7dd7f94878ccad720f3a758940cfb0105250f0c989a868502f6fc3ad7a3a6963

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ret4ke 0 delay v2.bat
Size 12KB
Sample260824-vcdeya1brb
SHA256 7dd7f94878ccad720f3a758940cfb0105250f0c989a868502f6fc3ad7a3a6963
MD5 ec0726f0a9745af7a6425683b26a2eff
SHA1 91335f5b50c7ab44f9e239a69a69a642becc8308
SHA512 0a283d2dcc9aebc522bbaca4d6dc3fef907fcdb8c93dfca733bb5eb3013cc9ce2a3418a66c2530aa17045439bc209c4da2e3e81f9e6b08b1b9f2692e834ccea7
SSDEEP 96:XgDCI272ZggaLApx12u2Ff4+a21QsjugjgWkXRYR7kR7sRP9rKYyhEgm+rCwipkb:3rFw+JNkwkunlubbB
TLSH
T12252631059BB4272C596E224BB53F923DBBBB8C760C4879139D9350E00DBC8F847E2E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5060	powershell.exe
4480	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 63 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4224	cmd.exe
5976	cmd.exe
3548	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3756	reg.exe
2540	reg.exe
5008	reg.exe
1008	reg.exe
3296	reg.exe
3256	reg.exe
4124	reg.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1608	reg.exe
1348	netsh.exe
1716	reg.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5168	WMIC.exe
5168	WMIC.exe
5168	WMIC.exe
5168	WMIC.exe
2232	WMIC.exe
2232	WMIC.exe
2232	WMIC.exe
2232	WMIC.exe
1556	powershell.exe
1556	powershell.exe
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5168	WMIC.exe
Token: SeSecurityPrivilege	5168	WMIC.exe
Token: SeTakeOwnershipPrivilege	5168	WMIC.exe
Token: SeLoadDriverPrivilege	5168	WMIC.exe
Token: SeSystemProfilePrivilege	5168	WMIC.exe
Token: SeSystemtimePrivilege	5168	WMIC.exe
Token: SeProfSingleProcessPrivilege	5168	WMIC.exe
Token: SeIncBasePriorityPrivilege	5168	WMIC.exe
Token: SeCreatePagefilePrivilege	5168	WMIC.exe
Token: SeBackupPrivilege	5168	WMIC.exe
Token: SeRestorePrivilege	5168	WMIC.exe
Token: SeShutdownPrivilege	5168	WMIC.exe
Token: SeDebugPrivilege	5168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5168	WMIC.exe
Token: SeRemoteShutdownPrivilege	5168	WMIC.exe
Token: SeUndockPrivilege	5168	WMIC.exe
Token: SeManageVolumePrivilege	5168	WMIC.exe
Token: 33	5168	WMIC.exe
Token: 34	5168	WMIC.exe
Token: 35	5168	WMIC.exe
Token: 36	5168	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5168	WMIC.exe
Token: SeSecurityPrivilege	5168	WMIC.exe
Token: SeTakeOwnershipPrivilege	5168	WMIC.exe
Token: SeLoadDriverPrivilege	5168	WMIC.exe
Token: SeSystemProfilePrivilege	5168	WMIC.exe
Token: SeSystemtimePrivilege	5168	WMIC.exe
Token: SeProfSingleProcessPrivilege	5168	WMIC.exe
Token: SeIncBasePriorityPrivilege	5168	WMIC.exe
Token: SeCreatePagefilePrivilege	5168	WMIC.exe
Token: SeBackupPrivilege	5168	WMIC.exe
Token: SeRestorePrivilege	5168	WMIC.exe
Token: SeShutdownPrivilege	5168	WMIC.exe
Token: SeDebugPrivilege	5168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5168	WMIC.exe
Token: SeRemoteShutdownPrivilege	5168	WMIC.exe
Token: SeUndockPrivilege	5168	WMIC.exe
Token: SeManageVolumePrivilege	5168	WMIC.exe
Token: 33	5168	WMIC.exe
Token: 34	5168	WMIC.exe
Token: 35	5168	WMIC.exe
Token: 36	5168	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2232	WMIC.exe
Token: SeSecurityPrivilege	2232	WMIC.exe
Token: SeTakeOwnershipPrivilege	2232	WMIC.exe
Token: SeLoadDriverPrivilege	2232	WMIC.exe
Token: SeSystemProfilePrivilege	2232	WMIC.exe
Token: SeSystemtimePrivilege	2232	WMIC.exe
Token: SeProfSingleProcessPrivilege	2232	WMIC.exe
Token: SeIncBasePriorityPrivilege	2232	WMIC.exe
Token: SeCreatePagefilePrivilege	2232	WMIC.exe
Token: SeBackupPrivilege	2232	WMIC.exe
Token: SeRestorePrivilege	2232	WMIC.exe
Token: SeShutdownPrivilege	2232	WMIC.exe
