsyncMac C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2220
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\atapi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2668
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\atapi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AudioEndpointBuilder C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:748
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AudioEndpointBuilder C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5740
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Audiosrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5360
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Audiosrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\autotimesvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5024
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\autotimesvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3256
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AxInstSV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3292
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\AxInstSV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3328
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\b06bdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3812
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\b06bdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bam C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3000
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bam C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5248
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BasicDisplay C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4372
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BasicDisplay C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3904
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BasicRender C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2592
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BasicRender C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5804
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BattC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:700
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BattC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BcastDVRUserService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4248
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BcastDVRUserService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5452
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BcastDVRUserService_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4152
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BcastDVRUserService_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4192
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bcmfn2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5340
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bcmfn2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1260
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BDESVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3532
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BDESVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2956
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Beep C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1204
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Beep C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BFE C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5892
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BFE C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4540
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5204
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2284
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bindflt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2224
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bindflt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BITS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1980
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BITS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1520
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BluetoothUserService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5328
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BluetoothUserService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1832
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BluetoothUserService_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2704
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BluetoothUserService_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2308
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bowser C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5440
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bowser C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5988
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BrokerInfrastructure C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2408
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BrokerInfrastructure C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1540
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTAGService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6040
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTAGService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3564
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthA2dp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1332
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthA2dp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthAvctpSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3744
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthAvctpSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2476
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3788
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2832
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthHFEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5932
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthHFEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3388
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthLEEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4892
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthLEEnum C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1168
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthMini C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1160
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BthMini C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1860
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHMODEM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2092
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHMODEM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHPORT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHPORT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2056
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bthserv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2776
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bthserv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1720
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHUSB C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\BTHUSB C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2500
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bttflt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5604
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\bttflt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3672
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\buttonconverter C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5772
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\buttonconverter C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6096
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CAD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3816
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CAD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3776
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\camsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5416
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\camsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:684
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CaptureService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3356
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CaptureService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CaptureService_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5124
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CaptureService_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2052
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cbdhsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4460
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cbdhsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2388
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cbdhsvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6052
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cbdhsvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4100
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4544
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3120
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cdfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4340
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cdfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2448
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4792
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2752
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPUserSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CDPUserSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4784
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cdrom C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5276
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cdrom C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1560
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CertPropSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2124
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CertPropSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1344
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cht4iscsi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3576
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cht4iscsi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2636
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cht4vbd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5768
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cht4vbd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4360
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CimFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2824
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CimFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5084
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\circlass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1320
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\circlass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2624
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CldFlt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CldFlt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1516
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CLFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5140
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CLFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2676
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ClickToRunSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5764
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ClickToRunSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5048
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ClipSVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3172
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ClipSVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1476
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CloudBackupRestoreSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4800
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CloudBackupRestoreSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3620
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CloudBackupRestoreSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1708
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CloudBackupRestoreSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5076
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cloudidsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1828
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cloudidsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3560
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v2.0.50727_32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1404
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v2.0.50727_32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2688
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v2.0.50727_64 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3312
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v2.0.50727_64 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5728
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v4.0.30319_32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:248
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v4.0.30319_32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2060
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v4.0.30319_64 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2080
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\clr_optimization_v4.0.30319_64 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3160
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CmBatt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2912
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CmBatt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4180
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CNG C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5256
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CNG C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1028
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cnghwassist C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\cnghwassist C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2076
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CompositeBus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4456
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CompositeBus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6048
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\COMSysApp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5080
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\COMSysApp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2188
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\condrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1084
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\condrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5040
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ConsentUxUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6104
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ConsentUxUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:8
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ConsentUxUserSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2488
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ConsentUxUserSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6088
