6d1a039eea136eb21a708e0dfc5e5aa866b1bcd407777337b84fe7ecd278cc1f

Analysis

user interaction
yes
max time kernel
5s
max time network
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
StripesOS_10_Home_SL_Clean (1).bat
Size 74KB
Sample260816-1pg7jsx1ev
SHA256 6d1a039eea136eb21a708e0dfc5e5aa866b1bcd407777337b84fe7ecd278cc1f
MD5 0581f02b5ebde960b0f27359e915c5b7
SHA1 16111ce260254a9fecaeb225002a34c15cb5c025
SHA512 e81f9ac8fdbec3b010fe053d3a67a9c2dff21ea8d8eaab76d0c33673d64545bae07c4e6bd436b3996676c6326d8f72d33d660b91898f701530713a117ab18f8c
SSDEEP 768:E4oqQsspqdaj8IN4Ey9QYM9i37nzjGszDaKBKfwgCI5G5zzmsVPVWIG3bI9:Zgf9i37npKfER
TLSH
T148731D2638154D6BD941F594EAAB4C52FBB663835C827BE0E6C7204C34BB707823ADDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution exploit persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 15 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5988	bcdedit.exe
4628	bcdedit.exe
3736	bcdedit.exe
1216	bcdedit.exe
4812	bcdedit.exe
3840	bcdedit.exe
412	bcdedit.exe
3660	bcdedit.exe
2300	bcdedit.exe
3912	bcdedit.exe
1412	bcdedit.exe
5980	bcdedit.exe
2872	bcdedit.exe
5312	bcdedit.exe
2680	bcdedit.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1364	takeown.exe
2556	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2556	icacls.exe
1364	takeown.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3012	powershell.exe
3920	powershell.exe
3008	powershell.exe