Token: SeDebugPrivilege	2232	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2232	WMIC.exe
Token: SeRemoteShutdownPrivilege	2232	WMIC.exe
Token: SeUndockPrivilege	2232	WMIC.exe
Token: SeManageVolumePrivilege	2232	WMIC.exe
Token: 33	2232	WMIC.exe
Token: 34	2232	WMIC.exe
Token: 35	2232	WMIC.exe
Token: 36	2232	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2232	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4300	4224	cmd.exe	90
PID 4224 wrote to memory of 3628	4224	cmd.exe	91
PID 4224 wrote to memory of 4160	4224	cmd.exe	92
PID 4224 wrote to memory of 3064	4224	cmd.exe	93
PID 4224 wrote to memory of 4304	4224	cmd.exe	94
PID 4224 wrote to memory of 1728	4224	cmd.exe	95
PID 4224 wrote to memory of 3660	4224	cmd.exe	96
PID 4224 wrote to memory of 4592	4224	cmd.exe	97
PID 4224 wrote to memory of 1716	4224	cmd.exe	98
PID 4224 wrote to memory of 1608	4224	cmd.exe	99
PID 4224 wrote to memory of 4396	4224	cmd.exe	100
PID 4224 wrote to memory of 2364	4224	cmd.exe	101
PID 4224 wrote to memory of 5844	4224	cmd.exe	102
PID 4224 wrote to memory of 3508	4224	cmd.exe	103
PID 4224 wrote to memory of 2984	4224	cmd.exe	104
PID 4224 wrote to memory of 1512	4224	cmd.exe	105
PID 4224 wrote to memory of 2728	4224	cmd.exe	106
PID 4224 wrote to memory of 5036	4224	cmd.exe	107
PID 4224 wrote to memory of 3440	4224	cmd.exe	108
PID 4224 wrote to memory of 4784	4224	cmd.exe	109
PID 4224 wrote to memory of 3320	4224	cmd.exe	110
PID 4224 wrote to memory of 6008	4224	cmd.exe	111
PID 4224 wrote to memory of 3432	4224	cmd.exe	112
PID 4224 wrote to memory of 1224	4224	cmd.exe	113
PID 4224 wrote to memory of 2756	4224	cmd.exe	114
PID 4224 wrote to memory of 5276	4224	cmd.exe	115
PID 4224 wrote to memory of 4760	4224	cmd.exe	116
PID 4224 wrote to memory of 1160	4224	cmd.exe	117
PID 4224 wrote to memory of 1288	4224	cmd.exe	118
PID 4224 wrote to memory of 1100	4224	cmd.exe	119
PID 4224 wrote to memory of 5692	4224	cmd.exe	120
PID 4224 wrote to memory of 5032	4224	cmd.exe	121
PID 4224 wrote to memory of 756	4224	cmd.exe	122
PID 4224 wrote to memory of 1516	4224	cmd.exe	123
PID 4224 wrote to memory of 4576	4224	cmd.exe	124
PID 4224 wrote to memory of 2560	4224	cmd.exe	125
PID 4224 wrote to memory of 5880	4224	cmd.exe	126
PID 4224 wrote to memory of 4428	4224	cmd.exe	127
PID 4224 wrote to memory of 2076	4224	cmd.exe	128
PID 4224 wrote to memory of 3764	4224	cmd.exe	129
PID 4224 wrote to memory of 4828	4224	cmd.exe	130
PID 4224 wrote to memory of 4552	4224	cmd.exe	131
PID 4224 wrote to memory of 4484	4224	cmd.exe	132
PID 4224 wrote to memory of 5316	4224	cmd.exe	133
PID 4224 wrote to memory of 3780	4224	cmd.exe	134
PID 4224 wrote to memory of 5944	4224	cmd.exe	135
PID 4224 wrote to memory of 6040	4224	cmd.exe	136
PID 4224 wrote to memory of 360	4224	cmd.exe	137
PID 4224 wrote to memory of 252	4224	cmd.exe	138
PID 4224 wrote to memory of 6132	4224	cmd.exe	139
PID 4224 wrote to memory of 5096	4224	cmd.exe	140
PID 4224 wrote to memory of 3032	4224	cmd.exe	141
PID 4224 wrote to memory of 1656	4224	cmd.exe	142
PID 4224 wrote to memory of 2864	4224	cmd.exe	143
PID 4224 wrote to memory of 3544	4224	cmd.exe	144
PID 4224 wrote to memory of 3924	4224	cmd.exe	145
PID 4224 wrote to memory of 5976	4224	cmd.exe	146
PID 5976 wrote to memory of 5168	5976	cmd.exe	147
PID 5976 wrote to memory of 5768	5976	cmd.exe	148
PID 4224 wrote to memory of 1292	4224	cmd.exe	150
PID 4224 wrote to memory of 3604	4224	cmd.exe	151
PID 4224 wrote to memory of 1236	4224	cmd.exe	152
PID 4224 wrote to memory of 6032	4224	cmd.exe	153
PID 4224 wrote to memory of 3548	4224	cmd.exe	154