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CoreMessagingRegistrar C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CoreMessagingRegistrar C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4480
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CoreUI C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5824
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CoreUI C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2560
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2412
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2932
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CredentialEnrollmentManagerUserSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4644
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\crypt32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3336
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\crypt32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6100
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CryptSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3008
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CryptSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1076
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CSC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6008
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CSC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4896
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CscService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:688
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\CscService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5972
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dam C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5548
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dam C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5504
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DCLocator C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2220
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DCLocator C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2668
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DcomLaunch C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DcomLaunch C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:748
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dcsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5740
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dcsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5360
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\defragsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\defragsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5024
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationBrokerSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3256
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationBrokerSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3292
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationBrokerSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3328
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationBrokerSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4756
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceAssociationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:788
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceInstall C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1528
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DeviceInstall C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5660
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicePickerUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1704
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicePickerUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4700
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicePickerUserSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1440
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicePickerUserSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4276
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicesFlowUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:792
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicesFlowUserSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4076
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicesFlowUserSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1408
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevicesFlowUserSvc_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5424
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\devmap C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3684
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\devmap C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3708
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevQueryBroker C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3396
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DevQueryBroker C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1772
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dfsc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3156
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dfsc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1672
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dhcp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1900
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dhcp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3732
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\diagsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4888
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\diagsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1340
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DiagTrack C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:612
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DiagTrack C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1880
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DialogBlockingService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3200
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DialogBlockingService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2200
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\disk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4596
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\disk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4472
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DispBrokerDesktopSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:976
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DispBrokerDesktopSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5976
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DisplayEnhancementService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1468
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DisplayEnhancementService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DisplayMux C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6032
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DisplayMux C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2840
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DmEnrollmentSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4588
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DmEnrollmentSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4136
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dmvsc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4440
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dmvsc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3092
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dmwappushservice C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5072
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dmwappushservice C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3484
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dnscache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5512
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Dnscache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5608
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DoSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2112
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DoSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4564
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dot3svc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5884
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\dot3svc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1924
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DPS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6112
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DPS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4060
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\drmkaud C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5524
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\drmkaud C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DsmSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2944
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DsmSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3380
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DsSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2304
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DsSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DusmSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2632
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DusmSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DXGKrnl C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3892
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\DXGKrnl C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5348
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EapHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5352
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EapHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4536
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ebdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4260
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ebdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4064
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ebdrv0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5332
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ebdrv0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1424
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\edgeupdate C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3356
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\edgeupdate C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2612
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\edgeupdatem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2256
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\edgeupdatem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4972
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2836
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EFS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5252
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EhStorClass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4268
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EhStorClass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2380
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EhStorTcgDrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:424
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EhStorTcgDrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5580
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\embeddedmode C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6124
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\embeddedmode C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1064
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EntAppSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3176
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EntAppSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3476
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ErrDev C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2752
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ErrDev C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1680
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ESENT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4784
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ESENT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5276
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EventLog C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2124
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EventLog C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1344
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EventSystem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3576
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\EventSystem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1796
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ExecutionContext C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ExecutionContext C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4616
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\exfat C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4804
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\exfat C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4628
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fastfat C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3392
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fastfat C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1368
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fdc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5600
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fdc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5224
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fdPHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fdPHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4560
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FDResPub C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FDResPub C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2216
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fhsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5808
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fhsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3940
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FileCrypt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1644
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FileCrypt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3852
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FileInfo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5028
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FileInfo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3796
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Filetrace C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1636
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Filetrace C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\flpydisk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3428
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\flpydisk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FltMgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5172
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FltMgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:124
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FontCache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1756
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FontCache C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4580
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FontCache3.0.0.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2468
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FontCache3.0.0.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2924
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FrameServer C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FrameServer C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5256
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FrameServerMonitor C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1028
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FrameServerMonitor C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FsDepends C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2076
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FsDepends C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4456
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Fs_Rec C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6048
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Fs_Rec C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5080
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fvevol C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2188
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\fvevol C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1084
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GameInputSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5040
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GameInputSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2236
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\gencounter C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6080
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\gencounter C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5576
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\genericusbfn C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4968
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\genericusbfn C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2424
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GenPass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4272
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GenPass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1272
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleChromeElevationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2964
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleChromeElevationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1664
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleUpdaterInternalService141.0.7340.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3208
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleUpdaterInternalService141.0.7340.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4484
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleUpdaterService141.0.7340.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1248
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GoogleUpdaterService141.0.7340.0 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5720
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GPIOClx0101 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2884
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GPIOClx0101 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2208
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\gpsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2348
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\gpsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GraphicsPerfSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5496
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\GraphicsPerfSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5996
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HdAudAddService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2496
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HdAudAddService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:692
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HDAudBus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HDAudBus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2668
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidBatt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1956
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidBatt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:748
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidBth C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5740
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidBth C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5360
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidi2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidi2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5024
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidinterrupt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3256
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidinterrupt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3292
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidIr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3328
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidIr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidserv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3556
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidserv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3900
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidspi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3904
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hidspi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2592
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidSpiCx C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5804
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidSpiCx C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4252
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidUsb C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1940
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HidUsb C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4248
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HpSAMD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1944
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HpSAMD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4152
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Hsp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4192
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Hsp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5340
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HTTP C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1260
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HTTP C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3532
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hvcrash C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2956
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hvcrash C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1204
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HvHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HvHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5144
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hvservice C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3732
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hvservice C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4888
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HwNClx0101 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1340
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HwNClx0101 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:612
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hwpolicy C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1880
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hwpolicy C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3200
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hyperkbd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4368
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\hyperkbd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1832
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HyperVideo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2652
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\HyperVideo C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2800
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\I3CHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3728
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\I3CHost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5988
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\i8042prt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\i8042prt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:716
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iagpio C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6040
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iagpio C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3564
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iai2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1332
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iai2c C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3744
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2476
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_BXT_P C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5512
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_BXT_P C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5608
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_CNL C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2112
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_CNL C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4564
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_GLK C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5884
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_GPIO2_GLK C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1924
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6112
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4060
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_BXT_P C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5524
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_BXT_P C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_CNL C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2944
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_CNL C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3380
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_GLK C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2304
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSS2i_I2C_GLK C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSSi_GPIO C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2632
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSSi_GPIO C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSSi_I2C C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5384
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaLPSSi_I2C C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4228
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorAV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6096
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorAV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3816
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorAVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5388
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorAVC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5332
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1424
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iaStorV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5344
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ibbus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1308
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ibbus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1296
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\icssvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2388
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\icssvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6052
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IKEEXT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IKEEXT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4544
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IndirectKmd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3120
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IndirectKmd C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4340
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\inetaccs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2448
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\inetaccs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\InstallService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4132
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\InstallService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4792
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelide C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4400
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelide C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3080
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelpep C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelpep C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2600
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelpmax C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3020
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelpmax C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2864
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IntelPMT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2636
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IntelPMT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5768
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelppm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4360
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\intelppm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\InventorySvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3848
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\InventorySvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1320
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iorate C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2624
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iorate C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2988
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IpFilterDriver C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5600
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IpFilterDriver C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5224
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iphlpsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iphlpsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4560
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPMIDRV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3352
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPMIDRV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3748
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPNAT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2216
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPNAT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5808