Power Settings 1 TTPs 10 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1472	powercfg.exe
4808	powercfg.exe
2096	reg.exe
3844	reg.exe
5920	powercfg.exe
2536	cmd.exe
5344	powercfg.exe
3192	powercfg.exe
4132	powercfg.exe
2308	powercfg.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3144	sc.exe
5336	sc.exe
1840	sc.exe
4324	sc.exe
3940	sc.exe
5932	sc.exe
2788	sc.exe
1840	sc.exe
5660	sc.exe
1364	sc.exe
3516	sc.exe
3960	sc.exe
1092	sc.exe
2996	sc.exe
1072	sc.exe
4264	sc.exe
200	sc.exe
3472	sc.exe
5964	sc.exe
5992	sc.exe
5028	sc.exe
4936	sc.exe
5312	sc.exe
1504	sc.exe
1048	sc.exe
3600	sc.exe
4324	sc.exe
2360	sc.exe
4932	sc.exe
2296	sc.exe
2732	sc.exe
4812	sc.exe
1756	sc.exe
5592	sc.exe
5320	sc.exe
6088	sc.exe
4336	sc.exe
524	sc.exe
4240	sc.exe
1640	sc.exe
2964	sc.exe
3212	sc.exe
1500	sc.exe
3976	sc.exe
2164	sc.exe
3844	sc.exe
3392	sc.exe
4156	sc.exe
5680	sc.exe
4208	sc.exe
1340	sc.exe
4704	sc.exe
1968	sc.exe
2536	sc.exe
1496	sc.exe
4524	sc.exe
4512	sc.exe
1664	sc.exe
5344	sc.exe
5884	sc.exe
3292	sc.exe
4872	sc.exe
420	sc.exe
4828	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5652	cmd.exe
2804	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 13 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1072	reg.exe
3184	reg.exe
2532	reg.exe
2144	reg.exe
1364	reg.exe
5784	reg.exe
5992	reg.exe
5024	reg.exe
5976	reg.exe
2744	reg.exe
2448	reg.exe
4772	reg.exe
3116	reg.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4336	timeout.exe
4976	timeout.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5988	ipconfig.exe
1816	ipconfig.exe
3552	ipconfig.exe
3732	ipconfig.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
4308	taskkill.exe
1376	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3440	2804	cmd.exe	244
PID 2804 wrote to memory of 4336	2804	cmd.exe	816
PID 2804 wrote to memory of 240	2804	cmd.exe	563
PID 2804 wrote to memory of 300	2804	cmd.exe	93
PID 2804 wrote to memory of 1968	2804	cmd.exe	617
PID 2804 wrote to memory of 2260	2804	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\StripesOS_10_Home_SL_Clean (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\system32\mode.com
  mode con: cols=120 lines=35
  2⤵
  PID:3440
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4336
- C:\Windows\system32\sc.exe
  sc config AarSvc start=disabled
  2⤵
  PID:240
- C:\Windows\system32\sc.exe
  sc config ADPSvc start=disabled
  2⤵
  PID:300
- C:\Windows\system32\sc.exe
  sc config AJRouter start=disabled
  2⤵
  - Launches sc.exe
  PID:1968
- C:\Windows\system32\sc.exe
  sc config ALG start=disabled
  2⤵
  PID:2260
- C:\Windows\system32\sc.exe
  sc config AppMgmt start=disabled
  2⤵
  PID:3516
- C:\Windows\system32\sc.exe
  sc config AppInfo start=demand
  2⤵
  - Launches sc.exe
  PID:4932
- C:\Windows\system32\sc.exe
  sc config AppReadiness start=disabled
  2⤵
  PID:2532
- C:\Windows\system32\sc.exe
  sc config AssignedAccessManagerSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:420
- C:\Windows\system32\sc.exe
  sc config autotimesvc start=disabled
  2⤵
  - Launches sc.exe
  PID:5884
- C:\Windows\system32\sc.exe
  sc config AxInstSV start=disabled
  2⤵
  - Launches sc.exe
  PID:3292
- C:\Windows\system32\sc.exe
  sc config BcastDVRUserService start=disabled
  2⤵
  PID:2400
- C:\Windows\system32\sc.exe
  sc config BDESVC start=disabled
  2⤵
  - Launches sc.exe
  PID:5028
- C:\Windows\system32\sc.exe
  sc config BITS start=disabled
  2⤵
  PID:3324
- C:\Windows\system32\sc.exe
  sc config BluetoothUserService start=disabled
  2⤵
  - Launches sc.exe
  PID:5336
- C:\Windows\system32\sc.exe
  sc config BTAGService start=disabled
  2⤵
  PID:4916
- C:\Windows\system32\sc.exe
  sc config BthAvctpSvc start=disabled
  2⤵
  PID:4948
- C:\Windows\system32\sc.exe
  sc config bthserv start=disabled
  2⤵
  - Launches sc.exe
  PID:3392
- C:\Windows\system32\sc.exe
  sc config CaptureService start=disabled
  2⤵
  - Launches sc.exe
  PID:3144
- C:\Windows\system32\sc.exe
  sc config cbdhsvc start=disabled
  2⤵
  - Launches sc.exe
  PID:1664
- C:\Windows\system32\sc.exe
  sc config CDPUserSvc start=disabled
  2⤵
  PID:4320
- C:\Windows\system32\sc.exe
  sc config CDPSvc start=disabled
  2⤵
  PID:5904
- C:\Windows\system32\sc.exe
  sc config CertPropSvc start=disabled
  2⤵
  PID:1412
- C:\Windows\system32\sc.exe
  sc config CloudBackupRestoreSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:4704
- C:\Windows\system32\sc.exe
  sc config cloudidsvc start=disabled
  2⤵
  - Launches sc.exe
  PID:524
- C:\Windows\system32\sc.exe
  sc config COMSysApp start=disabled
  2⤵
  PID:2172
- C:\Windows\system32\sc.exe
  sc config ConsentUxUserSvc start=disabled
  2⤵
  PID:1216
- C:\Windows\system32\sc.exe
  sc config CscService start=disabled
  2⤵
  PID:2304
- C:\Windows\system32\sc.exe
  sc config dcsvc start=disabled
  2⤵
  PID:3840
- C:\Windows\system32\sc.exe
  sc config defragsvc start=demand
  2⤵
  - Launches sc.exe
  PID:1756
- C:\Windows\system32\sc.exe
  sc config DeviceAssociationService start=disabled
  2⤵
  PID:4408
- C:\Windows\system32\sc.exe
  sc config DeviceInstall start=disabled
  2⤵
  PID:3416
- C:\Windows\system32\sc.exe
  sc config DevicePickerUserSvc start=disabled
  2⤵
  PID:3372
- C:\Windows\system32\sc.exe
  sc config DevicesFlowUserSvc start=disabled
  2⤵
  PID:848
- C:\Windows\system32\sc.exe
  sc config DevQueryBroker start=disabled
  2⤵
  - Launches sc.exe
  PID:3600
- C:\Windows\system32\sc.exe
  sc config diagnosticshub.standardcollector.service start=disabled
  2⤵
  PID:1316
- C:\Windows\system32\sc.exe
  sc config DiagTrack start=disabled
  2⤵
  PID:5816
- C:\Windows\system32\sc.exe
  sc config diagsvc start=disabled
  2⤵
  PID:4460
- C:\Windows\system32\sc.exe
  sc config DispBrokerDesktopSvc start=auto
  2⤵
  PID:5132
- C:\Windows\system32\sc.exe
  sc config DisplayEnhancementService start=disabled
  2⤵
  - Launches sc.exe
  PID:4324
- C:\Windows\system32\sc.exe
  sc config DmEnrollmentSvc start=disabled
  2⤵
  PID:5056
- C:\Windows\system32\sc.exe
  sc config dmwappushservice start=disabled
  2⤵
  PID:1716
- C:\Windows\system32\sc.exe
  sc config dot3svc start=disabled
  2⤵
  PID:5036
- C:\Windows\system32\sc.exe
  sc config DPS start=disabled
  2⤵
  PID:3008
- C:\Windows\system32\sc.exe
  sc config DsmSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:1364
- C:\Windows\system32\sc.exe
  sc config DsSvc start=disabled
  2⤵
  PID:4116
- C:\Windows\system32\sc.exe
  sc config DusmSvc start=disabled
  2⤵
  PID:4292
- C:\Windows\system32\sc.exe
  sc config Eaphost start=disabled
  2⤵
  PID:3336
- C:\Windows\system32\sc.exe
  sc config edgeupdate start=disabled
  2⤵
  - Launches sc.exe
  PID:5992
- C:\Windows\system32\sc.exe
  sc config edgeupdatem start=disabled
  2⤵
  PID:4772
- C:\Windows\system32\sc.exe
  sc config EFS start=disabled
  2⤵
  - Launches sc.exe
  PID:1840
- C:\Windows\system32\sc.exe
  sc config EventLog start=disabled
  2⤵
  PID:3476
- C:\Windows\system32\sc.exe
  sc config EventSystem start=demand
  2⤵
  PID:6044
- C:\Windows\system32\sc.exe
  sc config fdPHost start=disabled
  2⤵
  PID:1144
- C:\Windows\system32\sc.exe
  sc config FDResPub start=disabled
  2⤵
  - Launches sc.exe
  PID:3960
- C:\Windows\system32\sc.exe
  sc config fhsvc start=disabled
  2⤵
  PID:6072
- C:\Windows\system32\sc.exe
  sc config FontCache start=disabled
  2⤵
  - Launches sc.exe
  PID:1048
- C:\Windows\system32\sc.exe
  sc config FrameServer start=disabled
  2⤵
  PID:4720
- C:\Windows\system32\sc.exe
  sc config FrameServerMonitor start=disabled
  2⤵
  - Launches sc.exe
  PID:2296
- C:\Windows\system32\sc.exe
  sc config GameInputSvc start=disabled
  2⤵
  PID:4260
- C:\Windows\system32\sc.exe
  sc config GraphicsPerfSvc start=disabled
  2⤵
  PID:3104
- C:\Windows\system32\sc.exe
  sc config hpatchmon start=disabled
  2⤵
  PID:4492
- C:\Windows\system32\sc.exe
  sc config hidserv start=disabled
  2⤵
  PID:3256
- C:\Windows\system32\sc.exe
  sc config HvHost start=disabled
  2⤵
  PID:2908
- C:\Windows\system32\sc.exe
  sc config icssvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3940
- C:\Windows\system32\sc.exe
  sc config IKEEXT start=disabled
  2⤵
  PID:1644
- C:\Windows\system32\sc.exe
  sc config InstallService start=disabled
  2⤵
  PID:5492
- C:\Windows\system32\sc.exe
  sc config InventorySvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3212
- C:\Windows\system32\sc.exe
  sc config IpxlatCfgSvc start=disabled
  2⤵
  PID:2632
- C:\Windows\system32\sc.exe
  sc config KtmRm start=disabled
  2⤵
  - Launches sc.exe
  PID:2964
- C:\Windows\system32\sc.exe
  sc config LanmanServer start=disabled
  2⤵
  PID:1592
- C:\Windows\system32\sc.exe
  sc config LanmanWorkstation start=disabled
  2⤵
  PID:3420
- C:\Windows\system32\sc.exe
  sc config lfsvc start=disabled
  2⤵
  PID:1496
- C:\Windows\system32\sc.exe
  sc config LocalKdc start=disabled
  2⤵
  PID:5940
- C:\Windows\system32\sc.exe
  sc config LicenseManager start=disabled
  2⤵
  PID:5048
- C:\Windows\system32\sc.exe
  sc config lltdsvc start=disabled
  2⤵
  PID:5632
- C:\Windows\system32\sc.exe
  sc config lmhosts start=disabled
  2⤵
  PID:4964
- C:\Windows\system32\sc.exe
  sc config LxpSvc start=disabled
  2⤵
  PID:5592
- C:\Windows\system32\sc.exe
  sc config MapsBroker start=disabled
  2⤵
  PID:1396
- C:\Windows\system32\sc.exe
  sc config McpManagementService start=disabled
  2⤵
  - Launches sc.exe
  PID:1340
- C:\Windows\system32\sc.exe
  sc config McmSvc start=disabled
  2⤵
  PID:2720
- C:\Windows\system32\sc.exe
  sc config MessagingService start=disabled
  2⤵
  - Launches sc.exe
  PID:1092
- C:\Windows\system32\sc.exe
  sc config midisrv start=disabled
  2⤵
  PID:1528
- C:\Windows\system32\sc.exe
  sc config MSDTC start=disabled
  2⤵
  PID:1844
- C:\Windows\system32\sc.exe
  sc config MSiSCSI start=disabled
  2⤵
  PID:4344
- C:\Windows\system32\sc.exe
  sc config NaturalAuthentication start=disabled
  2⤵
  PID:4864
- C:\Windows\system32\sc.exe
  sc config NcaSvc start=disabled
  2⤵
  PID:4924
- C:\Windows\system32\sc.exe
  sc config NcbService start=disabled
  2⤵
  PID:560
- C:\Windows\system32\sc.exe
  sc config NcdAutoSetup start=disabled
  2⤵
  PID:4660
- C:\Windows\system32\sc.exe
  sc config Netlogon start=disabled
  2⤵
  - Launches sc.exe
  PID:4512
- C:\Windows\system32\sc.exe
  sc config Netman start=disabled
  2⤵
  PID:3796
- C:\Windows\system32\sc.exe
  sc config NetSetupSvc start=disabled
  2⤵
  PID:5972
- C:\Windows\system32\sc.exe
  sc config NetTcpPortSharing start=disabled
  2⤵
  PID:5392
- C:\Windows\system32\sc.exe
  sc config NlaSvc start=disabled
  2⤵
  PID:4504
- C:\Windows\system32\sc.exe
  sc config NPSMSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:4936
- C:\Windows\system32\sc.exe
  sc config OneSyncSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:4240
- C:\Windows\system32\sc.exe
  sc config p2pimsvc start=disabled
  2⤵
  PID:920
- C:\Windows\system32\sc.exe
  sc config p2psvc start=disabled
  2⤵
  - Launches sc.exe
  PID:4828
- C:\Windows\system32\sc.exe
  sc config P9RdrService start=disabled
  2⤵
  - Launches sc.exe
  PID:2164
- C:\Windows\system32\sc.exe
  sc config PcaSvc start=disabled
  2⤵
  PID:1804
- C:\Windows\system32\sc.exe
  sc config PeerDistSvc start=disabled
  2⤵
  PID:4232
- C:\Windows\system32\sc.exe
  sc config PenService start=disabled
  2⤵
  PID:3836
- C:\Windows\system32\sc.exe
  sc config perceptionsimulation start=disabled
  2⤵
  PID:4480
- C:\Windows\system32\sc.exe
  sc config PerfHost start=disabled
  2⤵
  - Launches sc.exe
  PID:4156
- C:\Windows\system32\sc.exe
  sc config PhoneSvc start=disabled
  2⤵
  PID:1056
- C:\Windows\system32\sc.exe
  sc config PimIndexMaintenanceSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:4524
- C:\Windows\system32\sc.exe
  sc config pla start=disabled
  2⤵
  PID:2052
- C:\Windows\system32\sc.exe
  sc config PNRPAutoReg start=disabled
  2⤵
  PID:4656
- C:\Windows\system32\sc.exe
  sc config PNRPsvc start=disabled
  2⤵
  - Launches sc.exe
  PID:6088
- C:\Windows\system32\sc.exe
  sc config PolicyAgent start=disabled
  2⤵
  PID:1548
- C:\Windows\system32\sc.exe
  sc config PrintDeviceConfigurationService start=disabled
  2⤵
  PID:4396
- C:\Windows\system32\sc.exe
  sc config PrintNotify start=disabled
  2⤵
  PID:1976
- C:\Windows\system32\sc.exe
  sc config PrintScanBrokerService start=disabled
  2⤵
  PID:5704
- C:\Windows\system32\sc.exe
  sc config PushToInstall start=disabled
  2⤵
  PID:5384
- C:\Windows\system32\sc.exe
  sc config QWAVE start=disabled
  2⤵
  - Launches sc.exe
  PID:5660
- C:\Windows\system32\sc.exe
  sc config RasAuto start=disabled
  2⤵
  PID:2008
- C:\Windows\system32\sc.exe
  sc config RasMan start=disabled
  2⤵
  PID:2880
- C:\Windows\system32\sc.exe
  sc config refsdedupsvc start=disabled
  2⤵
  PID:1320
- C:\Windows\system32\sc.exe
  sc config RemoteAccess start=disabled
  2⤵
  - Launches sc.exe
  PID:1500
- C:\Windows\system32\sc.exe
  sc config RemoteRegistry start=disabled
  2⤵
  PID:5296
- C:\Windows\system32\sc.exe
  sc config RetailDemo start=disabled
  2⤵
  PID:5004
- C:\Windows\system32\sc.exe
  sc config RmSvc start=disabled
  2⤵
  PID:2960
- C:\Windows\system32\sc.exe
  sc config RpcLocator start=disabled
  2⤵
  PID:668
- C:\Windows\system32\sc.exe
  sc config SamSs start=disabled
  2⤵
  PID:5760
- C:\Windows\system32\sc.exe
  sc config SCardSvr start=disabled
  2⤵
  PID:4636
- C:\Windows\system32\sc.exe
  sc config SCPolicySvc start=disabled
  2⤵
  - Launches sc.exe
  PID:4264
- C:\Windows\system32\sc.exe
  sc config SDRSVC start=disabled
  2⤵
  PID:3972
- C:\Windows\system32\sc.exe
  sc config seclogon start=disabled
  2⤵
  - Launches sc.exe
  PID:1640
- C:\Windows\system32\sc.exe
  sc config SENS start=disabled
  2⤵
  PID:3712
- C:\Windows\system32\sc.exe
  sc config Sense start=disabled
  2⤵
  PID:3492
- C:\Windows\system32\sc.exe
  sc config SensorDataService start=disabled
  2⤵
  PID:1156
- C:\Windows\system32\sc.exe
  sc config SensorService start=disabled
  2⤵
  PID:2476
- C:\Windows\system32\sc.exe
  sc config SensrSvc start=disabled
  2⤵
  PID:1636
- C:\Windows\system32\sc.exe
  sc config SEMgrSvc start=disabled
  2⤵
  PID:5324
- C:\Windows\system32\sc.exe
  sc config SessionEnv start=disabled
  2⤵
  PID:2856
- C:\Windows\system32\sc.exe
  sc config SharedAccess start=disabled
  2⤵
  PID:2372
- C:\Windows\system32\sc.exe
  sc config SharedRealitySvc start=disabled
  2⤵
  PID:3260
- C:\Windows\system32\sc.exe
  sc config ShellHWDetection start=disabled
  2⤵
  - Launches sc.exe
  PID:1504
- C:\Windows\system32\sc.exe
  sc config shpamsvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3976
- C:\Windows\system32\sc.exe
  sc config SmsRouter start=disabled
  2⤵
  - Launches sc.exe
  PID:4872
- C:\Windows\system32\sc.exe
  sc config smphost start=disabled
  2⤵
  - Launches sc.exe
  PID:4208
- C:\Windows\system32\sc.exe
  sc config SNMPTrap start=disabled
  2⤵
  PID:5340
- C:\Windows\system32\sc.exe
  sc config spectrum start=disabled
  2⤵
  - Launches sc.exe
  PID:5320
- C:\Windows\system32\sc.exe
  sc config Spooler start=disabled
  2⤵
  PID:4952
- C:\Windows\system32\sc.exe
  sc config SSDPSRV start=disabled
  2⤵
  PID:2972
- C:\Windows\system32\sc.exe
  sc config ssh-agent start=disabled
  2⤵
  PID:3296
- C:\Windows\system32\sc.exe
  sc config SstpSvc start=disabled
  2⤵
  PID:1488
- C:\Windows\system32\sc.exe
  sc config stisvc start=disabled
  2⤵
  PID:2120
- C:\Windows\system32\sc.exe
  sc config StorSvc start=disabled
  2⤵
  PID:4384
- C:\Windows\system32\sc.exe
  sc config svsvc start=disabled
  2⤵
  PID:2092
- C:\Windows\system32\sc.exe
  sc config SysMain start=disabled
  2⤵
  PID:5352
- C:\Windows\system32\sc.exe
  sc config TapiSrv start=disabled
  2⤵
  PID:5524
- C:\Windows\system32\sc.exe
  sc config TermService start=disabled
  2⤵
  PID:3460
- C:\Windows\system32\sc.exe
  sc config Themes start=disabled
  2⤵
  PID:3440
- C:\Windows\system32\sc.exe
  sc config TieringEngineService start=disabled
  2⤵
  PID:4808
- C:\Windows\system32\sc.exe
  sc config TokenBroker start=disabled
  2⤵
  PID:4356
- C:\Windows\system32\sc.exe
  sc config TrkWks start=disabled
  2⤵
  PID:3724
- C:\Windows\system32\sc.exe
  sc config TroubleshootingSvc start=disabled
  2⤵
  PID:3188
- C:\Windows\system32\sc.exe
  sc config tzautoupdate start=disabled
  2⤵
  - Launches sc.exe
  PID:2536
- C:\Windows\system32\sc.exe
  sc config UevAgentService start=disabled
  2⤵
  PID:5920
- C:\Windows\system32\sc.exe
  sc config uhssvc start=disabled
  2⤵
  - Launches sc.exe
  PID:2360
- C:\Windows\system32\sc.exe
  sc config UmRdpService start=disabled
  2⤵
  PID:4336
- C:\Windows\system32\sc.exe
  sc config UnistoreSvc start=disabled
  2⤵
  PID:4996
- C:\Windows\system32\sc.exe
  sc config upnphost start=disabled
  2⤵
  PID:1172
- C:\Windows\system32\sc.exe
  sc config UserDataSvc start=disabled
  2⤵
  PID:5960
- C:\Windows\system32\sc.exe
  sc config VacSvc start=disabled
  2⤵
  PID:3312
- C:\Windows\system32\sc.exe
  sc config VaultSvc start=disabled
  2⤵
  PID:2968
- C:\Windows\system32\sc.exe
  sc config vds start=disabled
  2⤵
  PID:4932
- C:\Windows\system32\sc.exe
  sc config vmicguestinterface start=disabled
  2⤵
  PID:428
- C:\Windows\system32\sc.exe
  sc config vmicheartbeat start=disabled
  2⤵
  PID:2448
- C:\Windows\system32\sc.exe
  sc config vmickvpexchange start=disabled
  2⤵
  PID:2744
- C:\Windows\system32\sc.exe
  sc config vmicrdv start=disabled
  2⤵
  PID:5976
- C:\Windows\system32\sc.exe
  sc config vmicshutdown start=disabled
  2⤵
  - Launches sc.exe
  PID:1072
- C:\Windows\system32\sc.exe
  sc config vmictimesync start=disabled
  2⤵
  PID:2144
- C:\Windows\system32\sc.exe
  sc config vmicvmsession start=disabled
  2⤵
  PID:5024
- C:\Windows\system32\sc.exe
  sc config vmicvss start=disabled
  2⤵
  PID:52
- C:\Windows\system32\sc.exe
  sc config W32Time start=disabled
  2⤵
  PID:4376
- C:\Windows\system32\sc.exe
  sc config WalletService start=disabled
  2⤵
  PID:2680
- C:\Windows\system32\sc.exe
  sc config WarpJITSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:5312
- C:\Windows\system32\sc.exe
  sc config wbengine start=disabled
  2⤵
  PID:5988
- C:\Windows\system32\sc.exe
  sc config WbioSrvc start=disabled
  2⤵
  PID:2872
- C:\Windows\system32\sc.exe
  sc config Wcmsvc start=disabled
  2⤵
  PID:5980
- C:\Windows\system32\sc.exe
  sc config wcncsvc start=disabled
  2⤵
  PID:4628
- C:\Windows\system32\sc.exe
  sc config WdiServiceHost start=disabled
  2⤵
  PID:1412
- C:\Windows\system32\sc.exe
  sc config WdiSystemHost start=disabled
  2⤵
  PID:3912
- C:\Windows\system32\sc.exe
  sc config WebClient start=disabled
  2⤵
  PID:3736
- C:\Windows\system32\sc.exe
  sc config webthreatdefusersvc start=disabled
  2⤵
  PID:2300
- C:\Windows\system32\sc.exe
  sc config webthreatdefsvc start=disabled
  2⤵
  PID:3660
- C:\Windows\system32\sc.exe
  sc config Wecsvc start=disabled
  2⤵
  PID:1216
- C:\Windows\system32\sc.exe
  sc config WEPHOSTSVC start=disabled
  2⤵
  PID:2304
- C:\Windows\system32\sc.exe
  sc config wercplsupport start=disabled
  2⤵
  PID:3840
- C:\Windows\system32\sc.exe
  sc config WerSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:4812
- C:\Windows\system32\sc.exe
  sc config WFDSConMgrSvc start=disabled
  2⤵
  PID:3436
- C:\Windows\system32\sc.exe
  sc config whesvc start=disabled
  2⤵
  PID:5408
- C:\Windows\system32\sc.exe
  sc config WiaRpc start=disabled
  2⤵
  PID:4308
- C:\Windows\system32\sc.exe
  sc config WinRM start=disabled
  2⤵
  PID:4112
- C:\Windows\system32\sc.exe
  sc config wisvc start=disabled
  2⤵
  - Launches sc.exe
  PID:5680
- C:\Windows\system32\sc.exe
  sc config WlanSvc start=disabled
  2⤵
  PID:5792
- C:\Windows\system32\sc.exe
  sc config wlidsvc start=disabled
  2⤵
  PID:5816
- C:\Windows\system32\sc.exe
  sc config wlpasvc start=disabled
  2⤵
  PID:4624
- C:\Windows\system32\sc.exe
  sc config WManSvc start=disabled
  2⤵
  PID:464
- C:\Windows\system32\sc.exe
  sc config wmiApSrv start=disabled
  2⤵
  - Launches sc.exe
  PID:4324
- C:\Windows\system32\sc.exe
  sc config WMPNetworkSvc start=disabled
  2⤵
  PID:4944
- C:\Windows\system32\sc.exe
  sc config workfolderssvc start=disabled
  2⤵
  - Launches sc.exe
  PID:2732
- C:\Windows\system32\sc.exe
  sc config WpcMonSvc start=disabled
  2⤵
  PID:2932
- C:\Windows\system32\sc.exe
  sc config WPDBusEnum start=disabled
  2⤵
  PID:1364
- C:\Windows\system32\sc.exe
  sc config WpnUserService start=disabled
  2⤵
  PID:4116
- C:\Windows\system32\sc.exe
  sc config WpnService start=disabled
  2⤵
  PID:1136
- C:\Windows\system32\sc.exe
  sc config wuqisvc start=disabled
  2⤵
  PID:1312
- C:\Windows\system32\sc.exe
  sc config WSAIFabricSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:5932
- C:\Windows\system32\sc.exe
  sc config WSearch start=disabled
  2⤵
  PID:2380
- C:\Windows\system32\sc.exe
  sc config WwanSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:1840
- C:\Windows\system32\sc.exe
  sc config XblAuthManager start=disabled
  2⤵
  PID:3476
- C:\Windows\system32\sc.exe
  sc config XblGameSave start=disabled
  2⤵
  PID:3268
- C:\Windows\system32\sc.exe
  sc config XboxGipSvc start=disabled
  2⤵
  PID:5912
- C:\Windows\system32\sc.exe
  sc config XboxNetApiSvc start=disabled
  2⤵
  PID:960
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\AppIDSvc" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:684
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\BFE" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:6072
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\ClipSVC" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4868
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\CredentialEnrollmentManagerUserSvc" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\DeviceAssociationBrokerSvc" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:1620
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\DoSvc" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:3108
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\EntAppSvc" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4668
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\embeddedmode" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4464
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\PrintWorkflowUserSvc" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\SgrmBroker" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:828
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\WinHttpAutoProxySvc" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4768
- C:\Windows\system32\sc.exe
  sc config jhi_service start=disabled
  2⤵
  - Launches sc.exe
  PID:2788
- C:\Windows\system32\sc.exe
  sc config WMIRegistrationService start=disabled
  2⤵
  - Launches sc.exe
  PID:5964
- C:\Windows\system32\sc.exe
  sc config ipfsvc start=disabled
  2⤵
  PID:1904
- C:\Windows\system32\sc.exe
  sc config igccservice start=disabled
  2⤵
  - Launches sc.exe
  PID:2996
- C:\Windows\system32\sc.exe
  sc config cplspcon start=disabled
  2⤵
  PID:3656
- C:\Windows\system32\sc.exe
  sc config esifsvc start=disabled
  2⤵
  PID:2904
- C:\Windows\system32\sc.exe
  sc config LMS start=disabled
  2⤵
  PID:4256
- C:\Windows\system32\sc.exe
  sc config ibtsiva start=disabled
  2⤵
  PID:1676
- C:\Windows\system32\sc.exe
  sc config cphs start=disabled
  2⤵
  - Launches sc.exe
  PID:1496
- C:\Windows\system32\sc.exe
  sc config DSAService start=disabled
  2⤵
  PID:5940
- C:\Windows\system32\sc.exe
  sc config DSAUpdateService start=disabled
  2⤵
  PID:4228
- C:\Windows\system32\sc.exe
  sc config RstMwService start=disabled
  2⤵
  PID:3000
- C:\Windows\system32\sc.exe
  sc config iaStorAfsService start=disabled
  2⤵
  PID:3832
- C:\Windows\system32\sc.exe
  sc config RzActionSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:5592
- C:\Windows\system32\sc.exe
  sc config CortexLauncherService start=disabled
  2⤵
  PID:5580
- C:\Windows\system32\sc.exe
  sc config HapticService start=disabled
  2⤵
  PID:1340
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\1394ohci" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2720
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\AcpiDev" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1092
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\acpipagr" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3272
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\AcpiPmi" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2740
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\acpitime" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5832
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\amdsata" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3012
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\amdsbs" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5088
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\amdxata" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5240
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\AppvVemgr" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1128
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\arcsas" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4660
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\atapi" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4512
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\b06bdrv" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3796
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\bam" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5972
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\beep" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5392
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\bowser" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4504
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BthA2dp" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:876
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BthEnum" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BthHFEnum" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:920
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BthLEEnum" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4828
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BthMini" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1860
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BTHMODEM" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1928
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4400
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BTHUSB" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5180
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\bttflt" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3368
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\cdfs" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3692
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\cdrom" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1184
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\cht4tiscsi" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3996
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\cht4vbd" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4524
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\circlass" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2052
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\CSC" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4656
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\dam" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:6088
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\ebdrv" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1548
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\fdc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\flpydisk" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1976
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\gencounter" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\HidBth" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5384
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\HidIr" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5660
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\hvcrash" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2008
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\hvservice" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\hyperkbd" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1320
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\HyperVideo" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4608
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\i8042prt" /v "Start" /t REG_DWORD /d "3" /f
  2⤵
  PID:3472
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\ItSas35i" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:672
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\MEIx64" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:824
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Microsoft_Bluetooth_AvrcpTransport" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4152
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\NdisCap" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3444
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\NdisVirtualBus" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2756
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Ndu" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3356
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\rdpbus" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5864
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\RFCOMM" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5472
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\scfilter" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4104
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\sfloppy" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2024
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SgrmAgent" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2500
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SpatialGraphFilter" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3744
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Synth3dVsc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2316
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\TsUsbFlt" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\TsUsbGD" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\tsusbhub" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3504
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\udfs" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1720
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\UevAgentDriver" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3260
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\umbus" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1504
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\usbcir" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3976
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\usbprint" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4872
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Vid" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4208
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\vmgid" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5340
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\vwifibus" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4476
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\vwififlt" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3096
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\vwifimp" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3296
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\WacomPen" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1488
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\wanarp" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2120
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\wanarpv6" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5956
- C:\Windows\system32\powercfg.exe
  powercfg -h off
  2⤵
  - Power Settings
  PID:5344
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabledDefault" /t REG_DWORD /d "0" /f
  2⤵
  PID:5352
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v "AwayModeEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5524
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v BackgroundOnlyAffinityMask /t REG_DWORD /d 0 /f
  2⤵
  PID:5708
- C:\Windows\system32\powercfg.exe
  powercfg -delete 381b4222-f694-41f0-9685-ff5bb260df2e
  2⤵
  - Power Settings
  PID:3192
- C:\Windows\system32\powercfg.exe
  powercfg -delete 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  PID:4808
- C:\Windows\system32\powercfg.exe
  powercfg -delete a1841308-3541-4fab-bc81-f71556f20b4a
  2⤵
  - Power Settings
  PID:2308
- C:\Windows\system32\powercfg.exe
  powercfg -import "C:/Windows/latency(1).pow"
  2⤵
  - Power Settings
  PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -list | findstr /i "latency(1)"
  2⤵
  - Power Settings
  PID:2536
- - C:\Windows\system32\powercfg.exe
    powercfg -list
    3⤵
    - Power Settings
    PID:5920
- - C:\Windows\system32\findstr.exe
    findstr /i "latency(1)"
    3⤵
    PID:4640
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\CameraAlternate\ShowPicturesOnArrival" /ve /t REG_SZ /d "MSTakeNoAction" /f
  2⤵
  PID:4880
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection\StorageOnArrival" /ve /t REG_SZ /d "MSTakeNoAction" /f
  2⤵
  PID:2016
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\CameraAlternate\ShowPicturesOnArrival" /ve /t REG_SZ /d "MSTakeNoAction" /f
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers\StorageOnArrival" /ve /t REG_SZ /d "MSTakeNoAction" /f
  2⤵
  PID:3516
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  PID:3844
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions" /v "IoPriority" /t REG_DWORD /d "3" /f
  2⤵
  PID:3684
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Services\pci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2532
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\ControlSet001\Services\pci\Parameters" /v "DmaRemappingOnHiberPath" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3184
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Services\storahci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2448
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\ControlSet001\Services\storahci\Parameters" /v "DmaRemappingOnHiberPath" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2744
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Services\stornvme\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5976
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\ControlSet001\Services\stornvme\Parameters" /v "DmaRemappingOnHiberPath" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1072
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Services\USBXHCI\Parameters" /v "DmaRemappingCompatibleSelfhost" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2144
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Services\USBXHCI\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5024
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "Welcome to FasterOS 11 Lite, Boosty.to/uzayyyiki" /f
  2⤵
  PID:52
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticetext" /t REG_SZ /d "Thanks you for purchasing FasterOS 11 Lite. Made by Uzayyyiki, Boosty.to/uzayyyiki." /f
  2⤵
  PID:4376
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2680
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5312
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5988
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} description "StripesOS 10 Home SL Dev"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2872
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5980
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot Yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux Disabled
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1412
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootlog no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3912
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 10
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3736
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick Yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype Off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3660
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1216
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformclock No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:412
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick Yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3840
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tscsyncpolicy enhanced
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4812
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\services\dmwappushservice" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3436
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\services\Beep" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5408
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\services\GpuEnergyDrv" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\services\npsvctrig" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4112
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\services\wanarp" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5680
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\services\Wanarpv6" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5792
- C:\Windows\system32\sc.exe
  sc delete CompositeBus
  2⤵
  PID:5816
- C:\Windows\system32\sc.exe
  sc delete NdisVirtualBus
  2⤵
  PID:4624
- C:\Windows\system32\sc.exe
  sc delete umbus
  2⤵
  PID:3432
- C:\Windows\system32\sc.exe
  sc delete vdrvroot
  2⤵
  PID:1684
- C:\Windows\system32\sc.exe
  sc delete Vid
  2⤵
  PID:1380
- C:\Windows\system32\sc.exe
  sc delete rdpbus
  2⤵
  PID:4600
- C:\Windows\system32\label.exe
  label C:StripesOS
  2⤵
  PID:6064
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hl.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 3 /f
  2⤵
  PID:6056
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VALORANT-Win64-Shipping.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 3 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1364
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cs2.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 3 /f
  2⤵
  PID:4292
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteLauncher.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 3 /f
  2⤵
  PID:3336
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping_BE.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 3 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5992
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping_EAC.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 3 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4772
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 3 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3116
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csgo.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 3 /f
  2⤵
  PID:3476
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\steam.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:3268
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\steam.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:5912
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Discord.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:960
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Discord.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:684
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ts3client_win64.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:6072
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ts3client_win64.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ts3client_win32.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:1620
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ts3client_win32.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:3108
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:4668
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:4464
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chromium.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chromium.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:828
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:4768
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msedge.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:2788
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:5964
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:1028
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brave.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:5804
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brave.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:1888
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tor.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:1592
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tor.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:3420
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:4200
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:6136
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera_gx.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:5156
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera_gx.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:2340
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vivaldi.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:3000
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vivaldi.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\waterfox.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:5592
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\waterfox.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:1396
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\librewolf.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:3772
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\librewolf.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:3348
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\palemoon.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:4520
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\palemoon.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:620
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v "FontSmoothing" /t REG_SZ /d "2" /f
  2⤵
  PID:1844
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v "DragFullWindows" /t REG_SZ /d "0" /f
  2⤵
  PID:4344
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop\WindowMetrics" /v "MinAnimate" /t REG_SZ /d "0" /f
  2⤵
  PID:4864
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewShadow" /t REG_DWORD /d "0" /f
  2⤵
  PID:5796
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d "0" /f
  2⤵
  PID:5260
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewAlphaSelect" /t REG_DWORD /d "0" /f
  2⤵
  PID:6032
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /t REG_DWORD /d "3" /f
  2⤵
  PID:5972
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\DWM" /v "EnableAeroPeek" /t REG_DWORD /d "0" /f
  2⤵
  PID:4936
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\DWM" /v "AlwaysHibernateThumbnails" /t REG_DWORD /d "0" /f
  2⤵
  PID:876
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v "UserPreferencesMask" /t REG_BINARY /d "9012038010000000" /f
  2⤵
  PID:920
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "AllowOnlineTips" /t "REG_DWORD" /d "0" /f
  2⤵
  PID:4828
- C:\Windows\system32\Dism.exe
  DISM /Online /Set-ReservedStorageState /State:Disabled
  2⤵
  PID:1860
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {65E95B14-F750-442E-BE17-5EC1988BB8E3}
    3⤵
    PID:3368
- C:\Windows\system32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Defrag\ScheduledDefrag" /disable
  2⤵
  PID:2508
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile" /v "DisableNotifications" /t REG_DWORD /d "1" /f
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v "DisableNotifications" /t REG_DWORD /d "1" /f
  2⤵
  PID:1976
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunch_C09E690C3F322367E058F9F0FC90C11A" /f
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /f
  2⤵
  PID:5384
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn \MicrosoftEdgeUpdateBrowserReplacementTask /F
  2⤵
  PID:5660
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn \MicrosoftEdgeUpdateTaskMachineCore /F
  2⤵
  PID:2404
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn \MicrosoftEdgeUpdateTaskMachineUA /F
  2⤵
  PID:6140
- C:\Windows\system32\sc.exe
  sc delete edgeupdate
  2⤵
  PID:4608
- C:\Windows\system32\sc.exe
  sc delete edgeupdatem
  2⤵
  - Launches sc.exe
  PID:3472
- C:\Windows\system32\sc.exe
  sc delete MicrosoftEdgeElevationService
  2⤵
  PID:2960
- C:\Windows\system32\reg.exe
  reg delete "HKLM\System\ControlSet001\Services\edgeupdate" /f
  2⤵
  PID:4288
- C:\Windows\system32\reg.exe
  reg delete "HKLM\System\ControlSet001\Services\edgeupdatem" /f
  2⤵
  PID:5760
- C:\Windows\system32\reg.exe
  reg delete "HKLM\System\ControlSet001\Services\MicrosoftEdgeElevationService" /f
  2⤵
  PID:4636
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "DiagnosticData" /t REG_DWORD /d "0" /f
  2⤵
  PID:4264
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "TrackingPrevention" /t REG_DWORD /d "3" /f
  2⤵
  PID:4568
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "BingAdsSuppression" /t REG_DWORD /d "1" /f
  2⤵
  PID:1640
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "UserFeedbackAllowed" /t REG_DWORD /d "0" /f
  2⤵
  PID:3712
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "AddressBarMicrosoftSearchInBingProviderEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3492
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "PersonalizationReportingEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1156
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "PromotionalTabsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2476
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "SpotlightExperiencesAndRecommendationsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2552
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main" /v "AllowPrelaunch" /t REG_DWORD /d "0" /f
  2⤵
  PID:4928
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main" /v "DoNotTrack" /t REG_DWORD /d "1" /f
  2⤵
  PID:4180
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\MicrosoftEdge\TabPreloader" /v "AllowTabPreloading" /t REG_DWORD /d "0" /f
  2⤵
  PID:2372
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Edge" /v "MetricsReportingEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2816
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Edge" /v "HubsSidebarEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2228
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Edge" /v "PersonalizationReportingEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3968
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Edge" /v "UserFeedbackAllowed" /t REG_DWORD /d "0" /f
  2⤵
  PID:4676
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Edge" /v "SpotlightExperiencesAndRecommendationsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1288
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\MicrosoftEdge\BooksLibrary" /v "EnableExtendedBooksTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:3920
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "WebWidgetAllowed" /t REG_DWORD /d "0" /f
  2⤵
  PID:4952
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "HubsSidebarEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3028
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "UserFeedbackAllowed" /t REG_DWORD /d "0" /f
  2⤵
  PID:3536
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "MetricsReportingEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2728
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\MicrosoftEdge\BooksLibrary" /v "EnableExtendedBooksTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:4160
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge\Recommended" /v "StartupBoostEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4100
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "StartupBoostEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5348
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "PinBrowserEssentialsToolbarButton" /t REG_DWORD /d "0" /f
  2⤵
  PID:2092
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "EdgeFollowEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4764
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "StandaloneHubsSidebarEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5644
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "SyncDisabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:1120
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "HideRestoreDialogEnabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:5708
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "ShowRecommendationsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3868
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "ShowMicrosoftRewards" /t REG_DWORD /d "0" /f
  2⤵
  PID:4648
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "QuickSearchShowMiniMenu" /t REG_DWORD /d "0" /f
  2⤵
  PID:3192
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "EdgeCollectionsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5928
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "SearchbarAllowed" /t REG_DWORD /d "0" /f
  2⤵
  PID:3188
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "NewTabPageContentEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5016
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "NewTabPageHideDefaultTopSites" /t REG_DWORD /d "1" /f
  2⤵
  PID:240
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "HideFirstRunExperience" /t REG_DWORD /d "1" /f
  2⤵
  PID:1512
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "EdgeShoppingAssistantEnabled" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5784
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Edge" /v "AutoImportAtFirstRun" /t REG_DWORD /d "4" /f
  2⤵
  PID:4880
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Steps-Recorder" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:2016
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Telemetry" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Inventory" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:3516
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:3844
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-EventTracing/Admin" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:3684
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\Cellcore"
  2⤵
  PID:2532
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\Cellcore" /v Start /t REG_DWORD /d 0 /f
  2⤵
  PID:3184
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger"
  2⤵
  PID:2448
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger" /v Start /t REG_DWORD /d 0 /f
  2⤵
  PID:2744
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderAuditLogger"
  2⤵
  PID:5976
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderAuditLogger" /v Start /t REG_DWORD /d 0 /f
  2⤵
  PID:1072
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\Diagtrack-Listener"
  2⤵
  PID:2144
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\Diagtrack-Listener" /v Start /t REG_DWORD /d 0 /f
  2⤵
  PID:5024
- C:\Windows\system32\reg.exe
  reg query "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\ReFSLog"
  2⤵
  PID:52
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\ReFSLog" /v Start /t REG_DWORD /d 0 /f
  2⤵
  PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Disable-AppBackgroundTaskDiagnosticLog
  2⤵
  PID:3144
- C:\Windows\system32\setx.exe
  setx POWERSHELL_TELEMETRY_OPTOUT 1
  2⤵
  PID:5980
- C:\Windows\system32\setx.exe
  setx DOTNET_CLI_TELEMETRY_OPTOUT 1
  2⤵
  PID:1756
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Preferences" /v "UsageTracking" /t REG_DWORD /d 0 /f
  2⤵
  PID:3840
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AllowIndexingEncryptedStoresOrItems" /t "REG_DWORD" /d 0 /f
  2⤵
  PID:4812
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "AlwaysUseAutoLangDetection" /t "REG_DWORD" /d 0 /f
  2⤵
  PID:3436
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v "PreventRemoteQueries" /t "REG_DWORD" /d 1 /f
  2⤵
  PID:5408
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  PID:4308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im runtimebroker.exe
  2⤵
  - Kills process with taskkill
  PID:1376
- C:\Windows\System32\takeown.exe
  takeown /f "runtimebroker.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1364
- C:\Windows\System32\icacls.exe
  icacls "C:\Windows\System32\RuntimeBroker.exe" /grant Administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2556
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:2276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get name
  2⤵
  - Executes a command shell one-liner
  PID:5652
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Intel Core Processor (Broadwell) "
  2⤵
  PID:4544
- C:\Windows\System32\find.exe
  find /i "AMD"
  2⤵
  PID:620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Intel Core Processor (Broadwell) "
  2⤵
  PID:4884
- C:\Windows\System32\find.exe
  find /i "Intel"
  2⤵
  PID:3012
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "FeatureSettingsOverride" /t REG_DWORD /d 3 /f
  2⤵
  PID:4476
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "FeatureSettingsOverrideMask" /t REG_DWORD /d 3 /f
  2⤵
  PID:3296
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "Win32PrioritySeparation" /t REG_DWORD /d "0x2a" /f
  2⤵
  PID:2120
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v AdjustDpcThreshold /t REG_DWORD /d 800 /f
  2⤵
  PID:4384
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v DeepIoCoalescingEnabled /t REG_DWORD /d 1 /f
  2⤵
  PID:5352
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v IdealDpcRate /t REG_DWORD /d 800 /f
  2⤵
  PID:964
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v ForegroundBoost /t REG_DWORD /d 1 /f
  2⤵
  PID:4352
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v SchedulerAssistThreadFlagOverride /t REG_DWORD /d 1 /f
  2⤵
  PID:3440
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v ThreadBoostType /t REG_DWORD /d 2 /f
  2⤵
  PID:904
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v ThreadSchedulingModel /t REG_DWORD /d 1 /f
  2⤵
  PID:3724
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d 402653184 /f
  2⤵
  PID:2308
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d 3 /f
  2⤵
  PID:3188
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\PerfOptions" /v "IoPriority" /t REG_DWORD /d 3 /f
  2⤵
  PID:240
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control" /v "ServicesPipeTimeout" /t REG_DWORD /d 2000 /f
  2⤵
  PID:1512
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "2000" /f
  2⤵
  PID:1968
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe" /v "MitigationOptions" /t REG_BINARY /d 00000000000000000000000000000000 /f
  2⤵
  PID:2016
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\mouclass\Parameters" /v MouseDataQueueSize /t REG_DWORD /d 54 /f
  2⤵
  PID:4612
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters" /v KeyboardDataQueueSize /t REG_DWORD /d 10 /f
  2⤵
  PID:3516
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\PowerCfg\GlobalPowerPolicy" /v Policies /t REG_BINARY /d 01000000020000000100000000000000020000000000000000000000000000002C010000323203030400000004000000000000000000000000000000840300002C01000000000000840300000001646464640000 /f
  2⤵
  - Power Settings
  PID:3844
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\ControlSet001\Control\Session Manager\Memory Management" /v LargeSystemCache /t REG_DWORD /d 0 /f
  2⤵
  PID:752
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\WindowsStore" /v AutoDownload /t REG_DWORD /d 2 /f
  2⤵
  PID:420
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:5884
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex /t REG_DWORD /d 4294967295 /f
  2⤵
  PID:2216
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness /t REG_DWORD /d 0 /f
  2⤵
  PID:1300
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NoLazyMode /t REG_DWORD /d 1 /f
  2⤵
  PID:5028
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v AlwaysOn /t REG_DWORD /d 1 /f
  2⤵
  PID:3324
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v Affinity /t REG_DWORD /d 0 /f
  2⤵
  PID:3932
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Background Only" /t REG_SZ /d False /f
  2⤵
  PID:4916
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Clock Rate" /t REG_DWORD /d 10000 /f
  2⤵
  PID:2512
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "GPU Priority" /t REG_DWORD /d 8 /f
  2⤵
  PID:4784
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v Priority /t REG_DWORD /d 6 /f
  2⤵
  PID:4704
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Scheduling Category" /t REG_SZ /d High /f
  2⤵
  PID:6132
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "SFIO Priority" /t REG_SZ /d High /f
  2⤵
  PID:5904
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f
  2⤵
  PID:2872
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f
  2⤵
  PID:5988
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f
  2⤵
  PID:3732
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v MouseHoverTime /t REG_SZ /d 0 /f
  2⤵
  PID:2680
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v SmoothMouseXCurve /t REG_BINARY /d 000000000000000000A00000000000000040010000000000800200000000000000050000000000 /f
  2⤵
  PID:524
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v SmoothMouseYCurve /t REG_BINARY /d 000000000000000066A6020000000000CD4C050000000000A0990A00000000003833150000000000 /f
  2⤵
  PID:5312
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v RawMouseThrottleDuration /t REG_DWORD /d 20 /f
  2⤵
  PID:2560
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v MouseWheelRouting /t REG_DWORD /d 0 /f
  2⤵
  PID:2312
- C:\Windows\System32\rundll32.exe
  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
  2⤵
  PID:1756
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USB" /v DisableSelectiveSuspend /t REG_DWORD /d 1 /f
  2⤵
  PID:3372
- C:\Windows\System32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\DWM" /v OverlayTestMode /t REG_DWORD /d 5 /f
  2⤵
  PID:848
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePagingExecutive /t REG_DWORD /d 1 /f
  2⤵
  PID:3600
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  PID:5980
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f
  2⤵
  PID:1248
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
  2⤵
  PID:4976
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d Off /f
  2⤵
  PID:5612
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "AllowHibernate" /t REG_DWORD /d "0" /f
  2⤵
  PID:2028
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "EnergySaverState" /t REG_DWORD /d "0" /f
  2⤵
  PID:1900
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "EventProcessorEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5696
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2860
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HiberbootEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4920
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabledDefault" /t REG_DWORD /d "0" /f
  2⤵
  PID:4960
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "TimerCoalescing" /t REG_BINARY /d "0000000000000000000000000000000000000000000000000000000000000000" /f
  2⤵
  PID:1060
- C:\Windows\System32\powercfg.exe
  powercfg /hibernate off
  2⤵
  - Power Settings
  PID:1472
- C:\Windows\System32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d "0" /f
  2⤵
  PID:936
- C:\Windows\System32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d "1" /f
  2⤵
  PID:2096
- C:\Windows\System32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCAMeetNow" /t REG_DWORD /d "1" /f
  2⤵
  PID:2244
- C:\Windows\System32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d "0" /f
  2⤵
  PID:5720
- C:\Windows\System32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:3216
- C:\Windows\System32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d "0" /f
  2⤵
  PID:4836
- C:\Windows\System32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "EnableTransparency" /t REG_DWORD /d "0" /f
  2⤵
  PID:1992
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "0" /f
  2⤵
  PID:2036
- C:\Windows\System32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d "0" /f
  2⤵
  PID:4308
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "PlatformAoAcOverride" /t REG_DWORD /d "0" /f
  2⤵
  PID:6128
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "PlatformRoleOverride" /t REG_DWORD /d "0" /f
  2⤵
  PID:3892
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "MSDisabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:5740
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "DynamicHeteroCpuPolicyMask" /t REG_DWORD /d "3" /f
  2⤵
  PID:3696
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "DefaultDynamicHeteroCpuPolicy" /t REG_DWORD /d "3" /f
  2⤵
  PID:1200
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "DynamicHeteroCpuPolicyImportant" /t REG_DWORD /d "1" /f
  2⤵
  PID:2928
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "DynamicHeteroCpuPolicyImportantShort" /t REG_DWORD /d "1" /f
  2⤵
  PID:2888
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "DynamicHeteroCpuPolicyImportantPriority" /t REG_DWORD /d "8" /f
  2⤵
  PID:5548
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "SerializeTimerExpiration" /t REG_DWORD /d "2" /f
  2⤵
  PID:4848
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d "2" /f
  2⤵
  PID:1180
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "TimerCheckFlags" /t REG_DWORD /d "0" /f
  2⤵
  PID:5064
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 4 /f
  2⤵
  PID:3008
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 3 /f
  2⤵
  PID:1716
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v OverlayTestMode /t REG_DWORD /d 5 /f
  2⤵
  PID:4292
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v OverlayMinFPS /t REG_DWORD /d 0 /f
  2⤵
  PID:1364
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v DisableIndependentFlip /t REG_DWORD /d 0 /f
  2⤵
  PID:1312
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v DisableAdvancedDirectFlip /t REG_DWORD /d 0 /f
  2⤵
  PID:2556
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v ForceDisableFrameBuffering /t REG_DWORD /d 1 /f
  2⤵
  PID:2788
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v EnableDrawToBackbuffer /t REG_DWORD /d 0 /f
  2⤵
  PID:3344
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v DisableDrawListCaching /t REG_DWORD /d 1 /f
  2⤵
  PID:4360
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v EnableEffectCaching /t REG_DWORD /d 0 /f
  2⤵
  PID:5276
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v DisableDeviceBitmaps /t REG_DWORD /d 1 /f
  2⤵
  PID:4624
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v EnableAeroPeek /t REG_DWORD /d 0 /f
  2⤵
  PID:5880
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v Blur /t REG_DWORD /d 0 /f
  2⤵
  PID:5936
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v DisallowAnimations /t REG_DWORD /d 1 /f
  2⤵
  PID:5768
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v EnableImageProcessing /t REG_DWORD /d 0 /f
  2⤵
  PID:1972
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v EnableShadow /t REG_DWORD /d 0 /f
  2⤵
  PID:5488
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v AlwaysOffscreenComposition /t REG_DWORD /d 0 /f
  2⤵
  PID:5544
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm\ExtendedComposition" /v ExclusiveModeFramerateAveragingPeriodMs /t REG_DWORD /d 250 /f
  2⤵
  PID:3180
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm\ExtendedComposition" /v ExclusiveModeFramerateThresholdPercent /t REG_DWORD /d 10 /f
  2⤵
  PID:5364
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v DisableOverlays /t REG_DWORD /d 1 /f
  2⤵
  PID:5496
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v HwSchMode /t REG_DWORD /d 1 /f
  2⤵
  PID:1848
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v DwmInputUsesIoCompletionPort /t REG_DWORD /d 0 /f
  2⤵
  PID:3172
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v EnableDwmInputProcessing /t REG_DWORD /d 0 /f
  2⤵
  PID:1800
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe\PerfOptions" /v CpuPriorityClass /t REG_DWORD /d 1 /f
  2⤵
  PID:3000
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe\PerfOptions" /v IoPriority /t REG_DWORD /d 0 /f
  2⤵
  PID:3584
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync" /v SyncPolicy /t REG_DWORD /d 5 /f
  2⤵
  PID:1576
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Personalization" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:6044
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\BrowserSettings" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:4552
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Credentials" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2380
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Accessibility" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:3604
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\Groups\Windows" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:1844
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v EnableTransparency /t REG_DWORD /d 0 /f
  2⤵
  PID:5240
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\ApplicationManagement\AllowGameDVR" /v value /t REG_DWORD /d 0 /f
  2⤵
  PID:4844
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f
  2⤵
  PID:5180
- C:\Windows\System32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2220
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\GameDVR" /v AppCaptureEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:4828
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\GameBar" /v AllowAutoGameMode /t REG_DWORD /d 0 /f
  2⤵
  PID:4524
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\GameBar" /v AutoGameModeEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:1804
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\ApplicationManagement\AllowGameMode" /v value /t REG_DWORD /d 0 /f
  2⤵
  PID:920
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v HwSchMode /t REG_DWORD /d 0 /f
  2⤵
  PID:4924
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v DirectXUserGlobalSettings /t REG_SZ /d "VRROptimizeEnable=0;" /f
  2⤵
  PID:5384
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\MouseKeys" /v Flags /t REG_SZ /d 0 /f
  2⤵
  PID:3232
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 0 /f
  2⤵
  PID:5108
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v Flags /t REG_SZ /d 0 /f
  2⤵
  PID:1500
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v Flags /t REG_SZ /d 0 /f
  2⤵
  PID:3444
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2564
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\International\User Profile" /v HttpAcceptLanguageOptOut /t REG_DWORD /d 1 /f
  2⤵
  PID:3972
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_TrackProgs /t REG_DWORD /d 0 /f
  2⤵
  PID:560
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338393Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:4568
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-353694Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2024
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-353696Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2896
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Speech_OneCore\Settings\OnlineSpeechPrivacy" /v HasAccepted /t REG_DWORD /d 0 /f
  2⤵
  PID:3712
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Personalization\Settings" /v AcceptedPrivacyPolicy /t REG_DWORD /d 0 /f
  2⤵
  PID:3744
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\InputPersonalization" /v RestrictImplicitInkCollection /t REG_DWORD /d 1 /f
  2⤵
  PID:3060
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\InputPersonalization" /v RestrictImplicitTextCollection /t REG_DWORD /d 1 /f
  2⤵
  PID:4428
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore" /v HarvestContacts /t REG_DWORD /d 0 /f
  2⤵
  PID:5580
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
  2⤵
  PID:4928
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Privacy" /v TailoredExperiencesWithDiagnosticDataEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:5844
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\EventTranscriptKey" /v EnableEventTranscript /t REG_DWORD /d 0 /f
  2⤵
  PID:5088
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Siuf\Rules" /v NumberOfSIUFInPeriod /t REG_DWORD /d 0 /f
  2⤵
  PID:6040
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator"
  2⤵
  PID:3976
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /disable
  2⤵
  PID:1288
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM"
  2⤵
  PID:3692
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM" /disable
  2⤵
  PID:4232
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask"
  2⤵
  PID:5892
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /disable
  2⤵
  PID:4504
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip"
  2⤵
  PID:2972
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /disable
  2⤵
  PID:5032
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader"
  2⤵
  PID:5956
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader" /disable
  2⤵
  PID:4356
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"
  2⤵
  PID:3192
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable
  2⤵
  PID:5708
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater"
  2⤵
  PID:5344
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /disable
  2⤵
  PID:4132
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Application Experience\StartupAppTask"
  2⤵
  PID:3188
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /disable
  2⤵
  PID:300
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"
  2⤵
  PID:2712
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /disable
  2⤵
  PID:1512
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver"
  2⤵
  PID:5780
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /disable
  2⤵
  PID:2968
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"
  2⤵
  PID:3516
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /disable
  2⤵
  PID:428
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor"
  2⤵
  PID:5256
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor" /disable
  2⤵
  PID:5884
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh"
  2⤵
  PID:2400
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh" /disable
  2⤵
  PID:6024
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyUpload"
  2⤵
  PID:3324
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyUpload" /disable
  2⤵
  PID:5024
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Autochk\Proxy"
  2⤵
  PID:4948
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Autochk\Proxy" /disable
  2⤵
  PID:4784
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Maintenance\WinSAT"
  2⤵
  PID:1412
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Maintenance\WinSAT" /disable
  2⤵
  PID:4320
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Application Experience\AitAgent"
  2⤵
  PID:2872
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Application Experience\AitAgent" /disable
  2⤵
  PID:4092
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting"
  2⤵
  PID:3912
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting" /disable
  2⤵
  PID:3416
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask"
  2⤵
  PID:3372
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask" /disable
  2⤵
  PID:5408
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\DiskFootprint\Diagnostics"
  2⤵
  PID:3156
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\DiskFootprint\Diagnostics" /disable
  2⤵
  PID:1248
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)"
  2⤵
  PID:4724
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)" /disable
  2⤵
  PID:1812
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\PI\Sqm-Tasks"
  2⤵
  PID:1900
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\PI\Sqm-Tasks" /disable
  2⤵
  PID:4540
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo"
  2⤵
  PID:1168
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /disable
  2⤵
  PID:4960
- C:\Windows\System32\schtasks.exe
  schtasks /end /tn "\Microsoft\Windows\AppID\SmartScreenSpecific"
  2⤵
  PID:1112
- C:\Windows\System32\schtasks.exe
  schtasks /change /tn "\Microsoft\Windows\AppID\SmartScreenSpecific" /disable
  2⤵
  PID:3768
- C:\Windows\System32\reg.exe
  reg add "HKCU\Control Panel\PowerCfg\GlobalPowerPolicy" /v Policies /t REG_BINARY /d 01000000020000000100000000000000020000000000000000000000000000000000002C0100003232030304000000040000000000000000000000000000840300002C01000000000000840300000001646464640000 /f
  2⤵
  - Power Settings
  PID:2096
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v PublishUserActivities /t REG_DWORD /d 0 /f
  2⤵
  PID:5888
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v UploadUserActivities /t REG_DWORD /d 0 /f
  2⤵
  PID:6028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\usb_power_disable.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3008
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userNotificationListener" /v Value /t REG_SZ /d Deny /f
  2⤵
  PID:668
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location" /v Value /t REG_SZ /d Deny /f
  2⤵
  PID:824
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics" /v Value /t REG_SZ /d Deny /f
  2⤵
  PID:2856
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\userAccountInformation" /v Value /t REG_SZ /d Deny /f
  2⤵
  PID:4884
- C:\Windows\System32\reg.exe
  reg add "HKCR\*\shell\OpenWithNotepadMenu" /ve /t REG_SZ /d "Edit with Notepad++" /f
  2⤵
  PID:2228
- C:\Windows\System32\reg.exe
  reg add "HKCR\*\shell\OpenWithNotepadMenu" /v Icon /t REG_SZ /d "C:\Program Files\Notepad++\notepad++.exe,0" /f
  2⤵
  PID:4852
- C:\Windows\System32\reg.exe
  reg add "HKCR\*\shell\OpenWithNotepadMenu\command" /ve /t REG_SZ /d "\"C:\Program Files\Notepad++\notepad++.exe\" \"%1\"" /f
  2⤵
  PID:4656
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications" /v GlobalUserDisabled /t REG_DWORD /d 1 /f
  2⤵
  PID:2472
- C:\Windows\System32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v BackgroundAppGlobalToggle /t REG_DWORD /d 0 /f
  2⤵
  PID:1288
- C:\Windows\System32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\ScheduledDiagnostics" /v "EnabledExecution" /t REG_DWORD /d "0" /f
  2⤵
  PID:1484
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Dsh" /v "AllowNewsAndInterests" /t REG_DWORD /d "0" /f
  2⤵
  PID:3996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope LocalMachine -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3920
- C:\Windows\System32\sc.exe
  sc config LanmanWorkstation start=demand
  2⤵
  - Launches sc.exe
  PID:5344
- C:\Windows\System32\sc.exe
  sc config WdiServiceHost start=demand
  2⤵
  PID:2308
- C:\Windows\System32\sc.exe
  sc config NcbService start=demand
  2⤵
  - Launches sc.exe
  PID:200
- C:\Windows\System32\sc.exe
  sc config ndu start=demand
  2⤵
  - Launches sc.exe
  PID:4336
- C:\Windows\System32\sc.exe
  sc config Netman start=demand
  2⤵
  PID:4996
- C:\Windows\System32\sc.exe
  sc config netprofm start=demand
  2⤵
  PID:2712
- C:\Windows\System32\sc.exe
  sc config WwanSvc start=demand
  2⤵
  PID:5960
- C:\Windows\System32\sc.exe
  sc config Dhcp start=auto
  2⤵
  PID:2016
- C:\Windows\System32\sc.exe
  sc config DPS start=auto
  2⤵
  PID:4416
- C:\Windows\System32\sc.exe
  sc config lmhosts start=auto
  2⤵
  - Launches sc.exe
  PID:3844
- C:\Windows\System32\sc.exe
  sc config NlaSvc start=auto
  2⤵
  - Launches sc.exe
  PID:3516
- C:\Windows\System32\sc.exe
  sc config nsi start=auto
  2⤵
  PID:3684
- C:\Windows\System32\sc.exe
  sc config RmSvc start=auto
  2⤵
  PID:428
- C:\Windows\System32\sc.exe
  sc config Wcmsvc start=auto
  2⤵
  PID:3292
- C:\Windows\System32\sc.exe
  sc config Winmgmt start=auto
  2⤵
  PID:2744
- C:\Windows\System32\sc.exe
  sc config WlanSvc start=auto
  2⤵
  PID:2592
- C:\Windows\System32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator" /v NoActiveProbe /t REG_DWORD /d 0 /f
  2⤵
  PID:3932
- C:\Windows\System32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v EnableActiveProbing /t REG_DWORD /d 1 /f
  2⤵
  PID:6024
- C:\Windows\System32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\BFE" /v Start /t REG_DWORD /d 2 /f
  2⤵
  PID:4916
- C:\Windows\System32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\Dnscache" /v Start /t REG_DWORD /d 2 /f
  2⤵
  PID:5024
- C:\Windows\System32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\WinHttpAutoProxySvc" /v Start /t REG_DWORD /d 3 /f
  2⤵
  PID:4704
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\vwifibus" /v Start /t REG_DWORD /d 3 /f
  2⤵
  PID:4784
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\vwififlt" /v Start /t REG_DWORD /d 3 /f
  2⤵
  PID:816
- C:\Windows\System32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\vwifimp" /v Start /t REG_DWORD /d 3 /f
  2⤵
  PID:1856
- C:\Windows\System32\ipconfig.exe
  ipconfig /release
  2⤵
  - Gathers network information
  PID:5988
- C:\Windows\System32\ipconfig.exe
  ipconfig /renew
  2⤵
  - Gathers network information
  PID:3732
- C:\Windows\System32\ARP.EXE
  arp -d *
  2⤵
  PID:4968
- C:\Windows\System32\nbtstat.exe
  nbtstat -R
  2⤵
  PID:5952
- C:\Windows\System32\nbtstat.exe
  nbtstat -RR
  2⤵
  PID:848
- C:\Windows\System32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:1816
- C:\Windows\System32\ipconfig.exe
  ipconfig /registerdns
  2⤵
  - Gathers network information
  PID:3552
- C:\Windows\System32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4976
- C:\Windows\System32\shutdown.exe
  shutdown /r -t 10
  2⤵
  PID:4992

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:920

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5104

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3536

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:5200

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:1480

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3604

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:4240

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:5584

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38b7055 /state1:0x41c64e6d
1⤵
PID:5720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 813cba1a8675055f580767cf2b618286461adb840d8babaa24fb1f43c7e2bcf9
MD5 3b494e56c0e8b70c64ee9a8d20ffdd61
SHA1 19103030dfbaeb43355a79528419d7e5d8e9751f
SHA512 3612c65df360b5d94d49bd71f8189fbb2ed3efc7803bb2455e9f08adf0240c97019fe3efcc71578c2f0407aa4485462572c5ca0f894c1a59b4b6153e733ad63d
TLSH
T133217473F3DC8264DC5A403640DEAC1136AAC7CB819ECE9B7B94D150B43F6A9CE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 562c89b59df710d6fb590dcedd971c39a1cb0932d85a4837b03d8ab8fb7e9bd7
MD5 87f48c2e4c0e61f3220d20cec10f51c1
SHA1 3950da2533da9310f28eabf961188e8f7105084e
SHA512 25326211c0d944af7417a18b28be1b650eb37fba25a82ae424fcc0eab68a2d70e84830aff3fd6410c49d193716a84cbe7b780488ccdaf35170eeba00e318c8a0
TLSH
T1B6219833F3DC8614CC99003A10DEAC1036B6C7DB40DECF9B6B85E159A82F298DF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 702e1c69435c62b7f4f906f46f56c71350e8dc25611d7d51e9075e08b7b01dc6
MD5 31b0ff40077b0a6f5acfd2784a652e53
SHA1 b2d2bb9671502c45abcd756c6d7137c2944a751f
SHA512 ac2e3e4e315cf2f3baf74fd565913b4047d6525672d85d56c0c8ec6a1e22217e7883b5c02572176044b27e685ff75492401570d19de1ff333d932b6bb29de271
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_thvb440h.utf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_thvb440h.utf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

usb_power_disable.ps1

Path C:\Users\Admin\AppData\Local\Temp\usb_power_disable.ps1
Size 2KB
SHA256 7f900e6a364758bec7ae35c586423f1792b93ca086fd425231f27eddc408834f
MD5 786503cc062fab078c2e686e28683fe5
SHA1 7565dd48846a2462d464f934e6539b211a6a3f78
SHA512 a3f006f792568f3bf4a1e97acef0dc2d62fc84c5d5ccec0097e8d283a0f99c689cad691f64a13a6bb7889dc921aebf2bea18a2a46da250d52b7d7d66f078f5c5
TLSH
T19051DB245749160D1AB7409F2C20AA58EDC7526FC1D7AFC0B19CA8347FF6A5E8227833
MD5 SHA1 SHA512 TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 288KB
SHA256 02543550665bb42840ed252dad71b1e5dc802de312356daac8815ed8563d9290
MD5 98402507f7de190f157568d667341aa9
SHA1 245d44e303b992f8f33471ca952148dd917be16d
SHA512 af72f2de0c1d072cf82096f2543d13678fea64edbd835c9576e92ab55c85497e9f04e599c46056cbd0a3cf7026a12e6a7e283b7f5f4c94068e5b70e75a7467f5
SSDEEP 1536:7i2pzlgqlYoCA6Y/7DYyMdXGY4XNc/nCpTPlW3U8ol3Nblaw0kYsra85bri0LoHL:7rXpTkI8odM
TLSH
T13554AD1E57AF4DB1A149C40371799AED62D7B083AAC8F314772FD22A77C258B8E1F580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1480-77-0x0000027D5C010000-0x0000027D5C4F8000-memory.dmp

Download

memory/2276-97-0x0000000003C90000-0x0000000003C91000-memory.dmp

Download

memory/3008-76-0x000001E0ACC00000-0x000001E0ACC24000-memory.dmp

Download

memory/3008-72-0x000001E0AC670000-0x000001E0AC68E000-memory.dmp

Download

memory/3008-75-0x000001E0ACC00000-0x000001E0ACC2A000-memory.dmp

Download

memory/3008-74-0x000001E0AC690000-0x000001E0AC69A000-memory.dmp

Download

memory/3008-73-0x000001E0AC8C0000-0x000001E0AC972000-memory.dmp

Download

memory/3012-88-0x0000023CF63F0000-0x0000023CF640E000-memory.dmp

Download

memory/3144-15-0x00000144F1370000-0x00000144F1378000-memory.dmp

Download

memory/3144-14-0x00000144F0E30000-0x00000144F0E52000-memory.dmp

Download

memory/3604-78-0x000001E0E96E0000-0x000001E0E9BC8000-memory.dmp

Download

memory/4240-79-0x000002350B110000-0x000002350B5F8000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads