093c4cfa423821efd53e0b04e18845f5301a2fc93206429f3622a5f4a91a308b

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app-knowledge-export.exe
Size 5.4MB
Sample260908-dazrqabq21
SHA256 093c4cfa423821efd53e0b04e18845f5301a2fc93206429f3622a5f4a91a308b
MD5 c16abae26018eb4f1a37bf585754547c
SHA1 12177bbce2e1d4b501060fc2f8c157b7e59572fc
SHA512 deb4144a8510c767d53f5bb622ffc551bd47a39aae36a62a3765703d61f467cd6420fcb4c24cce86ac693379d322690f48c70c1977758250401e1720aa880c7f
SSDEEP 49152:lcZ4634BOzxbFg8waV3jVbnHlj6RNjLjv+D0XaOZa+UUEolqyKyTbrz11I:uvq+ww0z1
TLSH
T1CA466C18DB692E7B848D7576A8060D336A20657B1F11342E339CD25C2F8ED6F81BD2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1484	powershell.exe
1924	powershell.exe
932	powershell.exe
3624	powershell.exe
3316	powershell.exe

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
3336	bcdedit.exe

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
720	powercfg.exe
4292	powercfg.exe
5360	powercfg.exe
488	powercfg.exe
2532	powercfg.exe
1324	powercfg.exe
5220	powercfg.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 7 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
964	powershell.exe
5392	powershell.exe
6088	powershell.exe
5744	powershell.exe
1484	powershell.exe
2400	powershell.exe
1476	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies registry key 1 TTPs 58 IoCs

Modify Registry

T1112

pid	Process
2408	reg.exe
4952	reg.exe
5792	reg.exe
2788	reg.exe
300	reg.exe
3276	reg.exe
2396	reg.exe
4436	reg.exe
2932	reg.exe
1036	reg.exe
5872	reg.exe
4248	reg.exe
4732	reg.exe
4248	reg.exe
4928	reg.exe
2960	reg.exe
4372	reg.exe
1468	reg.exe
5004	reg.exe
2228	reg.exe
1028	reg.exe
2424	reg.exe
5808	reg.exe
3272	reg.exe
1620	reg.exe
5704	reg.exe
984	reg.exe
4816	reg.exe
972	reg.exe
4080	reg.exe
3176	reg.exe
4236	reg.exe
1196	reg.exe
1224	reg.exe
5004	reg.exe
1240	reg.exe
4516	reg.exe
4184	reg.exe
2180	reg.exe
984	reg.exe
2384	reg.exe
4168	reg.exe
2848	reg.exe
3760	reg.exe
2872	reg.exe
1700	reg.exe
4420	reg.exe
4640	reg.exe
5952	reg.exe
4764	reg.exe
3920	reg.exe
3536	reg.exe
412	reg.exe
3556	reg.exe
4736	reg.exe
5732	reg.exe
4956	reg.exe
960	reg.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
3268	wmic.exe
3268	wmic.exe
3268	wmic.exe
3268	wmic.exe
896	wmic.exe
896	wmic.exe
896	wmic.exe
896	wmic.exe
932	powershell.exe
932	powershell.exe
300	wmic.exe
300	wmic.exe
300	wmic.exe
300	wmic.exe
3624	powershell.exe
3624	powershell.exe
4500	wmic.exe
4500	wmic.exe
4500	wmic.exe
4500	wmic.exe
4612	wmic.exe
4612	wmic.exe
4612	wmic.exe
4612	wmic.exe
3316	powershell.exe
3316	powershell.exe
2400	powershell.exe
2400	powershell.exe
2400	powershell.exe
1476	powershell.exe
1476	powershell.exe
1476	powershell.exe
964	powershell.exe
964	powershell.exe
964	powershell.exe
5392	powershell.exe
5392	powershell.exe
5392	powershell.exe
1924	powershell.exe
1924	powershell.exe
1924	powershell.exe
6088	powershell.exe
6088	powershell.exe
6088	powershell.exe
5744	powershell.exe
5744	powershell.exe
5744	powershell.exe
1484	powershell.exe
1484	powershell.exe
1484	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3268	wmic.exe
Token: SeSecurityPrivilege	3268	wmic.exe
Token: SeTakeOwnershipPrivilege	3268	wmic.exe
Token: SeLoadDriverPrivilege	3268	wmic.exe
Token: SeSystemProfilePrivilege	3268	wmic.exe
Token: SeSystemtimePrivilege	3268	wmic.exe
Token: SeProfSingleProcessPrivilege	3268	wmic.exe
Token: SeIncBasePriorityPrivilege	3268	wmic.exe
Token: SeCreatePagefilePrivilege	3268	wmic.exe
Token: SeBackupPrivilege	3268	wmic.exe
Token: SeRestorePrivilege	3268	wmic.exe
Token: SeShutdownPrivilege	3268	wmic.exe
Token: SeDebugPrivilege	3268	wmic.exe
Token: SeSystemEnvironmentPrivilege	3268	wmic.exe
Token: SeRemoteShutdownPrivilege	3268	wmic.exe
Token: SeUndockPrivilege	3268	wmic.exe
Token: SeManageVolumePrivilege	3268	wmic.exe
Token: 33	3268	wmic.exe
Token: 34	3268	wmic.exe
Token: 35	3268	wmic.exe
Token: 36	3268	wmic.exe
Token: SeIncreaseQuotaPrivilege	3268	wmic.exe
Token: SeSecurityPrivilege	3268	wmic.exe
Token: SeTakeOwnershipPrivilege	3268	wmic.exe
Token: SeLoadDriverPrivilege	3268	wmic.exe