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3940
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IPT C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1644
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IpxlatCfgSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1708
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\IpxlatCfgSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2672
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\isapnp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4828
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\isapnp C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1436
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iScsiPrt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5324
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\iScsiPrt C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ItSas35i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ItSas35i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3372
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbdclass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:240
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbdclass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2060
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbdhid C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2080
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbdhid C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3160
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbldfltr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5936
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kbldfltr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4180
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kdnic C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4728
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kdnic C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kdnic_legacy C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3060
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\kdnic_legacy C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4464
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KeyIso C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1312
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KeyIso C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1028
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KSecDD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4696
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KSecDD C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2076
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KSecPkg C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4456
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KSecPkg C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6048
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ksthunk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5080
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ksthunk C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2188
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KtmRm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1084
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\KtmRm C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5040
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LanmanServer C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2236
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LanmanServer C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6080
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LanmanWorkstation C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5576
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LanmanWorkstation C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4968
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ldap C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2424
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\ldap C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4272
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lfsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1272
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lfsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2964
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LicenseManager C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1664
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LicenseManager C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3208
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lltdio C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4484
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lltdio C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1248
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lltdsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5720
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lltdsvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2884
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lmhosts C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2208
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\lmhosts C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2348
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LocalKdc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1604
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LocalKdc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5496
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5996
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2496
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS2i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:692
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS2i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2220
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS3i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3164
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSI_SAS3i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1200
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5840
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LSM C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1952
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\luafv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3180
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\luafv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4944
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LxpSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1052
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\LxpSvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1048
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MapsBroker C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1176
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MapsBroker C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mausbhost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3492
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mausbhost C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5248
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mausbip C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1528
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mausbip C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5480
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MbbCx C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1724
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MbbCx C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4700
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\McpManagementService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:700
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\McpManagementService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4276
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasas2i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasas2i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4076
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasas35i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1408
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasas35i C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5424
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3684
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\megasr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4912
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MessagingService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3396
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MessagingService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1772
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MessagingService_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3156
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MessagingService_25ea8 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2616
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MicrosoftEdgeElevationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MicrosoftEdgeElevationService C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5144
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Microsoft_Bluetooth_AvrcpTransport C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3732
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Microsoft_Bluetooth_AvrcpTransport C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4888
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mlx4_bus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1340
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mlx4_bus C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:612
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MMCSS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1880
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MMCSS C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3200
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Modem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4368
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Modem C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1832
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\monitor C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2652
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\monitor C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2800
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mouclass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3728
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mouclass C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5988
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mouhid C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mouhid C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:716
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mountmgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:6040
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mountmgr C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3564
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MozillaMaintenance C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1332
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MozillaMaintenance C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpi3drvi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3744
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpi3drvi C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2476
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpsdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5512
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpsdrv C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5608
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpssvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2112
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mpssvc C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4564
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MRxDAV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5884
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MRxDAV C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1572
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mrxsmb C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1364
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mrxsmb C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mrxsmb20 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mrxsmb20 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5584
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MsBridge C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2776
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MsBridge C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4072
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2500
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3892
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5348
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5408
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\MSDTC C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3736
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Msfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:3776
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\Msfs C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5416
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\msgpiowin32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:684
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\msgpiowin32 C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4872
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mshidkmdf C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:5124
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mshidkmdf C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2256
- C:\Windows\system32\reg.exe
  reg save HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mshidumdf C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:4972
- C:\Windows\system32\reg.exe
  reg restore HKEY_LOCAL_MACHINE\system\currentcontrolset\services\mshidumdf C:\Users\Admin\AppData\Local\Temp\reg.hiv
  2⤵
  PID:2836

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv IsjrIAkA90ComR4brLRn8w.0.2
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dea234ed69b56a5ac20026ced884f4bb792af688a6a339fefb58f73068aaa846
MD5 705868f1da8dfb6bdcc2c97028a6df75
SHA1 0559741e798c1d22fffdf7b875373d94e6c798ae
SHA512 5f47468848b1ca69581fd73eec6fe6c5e600b11aa4fbffb514fa35c12f303d55abb81b1ef7fb4aea060ac2ea7997d91ff17a442ed06396f3c1198b0e2911d24a
TLSH
T103115733B3CC8724DC9A413650CEAC1136B687DB409ECE6BBB84D548B42F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9ecf454d8b55b7bc57249021d41b3bb8ae49c6db962c081c3fcfec87c41d5373
MD5 610f4038baf99b8ee9e40266597a6f8f
SHA1 7a3f9b3694b4dd63df5788b22183418f653cda19
SHA512 150d4cc311601c7bb6d9d7068471d9217791411ee172e5a14272e4034e2bdb8b82578dcf838e0a192e9abe5a573ff170870608e353e553d46383762188c14fa0
TLSH
T1C4215333F3CC8624C89A413A50CEAC1036B687DB419ECFABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e10c474c8a4c602158e1730028a90bea352eb22847ee9c225d283aa17c162ecc
MD5 e57203347bf50da1635e2e309f379959
SHA1 e2439cc6dd84fdb853d329a0f0af939401e60c9f
SHA512 761e4dea7dca6db1539c74523a714dd16edc2370c954f1ddad80b09ad86765e0da744ff807b17926103051abc411b98bc5db6311cf70e8ec1f20a97810b4bfe9
TLSH
T1BE215433B3CD8225D899403A50CEAC1036B597DB80DECE5BBB84D554F43F6A9CE606A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ahlpd5h1.tlg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ahlpd5h1.tlg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/692-7-0x00000211227C0000-0x00000211227CA000-memory.dmp

Download

memory/6044-2-0x00000245D82C0000-0x00000245D82E2000-memory.dmp

Download