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ret4ke 0 delay v2.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS" /v "Tcp Autotuning Level" /t REG_SZ /d "Off" /f
  2⤵
  PID:4300
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS" /v "Tcp Autotuning Level" /t REG_SZ /d "Highly Restricted" /f
  2⤵
  PID:3628
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS" /v "Tcp Autotuning Level" /t REG_SZ /d "Restricted" /f
  2⤵
  PID:4160
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS" /v "Tcp Autotuning Level" /t REG_SZ /d "Normal" /f
  2⤵
  PID:3064
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS" /v "Application DSCP Marking Request" /t REG_SZ /d "Ignored" /f
  2⤵
  PID:4304
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS" /v "Application DSCP Marking Request" /t REG_SZ /d "Allowed" /f
  2⤵
  PID:1728
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\services\Tcpip\QoS" /v "Do not use NLA" /t REG_SZ /d "1" /f
  2⤵
  PID:3660
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DisableUserTOSSetting" /t REG_DWORD /d "0" /f
  2⤵
  PID:4592
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet" /v "CorpLocationProbeTimeout" /t REG_DWORD /d "30" /f
  2⤵
  - System Time Discovery
  PID:1716
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet" /v "LdapTimeoutMs" /t REG_DWORD /d "5000" /f
  2⤵
  - System Time Discovery
  PID:1608
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet" /v "ShowDomainEndpointInterfaces" /t REG_DWORD /d "1" /f
  2⤵
  PID:4396
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet" /v "EnableNoGatewayLocationDetection" /t REG_DWORD /d "1" /f
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet" /v "MinimumInternetHopCount" /t REG_DWORD /d "2" /f
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v "RmGpsPsEnablePerCpuCoreDpc" /t REG_DWORD /d "1" /f
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Power" /v "RmGpsPsEnablePerCpuCoreDpc" /t REG_DWORD /d "1" /f
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "RmGpsPsEnablePerCpuCoreDpc" /t REG_DWORD /d "1" /f
  2⤵
  PID:1512
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\NVAPI" /v "RmGpsPsEnablePerCpuCoreDpc" /t REG_DWORD /d "1" /f
  2⤵
  PID:2728
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\NVTweak" /v "RmGpsPsEnablePerCpuCoreDpc" /t REG_DWORD /d "1" /f
  2⤵
  PID:5036
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability" /v "TimeStampInterval" /t REG_DWORD /d "0" /f
  2⤵
  PID:3440
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Diagnostics\Performance" /F /V "DisableDiagnosticTracing" /T REG_DWORD /d 1
  2⤵
  PID:4784
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" /F /V "EventProcessorEnabled" /T REG_DWORD /d 0
  2⤵
  PID:3320
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /F /V "MonitorLatencyTolerance" /T REG_DWORD /d 0
  2⤵
  PID:6008
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\DXGKrnl" /F /V "MonitorRefreshLatencyTolerance" /T REG_DWORD /d 0
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_CURRENT_USER\Control Panel\Desktop" /F /V "MenuShowDelay" /T REG_SZ /d 0
  2⤵
  PID:1224
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_CURRENT_USER\Control Panel\Mouse" /F /V "MouseSensitivity" /T REG_SZ /d 0
  2⤵
  PID:2756
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_CURRENT_USER\Control Panel\Mouse" /F /V "SmoothMouseXCurve" /T REG_BINARY /d 0000000000000000C0CC0C0000000000809919000000000040662600000000000033330000000000
  2⤵
  PID:5276
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_CURRENT_USER\Control Panel\Mouse" /F /V "SmoothMouseYCurve" /T REG_BINARY /d 0000000000000000000038000000000000007000000000000000A800000000000000E00000000000
  2⤵
  PID:4760
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_CURRENT_USER\Control Panel\Mouse" /F /V "MouseSpeed" /T REG_SZ /d 0
  2⤵
  PID:1160
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_CURRENT_USER\Control Panel\Mouse" /F /V "MouseThreshold1" /T REG_SZ /d 0
  2⤵
  PID:1288
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_CURRENT_USER\Control Panel\Mouse" /F /V "MouseThreshold2" /T REG_SZ /d 0
  2⤵
  PID:1100
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "ConvertibleSlateMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:5692
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl" /v "Win32PrioritySeparation" /t REG_DWORD /d "40" /f
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Update" /v "ExcludeWUDriversInQualityUpdate" /t REG_DWORD /d "1" /f
  2⤵
  PID:756
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\PolicyManager\default\Update" /v "ExcludeWUDriversInQualityUpdate" /t REG_DWORD /d "1" /f
  2⤵
  PID:1516
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\PolicyManager\default\Update\ExcludeWUDriversInQualityUpdate" /v "value" /t REG_DWORD /d "1" /f
  2⤵
  PID:4576
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v "ExcludeWUDriversInQualityUpdate" /t REG_DWORD /d "1" /f
  2⤵
  PID:2560
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "ExcludeWUDriversInQualityUpdate" /t REG_DWORD /d "1" /f
  2⤵
  PID:5880
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /t REG_DWORD /d "3" /f
  2⤵
  PID:4428
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v "DragFullWindows" /t REG_SZ /d "0" /f reg add "HKCU\Control Panel\Desktop" /v "FontSmoothing" /t REG_SZ /d "2" /f
  2⤵
  PID:2076
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v "UserPreferencesMask" /t REG_BINARY /d "9012038010020000" /f
  2⤵
  PID:3764
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop\WindowMetrics" /v "MinAnimate" /t REG_SZ /d "0" /f
  2⤵
  PID:4828
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "ShellState" /t REG_BINARY /d "240000003E28000000000000000000000000000001000000130000000000000072000000" /f
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "IconsOnly" /t REG_DWORD /d "1" /f
  2⤵
  PID:4484
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewAlphaSelect" /t REG_DWORD /d "0" /f
  2⤵
  PID:5316
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewShadow" /t REG_DWORD /d "0" /f
  2⤵
  PID:3780
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d "0" /f
  2⤵
  PID:5944
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d "1" /f
  2⤵
  PID:6040
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF" /v "LogEnable" /t REG_DWORD /d "0" /f reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF" /v "LogLevel" /t REG_DWORD /d "0" /f
  2⤵
  PID:360
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:252
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Privacy" /v "TailoredExperiencesWithDiagnosticDataEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:6132
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Control\WMI\AutoLogger\AutoLogger-Diagtrack-Listener" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:5096
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Control\WMI\AutoLogger\SQMLogger" /v "Start" /t REG_DWORD /d "0" /f
  2⤵
  PID:3032
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\SQMClient\Windows" /v "CEIPEnable" /t REG_DWORD /d "0" /f
  2⤵
  PID:1656
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\SQMClient" /v "CorporateSQMURL" /t REG_SZ /d "0.0.0.0" /f
  2⤵
  PID:2864
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters" /v "KeyboardDataQueueSize" /t REG_DWORD /d "16" /f reg add "HKLM\SYSTEM\CurrentControlSet\Services\mouclass\Parameters" /v "MouseDataQueueSize" /t REG_DWORD /d "16" /f
  2⤵
  PID:3544
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings" /v "DownloadMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:3924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic PATH Win32_PnPEntity GET DeviceID | findstr /l "USB\VID_"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_PnPEntity GET DeviceID
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5168
- - C:\Windows\system32\findstr.exe
    findstr /l "USB\VID_"
    3⤵
    PID:5768
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\ControlSet001\Enum\USB\VID_0222&PID_0001\28754-0000:00:04.0-1\Device Parameters" /v SelectiveSuspendOn /t REG_DWORD /d 00000000 /f
  2⤵
  PID:1292
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\ControlSet001\Enum\USB\VID_0222&PID_0001\28754-0000:00:04.0-1\Device Parameters" /v SelectiveSuspendEnabled /t REG_BINARY /d 00 /f
  2⤵
  PID:3604
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\ControlSet001\Enum\USB\VID_0222&PID_0001\28754-0000:00:04.0-1\Device Parameters" /v EnhancedPowerManagementEnabled /t REG_DWORD /d 00000000 /f
  2⤵
  PID:1236
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\ControlSet001\Enum\USB\VID_0222&PID_0001\28754-0000:00:04.0-1\Device Parameters" /v AllowIdleIrpInD3 /t REG_DWORD /d 00000000 /f
  2⤵
  PID:6032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic PATH Win32_USBHub GET DeviceID | findstr /l "USB\ROOT_HUB"
  2⤵
  - Executes a command shell one-liner
  PID:3548
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_USBHub GET DeviceID
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- - C:\Windows\system32\findstr.exe
    findstr /l "USB\ROOT_HUB"
    3⤵
    PID:4812
- C:\Windows\system32\reg.exe
  reg.exe add "HKLM\SYSTEM\ControlSet001\Enum\USB\ROOT_HUB20\4&3104EFD0&0\Device Parameters\WDF" /v IdleInWorkingState /t REG_DWORD /d 00000000 /f
  2⤵
  PID:3268
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 3 /f reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f
  2⤵
  PID:3028
- C:\Windows\system32\netsh.exe
  netsh interface teredo set state disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4688
- C:\Windows\system32\netsh.exe
  netsh interface 6to4 set state disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4248
- C:\Windows\system32\netsh.exe
  netsh winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6024
- C:\Windows\system32\netsh.exe
  netsh int isatap set state disable
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2288
- C:\Windows\system32\netsh.exe
  netsh int ip set global taskoffload=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3136
- C:\Windows\system32\netsh.exe
  netsh int ip set global neighborcachelimit=4096
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5580
- C:\Windows\system32\netsh.exe
  netsh int tcp set global timestamps=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:1348
- C:\Windows\system32\netsh.exe
  netsh int tcp set heuristics disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5856
- C:\Windows\system32\netsh.exe
  netsh int tcp set global autotuninglevel=disable
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4316
- C:\Windows\system32\netsh.exe
  netsh int tcp set global chimney=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5612
- C:\Windows\system32\netsh.exe
  netsh int tcp set global ecncapability=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1480
- C:\Windows\system32\netsh.exe
  netsh int tcp set global rss=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2852
- C:\Windows\system32\netsh.exe
  netsh int tcp set global rsc=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:892
- C:\Windows\system32\netsh.exe
  netsh int tcp set global dca=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1776
- C:\Windows\system32\netsh.exe
  netsh int tcp set global netdma=enabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1168
- C:\Windows\system32\netsh.exe
  netsh int tcp set global nonsackrttresiliency=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2120
- C:\Windows\system32\netsh.exe
  netsh int tcp set security mpp=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1392
- C:\Windows\system32\netsh.exe
  netsh int tcp set security profiles=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5744
- C:\Windows\system32\netsh.exe
  netsh int ip set global icmpredirects=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2772
- C:\Windows\system32\netsh.exe
  netsh int tcp set security mpp=disabled profiles=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3948
- C:\Windows\system32\netsh.exe
  netsh int ip set global multicastforwarding=disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell Disable-NetAdapterLso -Name "*"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "ForEach($adapter In Get-NetAdapter){Disable-NetAdapterPowerManagement -Name $adapter.Name -ErrorAction SilentlyContinue}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "ForEach($adapter In Get-NetAdapter){Disable-NetAdapterLso -Name $adapter.Name -ErrorAction SilentlyContinue}"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnableICMPRedirect" /t REG_DWORD /d "1" /f
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "EnablePMTUDiscovery" /t REG_DWORD /d "1" /f
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "Tcp1323Opts" /t REG_DWORD /d "0" /f
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpMaxDupAcks" /t REG_DWORD /d "2" /f
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpTimedWaitDelay" /t REG_DWORD /d "32" /f
  2⤵
  PID:1512
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "GlobalMaxTcpWindowSize" /t REG_DWORD /d "8760" /f
  2⤵
  PID:2728
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "TcpWindowSize" /t REG_DWORD /d "8760" /f
  2⤵
  PID:5036
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxConnectionsPerServer" /t REG_DWORD /d "0" /f
  2⤵
  PID:4364
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "MaxUserPort" /t REG_DWORD /d "65534" /f
  2⤵
  PID:4808
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "SackOpts" /t REG_DWORD /d "0" /f
  2⤵
  PID:3320
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v "DefaultTTL" /t REG_DWORD /d "64" /f
  2⤵
  PID:5492
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v "NetworkThrottlingIndex" /t REG_SZ /d "ffffffff" /f
  2⤵
  PID:6064
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SOftWARE\Policies\Microsoft\Windows\QoS\fortnite" /v "Application Name" /t REG_SZ /d "fortniteclient-win64-shipping.exe" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4124
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SOftWARE\Policies\Microsoft\Windows\QoS\fortnite" /v "DSCP value" /t REG_SZ /d "46" /f
  2⤵
  PID:5476
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SOftWARE\Policies\Microsoft\Windows\QoS\fortnite" /v "Local IP" /t REG_SZ /d "*" /f
  2⤵
  PID:2776
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SOftWARE\Policies\Microsoft\Windows\QoS\fortnite" /v "Local IP Prefix Length" /t REG_SZ /d "*" /f
  2⤵
  PID:4632
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SOftWARE\Policies\Microsoft\Windows\QoS\fortnite" /v "Local Port" /t REG_SZ /d "*" /f
  2⤵
  PID:2044
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SOftWARE\Policies\Microsoft\Windows\QoS\fortnite" /v "Protocol" /t REG_SZ /d "UDP" /f
  2⤵
  PID:5780
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SOftWARE\Policies\Microsoft\Windows\QoS\fortnite" /v "Remote IP" /t REG_SZ /d "*" /f
  2⤵
  PID:3528
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SOftWARE\Policies\Microsoft\Windows\QoS\fortnite" /v "Remote IP Prefix Length" /t REG_SZ /d "*" /f
  2⤵
  PID:2368
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SOftWARE\Policies\Microsoft\Windows\QoS\fortnite" /v "Remote Port" /t REG_SZ /d "*" /f
  2⤵
  PID:4608
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SOftWARE\Policies\Microsoft\Windows\QoS\fortnite" /v "throttle Rate" /t REG_SZ /d "-1" /f
  2⤵
  PID:1140
- C:\Windows\system32\reg.exe
  REG ADD "HKEY_LOCAL_MACHINE\SOftWARE\Policies\Microsoft\Windows\QoS\fortnite" /v "version" /t REG_SZ /d "1.0" /f
  2⤵
  PID:2152
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\pci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3756
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\rt640x64\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2540
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\storahci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5008
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1008
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\USBXHCI\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3296
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\pci\Parameters" /v "DmaRemappingCompatible" /t REG_DWORD /d "0" /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6fa817959ced0745e6525d7d02cb46169d523bede9e98875e86985bd6c7c813d
MD5 b8bd38654857618ffdea2144de769df7
SHA1 1ae0dd8a7216accb59f8ae0014edc1e067277a8f
SHA512 9eb121904823346aa8f1abe4e331f9a389883b0f32b2dfb6111ae8d12b7f4787ed984f3c191f28117f2230e0bbff7845453f2046ffe516c9117538fd37d41490
TLSH
T16B216833B3DD8625CC9A413A10CDAC1036BAC7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d51019a65da8fb94a47a7907934f576381151575a5ced212b65b0ed0fff9ea88
MD5 c1f26fb0160d7e829cafc7987862da8a
SHA1 4c5f9c9acfef19a28482e232f75521be253f0704
SHA512 06b4afea5c1d8b63f95734d152d7b3f02d95ae58965b63a109505a31d3a98ade22a7c80378443d4e66eee04397b3071ff85315ca0dac641567dbe49852dda4fc
TLSH
T1C0216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qboa3vgu.tgf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qboa3vgu.tgf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1556-1-0x0000023248330000-0x0000023248352000-memory.dmp

Download

memory/1556-5-0x00000232483E0000-0x00000232483FE000-memory.dmp

Download

memory/1556-6-0x0000023248400000-0x00000232484B2000-memory.dmp

Download

memory/1556-7-0x00000232484C0000-0x00000232484CA000-memory.dmp

Download

memory/1556-8-0x00000232484F0000-0x000002324850E000-memory.dmp

Download