Token: SeSystemProfilePrivilege	3268	wmic.exe
Token: SeSystemtimePrivilege	3268	wmic.exe
Token: SeProfSingleProcessPrivilege	3268	wmic.exe
Token: SeIncBasePriorityPrivilege	3268	wmic.exe
Token: SeCreatePagefilePrivilege	3268	wmic.exe
Token: SeBackupPrivilege	3268	wmic.exe
Token: SeRestorePrivilege	3268	wmic.exe
Token: SeShutdownPrivilege	3268	wmic.exe
Token: SeDebugPrivilege	3268	wmic.exe
Token: SeSystemEnvironmentPrivilege	3268	wmic.exe
Token: SeRemoteShutdownPrivilege	3268	wmic.exe
Token: SeUndockPrivilege	3268	wmic.exe
Token: SeManageVolumePrivilege	3268	wmic.exe
Token: 33	3268	wmic.exe
Token: 34	3268	wmic.exe
Token: 35	3268	wmic.exe
Token: 36	3268	wmic.exe
Token: SeIncreaseQuotaPrivilege	896	wmic.exe
Token: SeSecurityPrivilege	896	wmic.exe
Token: SeTakeOwnershipPrivilege	896	wmic.exe
Token: SeLoadDriverPrivilege	896	wmic.exe
Token: SeSystemProfilePrivilege	896	wmic.exe
Token: SeSystemtimePrivilege	896	wmic.exe
Token: SeProfSingleProcessPrivilege	896	wmic.exe
Token: SeIncBasePriorityPrivilege	896	wmic.exe
Token: SeCreatePagefilePrivilege	896	wmic.exe
Token: SeBackupPrivilege	896	wmic.exe
Token: SeRestorePrivilege	896	wmic.exe
Token: SeShutdownPrivilege	896	wmic.exe
Token: SeDebugPrivilege	896	wmic.exe
Token: SeSystemEnvironmentPrivilege	896	wmic.exe
Token: SeRemoteShutdownPrivilege	896	wmic.exe
Token: SeUndockPrivilege	896	wmic.exe
Token: SeManageVolumePrivilege	896	wmic.exe
Token: 33	896	wmic.exe
Token: 34	896	wmic.exe
Token: 35	896	wmic.exe
Token: 36	896	wmic.exe
Token: SeDebugPrivilege	932	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3336	2916	app-knowledge-export.exe	90
PID 2916 wrote to memory of 3268	2916	app-knowledge-export.exe	92
PID 2916 wrote to memory of 896	2916	app-knowledge-export.exe	95
PID 2916 wrote to memory of 932	2916	app-knowledge-export.exe	97
PID 2916 wrote to memory of 300	2916	app-knowledge-export.exe	99
PID 2916 wrote to memory of 3624	2916	app-knowledge-export.exe	101
PID 2916 wrote to memory of 4500	2916	app-knowledge-export.exe	103
PID 2916 wrote to memory of 4612	2916	app-knowledge-export.exe	105
PID 2916 wrote to memory of 1196	2916	app-knowledge-export.exe	107
PID 2916 wrote to memory of 1224	2916	app-knowledge-export.exe	109
PID 2916 wrote to memory of 5872	2916	app-knowledge-export.exe	111
PID 2916 wrote to memory of 2792	2916	app-knowledge-export.exe	113
PID 2916 wrote to memory of 5004	2916	app-knowledge-export.exe	115
PID 2916 wrote to memory of 3920	2916	app-knowledge-export.exe	117
PID 2916 wrote to memory of 3536	2916	app-knowledge-export.exe	119
PID 2916 wrote to memory of 984	2916	app-knowledge-export.exe	121
PID 2916 wrote to memory of 5552	2916	app-knowledge-export.exe	123
PID 2916 wrote to memory of 4780	2916	app-knowledge-export.exe	125
PID 2916 wrote to memory of 2020	2916	app-knowledge-export.exe	127
PID 2916 wrote to memory of 2384	2916	app-knowledge-export.exe	129
PID 2916 wrote to memory of 960	2916	app-knowledge-export.exe	131
PID 2916 wrote to memory of 2904	2916	app-knowledge-export.exe	133
PID 2916 wrote to memory of 476	2916	app-knowledge-export.exe	135
PID 2916 wrote to memory of 2880	2916	app-knowledge-export.exe	137
PID 2916 wrote to memory of 5296	2916	app-knowledge-export.exe	139
PID 2916 wrote to memory of 4860	2916	app-knowledge-export.exe	141
PID 2916 wrote to memory of 5732	2916	app-knowledge-export.exe	143
PID 2916 wrote to memory of 4820	2916	app-knowledge-export.exe	145
PID 2916 wrote to memory of 3316	2916	app-knowledge-export.exe	147
PID 2916 wrote to memory of 2632	2916	app-knowledge-export.exe	151
PID 2916 wrote to memory of 5704	2916	app-knowledge-export.exe	153
PID 2916 wrote to memory of 2348	2916	app-knowledge-export.exe	155
PID 2916 wrote to memory of 3376	2916	app-knowledge-export.exe	157
PID 2916 wrote to memory of 5848	2916	app-knowledge-export.exe	159
PID 2916 wrote to memory of 4184	2916	app-knowledge-export.exe	297
PID 2916 wrote to memory of 2400	2916	app-knowledge-export.exe	304
PID 2916 wrote to memory of 1476	2916	app-knowledge-export.exe	165
PID 2916 wrote to memory of 964	2916	app-knowledge-export.exe	167
PID 2916 wrote to memory of 5392	2916	app-knowledge-export.exe	169
PID 2916 wrote to memory of 5424	2916	app-knowledge-export.exe	171
PID 2916 wrote to memory of 4956	2916	app-knowledge-export.exe	173
PID 2916 wrote to memory of 2408	2916	app-knowledge-export.exe	175
PID 2916 wrote to memory of 984	2916	app-knowledge-export.exe	177
PID 2916 wrote to memory of 5896	2916	app-knowledge-export.exe	179
PID 2916 wrote to memory of 4816	2916	app-knowledge-export.exe	181
PID 2916 wrote to memory of 2368	2916	app-knowledge-export.exe	183
PID 2916 wrote to memory of 4928	2916	app-knowledge-export.exe	324
PID 2916 wrote to memory of 972	2916	app-knowledge-export.exe	326
PID 2916 wrote to memory of 720	2916	app-knowledge-export.exe	189
PID 2916 wrote to memory of 4292	2916	app-knowledge-export.exe	191
PID 2916 wrote to memory of 2744	2916	app-knowledge-export.exe	193
PID 2916 wrote to memory of 4236	2916	app-knowledge-export.exe	333
PID 2916 wrote to memory of 1116	2916	app-knowledge-export.exe	197
PID 2916 wrote to memory of 4516	2916	app-knowledge-export.exe	199
PID 2916 wrote to memory of 2596	2916	app-knowledge-export.exe	201
PID 2916 wrote to memory of 5140	2916	app-knowledge-export.exe	203
PID 2916 wrote to memory of 2592	2916	app-knowledge-export.exe	205
PID 2916 wrote to memory of 3240	2916	app-knowledge-export.exe	284
PID 2916 wrote to memory of 1824	2916	app-knowledge-export.exe	209
PID 2916 wrote to memory of 3276	2916	app-knowledge-export.exe	211
PID 2916 wrote to memory of 2960	2916	app-knowledge-export.exe	213
PID 2916 wrote to memory of 5360	2916	app-knowledge-export.exe	215
PID 2916 wrote to memory of 4372	2916	app-knowledge-export.exe	217
PID 2916 wrote to memory of 5952	2916	app-knowledge-export.exe	219

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\app-knowledge-export.exe
"C:\Users\Admin\AppData\Local\Temp\app-knowledge-export.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3336
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get Name,Manufacturer /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "path win32_videocontroller" get Name /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance win32_videocontroller | ForEach-Object { Write-Output ('Name={0}' -f $_.Name); Write-Output '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" baseboard get Manufacturer /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance Win32_BaseBoard | ForEach-Object { Write-Output ('Manufacturer={0}' -f $_.Manufacturer); Write-Output '' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get Caption /format:list
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" computersystem get pcsystemtype /value
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v DisableOverlays
  2⤵
  - Modifies registry key
  PID:1196
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\mouclass\Parameters /v MouseDataQueueSize
  2⤵
  - Modifies registry key
  PID:1224
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize
  2⤵
  - Modifies registry key
  PID:5872
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v GlobalTimerResolutionRequests
  2⤵
  PID:2792
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v HwSchMode
  2⤵
  - Modifies registry key
  PID:5004
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v HwSchMode
  2⤵
  - Modifies registry key
  PID:3920
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity
  2⤵
  - Modifies registry key
  PID:3536
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled
  2⤵
  - Modifies registry key
  PID:984
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride
  2⤵
  PID:5552
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask
  2⤵
  PID:4780
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions" /v CpuPriorityClass
  2⤵
  PID:2020
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v EnablePreemption
  2⤵
  - Modifies registry key
  PID:2384
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v DisableCoalescedTimerExpiration
  2⤵
  - Modifies registry key
  PID:960
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v LargeSystemCache
  2⤵
  PID:2904
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePagingExecutive
  2⤵
  PID:476
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher
  2⤵
  PID:2880
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnableSuperfetch
  2⤵
  PID:5296
- C:\Windows\system32\fsutil.exe
  "fsutil" behavior query disablelastaccess
  2⤵
  PID:4860
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v NtfsMemoryUsage
  2⤵
  - Modifies registry key
  PID:5732
- C:\Windows\system32\fsutil.exe
  "fsutil" behavior query disable8dot3
  2⤵
  PID:4820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.InterfaceDescription -notmatch 'Virtual|Loopback' } | Sort-Object -Property LinkSpeed -Descending | Select-Object -First 1).Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex
  2⤵
  PID:2632
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
  2⤵
  - Modifies registry key
  PID:5704
- C:\Windows\system32\reg.exe
  "reg" query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{04dcbc85-566b-4290-95bf-10eb2257d534} /v TcpAckFrequency
  2⤵
  PID:2348
- C:\Windows\system32\reg.exe
  "reg" query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{a3ee0e7b-0544-42bb-b43f-766a0a6d7572} /v TcpAckFrequency
  2⤵
  PID:3376
- C:\Windows\system32\reg.exe
  "reg" query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{ca415a84-7be3-11f1-af01-806e6f6e6963} /v TcpAckFrequency
  2⤵
  PID:5848
- C:\Windows\system32\netsh.exe
  "netsh" int tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterAdvancedProperty -Name 'Ethernet' -DisplayName 'Interrupt Moderation' -ErrorAction SilentlyContinue).DisplayValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterAdvancedProperty -Name 'Ethernet' -DisplayName 'Energy-Efficient Ethernet' -ErrorAction SilentlyContinue).DisplayValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterPowerManagement -Name 'Ethernet' -ErrorAction SilentlyContinue).AllowComputerToTurnOffDevice"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterLso -Name 'Ethernet' -ErrorAction SilentlyContinue).IPv4Enabled"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5392
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCortana
  2⤵
  PID:5424
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowTelemetry
  2⤵
  - Modifies registry key
  PID:4956
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\GameDVR /v AppCaptureEnabled
  2⤵
  - Modifies registry key
  PID:2408
- C:\Windows\system32\reg.exe
  "reg" query HKCU\System\GameConfigStore /v GameDVR_FSEBehaviorMode
  2⤵
  - Modifies registry key
  PID:984
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Audio" /v "Scheduling Category"
  2⤵
  PID:5896
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Audio /v DisableSystemEffects
  2⤵
  - Modifies registry key
  PID:4816
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness
  2⤵
  PID:2368
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Multimedia\Audio /v UserDuckingPreference
  2⤵
  - Modifies registry key
  PID:4928
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\USB /v DisableSelectiveSuspend
  2⤵
  - Modifies registry key
  PID:972
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5
  2⤵
  - Power Settings
  PID:720
- C:\Windows\system32\powercfg.exe
  "powercfg" /getactivescheme
  2⤵
  - Power Settings
  PID:4292
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\NVIDIA Corporation\Global\NVTweak" /v "Threaded optimization"
  2⤵
  PID:2744
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\NVIDIA Corporation\Global\NVTweak" /v NVShaderCacheMaxSize
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\NVIDIA Corporation\Global\NVTweak" /v CPLPreRenderLimit
  2⤵
  PID:1116
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v AppCaptureEnabled
  2⤵
  - Modifies registry key
  PID:4516
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Mouse" /v MouseSpeed
  2⤵
  PID:2596
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Mouse" /v MouseThreshold1
  2⤵
  PID:5140
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Mouse" /v MouseThreshold2
  2⤵
  PID:2592
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags
  2⤵
  PID:3240
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Accessibility\Keyboard Response" /v Flags
  2⤵
  PID:1824
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation
  2⤵
  - Modifies registry key
  PID:3276
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583 /v ValueMax
  2⤵
  - Modifies registry key
  PID:2960
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMIN
  2⤵
  - Power Settings
  PID:5360
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\WSearch /v Start
  2⤵
  - Modifies registry key
  PID:4372
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications /v GlobalUserDisabled
  2⤵
  - Modifies registry key
  PID:5952
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization /v DODownloadMode
  2⤵
  - Modifies registry key
  PID:4168
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR /v AllowGameDVR
  2⤵
  - Modifies registry key
  PID:3760
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\xbgm /v Start
  2⤵
  - Modifies registry key
  PID:412
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Cursors" /v ContactVisualization
  2⤵
  PID:4972
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "GPU Priority"
  2⤵
  PID:2780
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v Priority
  2⤵
  PID:1560
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Desktop" /v MenuShowDelay
  2⤵
  PID:944
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v EnableTFO
  2⤵
  - Modifies registry key
  PID:4764
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-338389Enabled
  2⤵
  - Modifies registry key
  PID:2872
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v RotatingLockScreenEnabled
  2⤵
  - Modifies registry key
  PID:4248
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v AllowClipboardHistory
  2⤵
  - Modifies registry key
  PID:1468
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v EnableActivityFeed
  2⤵
  - Modifies registry key
  PID:1700
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v PublishUserActivities
  2⤵
  - Modifies registry key
  PID:4080
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer /v DisableSearchBoxSuggestions
  2⤵
  - Modifies registry key
  PID:5808
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search /v BingSearchEnabled
  2⤵
  - Modifies registry key
  PID:3272
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency
  2⤵
  - Modifies registry key
  PID:5004
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v OemPreInstalledAppsEnabled
  2⤵
  - Modifies registry key
  PID:4420
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\DiagTrack /v Start
  2⤵
  - Modifies registry key
  PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command (Get-MMAgent).MemoryCompression
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Windows\system32\schtasks.exe
  "schtasks" /Query /TN \Microsoft\Windows\Defrag\ScheduledDefrag
  2⤵
  PID:2252
- C:\Windows\system32\fsutil.exe
  "fsutil" behavior query DisableDeleteNotify
  2⤵
  PID:5012
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy /v 01
  2⤵
  - Modifies registry key
  PID:4952
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled
  2⤵
  PID:1636
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v fAllowToGetHelp
  2⤵
  PID:1720
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\Spooler /v Start
  2⤵
  - Modifies registry key
  PID:4732
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled
  2⤵
  PID:3900
- C:\Windows\system32\netsh.exe
  "netsh" int tcp show supplemental
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4624
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v TdrDelay
  2⤵
  - Modifies registry key
  PID:2396
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v EnablePreemption
  2⤵
  - Modifies registry key
  PID:3556
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v PreemptionLevel
  2⤵
  - Modifies registry key
  PID:4436
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:3176
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0001 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:5792
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3240
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0002 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:1036
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0003 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:1028
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0004 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:2788
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0005 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:2932
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0006 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:4736
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0007 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:1620
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0008 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:4184
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0009 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:2424
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\WpnService /v Start
  2⤵
  - Modifies registry key
  PID:300
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v MaintenanceDisabled
  2⤵
  PID:5856
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2400
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Power /v CsEnabled
  2⤵
  - Modifies registry key
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-NetAdapterAdvancedProperty -Name * -RegistryKeyword '*ReceiveBuffers' -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty RegistryValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:6088
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:944
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v SwapEffectUpgradeCache
  2⤵
  - Modifies registry key
  PID:4248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-NetAdapterAdvancedProperty -Name * -RegistryKeyword '*ITR' -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty RegistryValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Enum\PCI\VEN_10DE*\*\Device Parameters\Interrupt Management\Affinity Policy' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty DevicePolicy -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Windows\system32\secedit.exe
  "secedit" /export /cfg C:\Users\Admin\AppData\Local\Temp\pulse_secpol_query.cfg
  2⤵
  PID:5564
- C:\Windows\system32\whoami.exe
  "whoami" /user /fo csv /nh
  2⤵
  PID:2064
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 be337238-0d82-4146-a960-4f3749d470c7
  2⤵
  - Power Settings
  PID:488
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 bae08b81-2d5e-4688-ad6a-13243356654b
  2⤵
  - Power Settings
  PID:2532
- C:\Windows\system32\powercfg.exe
  "powercfg" /q SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 5d76a2ca-e8c0-402f-a133-2158492d58ad
  2⤵
  - Power Settings
  PID:1324
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4928
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control /v WaitToKillServiceTimeout
  2⤵
  - Modifies registry key
  PID:1240
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:972
- C:\Windows\system32\netsh.exe
  "netsh" int tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2272
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\DirectX\GraphicsSettings /v DirectXUserGlobalSettings
  2⤵
  - Modifies registry key
  PID:2228
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1720
- C:\Windows\system32\powercfg.exe
  "powercfg" /q SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 619b7505-003b-4e82-b7a6-4dd29c300971
  2⤵
  - Power Settings
  PID:5220
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4732
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Policies\Microsoft\Windows\WindowsCopilot /v TurnOffWindowsCopilot
  2⤵
  - Modifies registry key
  PID:4236
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Policies\Microsoft\Windows\WindowsAI /v DisableAIDataAnalysis
  2⤵
  - Modifies registry key
  PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact