093c4cfa423821efd53e0b04e18845f5301a2fc93206429f3622a5f4a91a308b

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app-knowledge-export.exe
Size 5.4MB
Sample261011-pgvxwsas5m
SHA256 093c4cfa423821efd53e0b04e18845f5301a2fc93206429f3622a5f4a91a308b
MD5 c16abae26018eb4f1a37bf585754547c
SHA1 12177bbce2e1d4b501060fc2f8c157b7e59572fc
SHA512 deb4144a8510c767d53f5bb622ffc551bd47a39aae36a62a3765703d61f467cd6420fcb4c24cce86ac693379d322690f48c70c1977758250401e1720aa880c7f
SSDEEP 49152:lcZ4634BOzxbFg8waV3jVbnHlj6RNjLjv+D0XaOZa+UUEolqyKyTbrz11I:uvq+ww0z1
TLSH
T1CA466C18DB692E7B848D7576A8060D336A20657B1F11342E339CD25C2F8ED6F81BD2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5088	powershell.exe
6028	powershell.exe
3428	powershell.exe

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
2868	bcdedit.exe

Power Settings 1 TTPs 7 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4328	powercfg.exe
3768	powercfg.exe
3744	powercfg.exe
2024	powercfg.exe
5560	powercfg.exe
4596	powercfg.exe
2736	powercfg.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 3 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
3448	powershell.exe
3252	wmic.exe
4004	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 7 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4184	powershell.exe
3596	powershell.exe
1444	powershell.exe
4004	powershell.exe
5700	powershell.exe
3428	powershell.exe
4280	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe

Modifies registry key 1 TTPs 58 IoCs

Modify Registry

T1112

pid	Process
4664	reg.exe
5956	reg.exe
5528	reg.exe
5712	reg.exe
1768	reg.exe
4748	reg.exe
5972	reg.exe
4724	reg.exe
860	reg.exe
2864	reg.exe
5824	reg.exe
5708	reg.exe
4736	reg.exe
3380	reg.exe
3860	reg.exe
2948	reg.exe
5824	reg.exe
1084	reg.exe
1724	reg.exe
1340	reg.exe
4376	reg.exe
4560	reg.exe
916	reg.exe
1696	reg.exe
4748	reg.exe
2664	reg.exe
4484	reg.exe
2520	reg.exe
4712	reg.exe
5900	reg.exe
5364	reg.exe
5524	reg.exe
4472	reg.exe
2936	reg.exe
1120	reg.exe
5740	reg.exe
1736	reg.exe
5676	reg.exe
1696	reg.exe
4160	reg.exe
5856	reg.exe
4912	reg.exe
4236	reg.exe
5340	reg.exe
4512	reg.exe
3312	reg.exe
3512	reg.exe
620	reg.exe
5904	reg.exe
4536	reg.exe
2764	reg.exe
5536	reg.exe
368	reg.exe
728	reg.exe
2756	reg.exe
4604	reg.exe
4428	reg.exe
620	reg.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1340	wmic.exe
1340	wmic.exe
1340	wmic.exe
1340	wmic.exe
2864	wmic.exe
2864	wmic.exe
2864	wmic.exe
2864	wmic.exe
3448	powershell.exe
3448	powershell.exe
3252	wmic.exe
3252	wmic.exe
3252	wmic.exe
3252	wmic.exe
4004	powershell.exe
4004	powershell.exe
5652	wmic.exe
5652	wmic.exe
5652	wmic.exe
5652	wmic.exe
3360	wmic.exe
3360	wmic.exe
3360	wmic.exe
3360	wmic.exe
5088	powershell.exe
5088	powershell.exe
4280	powershell.exe
4280	powershell.exe
4280	powershell.exe
4184	powershell.exe
4184	powershell.exe
4184	powershell.exe
3596	powershell.exe
3596	powershell.exe
3596	powershell.exe
1444	powershell.exe
1444	powershell.exe
1444	powershell.exe
6028	powershell.exe
6028	powershell.exe
6028	powershell.exe
4004	powershell.exe
4004	powershell.exe
4004	powershell.exe
5700	powershell.exe
5700	powershell.exe
5700	powershell.exe
3428	powershell.exe
3428	powershell.exe
3428	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1340	wmic.exe
Token: SeSecurityPrivilege	1340	wmic.exe
Token: SeTakeOwnershipPrivilege	1340	wmic.exe
Token: SeLoadDriverPrivilege	1340	wmic.exe
Token: SeSystemProfilePrivilege	1340	wmic.exe
Token: SeSystemtimePrivilege	1340	wmic.exe
Token: SeProfSingleProcessPrivilege	1340	wmic.exe
Token: SeIncBasePriorityPrivilege	1340	wmic.exe
Token: SeCreatePagefilePrivilege	1340	wmic.exe
Token: SeBackupPrivilege	1340	wmic.exe
Token: SeRestorePrivilege	1340	wmic.exe
Token: SeShutdownPrivilege	1340	wmic.exe
Token: SeDebugPrivilege	1340	wmic.exe
Token: SeSystemEnvironmentPrivilege	1340	wmic.exe
Token: SeRemoteShutdownPrivilege	1340	wmic.exe
Token: SeUndockPrivilege	1340	wmic.exe
Token: SeManageVolumePrivilege	1340	wmic.exe
Token: 33	1340	wmic.exe
Token: 34	1340	wmic.exe
Token: 35	1340	wmic.exe
Token: 36	1340	wmic.exe
Token: SeIncreaseQuotaPrivilege	1340	wmic.exe
Token: SeSecurityPrivilege	1340	wmic.exe
Token: SeTakeOwnershipPrivilege	1340	wmic.exe
Token: SeLoadDriverPrivilege	1340	wmic.exe
Token: SeSystemProfilePrivilege	1340	wmic.exe
Token: SeSystemtimePrivilege	1340	wmic.exe
Token: SeProfSingleProcessPrivilege	1340	wmic.exe
Token: SeIncBasePriorityPrivilege	1340	wmic.exe
Token: SeCreatePagefilePrivilege	1340	wmic.exe
Token: SeBackupPrivilege	1340	wmic.exe
Token: SeRestorePrivilege	1340	wmic.exe
Token: SeShutdownPrivilege	1340	wmic.exe
Token: SeDebugPrivilege	1340	wmic.exe
Token: SeSystemEnvironmentPrivilege	1340	wmic.exe
Token: SeRemoteShutdownPrivilege	1340	wmic.exe
Token: SeUndockPrivilege	1340	wmic.exe
Token: SeManageVolumePrivilege	1340	wmic.exe
Token: 33	1340	wmic.exe
Token: 34	1340	wmic.exe
Token: 35	1340	wmic.exe
Token: 36	1340	wmic.exe
Token: SeIncreaseQuotaPrivilege	2864	wmic.exe
Token: SeSecurityPrivilege	2864	wmic.exe
Token: SeTakeOwnershipPrivilege	2864	wmic.exe
Token: SeLoadDriverPrivilege	2864	wmic.exe
Token: SeSystemProfilePrivilege	2864	wmic.exe
Token: SeSystemtimePrivilege	2864	wmic.exe
Token: SeProfSingleProcessPrivilege	2864	wmic.exe
Token: SeIncBasePriorityPrivilege	2864	wmic.exe
Token: SeCreatePagefilePrivilege	2864	wmic.exe
Token: SeBackupPrivilege	2864	wmic.exe
Token: SeRestorePrivilege	2864	wmic.exe
Token: SeShutdownPrivilege	2864	wmic.exe
Token: SeDebugPrivilege	2864	wmic.exe
Token: SeSystemEnvironmentPrivilege	2864	wmic.exe
Token: SeRemoteShutdownPrivilege	2864	wmic.exe
Token: SeUndockPrivilege	2864	wmic.exe
Token: SeManageVolumePrivilege	2864	wmic.exe
Token: 33	2864	wmic.exe
Token: 34	2864	wmic.exe
Token: 35	2864	wmic.exe
Token: 36	2864	wmic.exe
Token: SeDebugPrivilege	3448	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2868	4940	app-knowledge-export.exe	90
PID 4940 wrote to memory of 1340	4940	app-knowledge-export.exe	92
PID 4940 wrote to memory of 2864	4940	app-knowledge-export.exe	95
PID 4940 wrote to memory of 3448	4940	app-knowledge-export.exe	97
PID 4940 wrote to memory of 3252	4940	app-knowledge-export.exe	99
PID 4940 wrote to memory of 4004	4940	app-knowledge-export.exe	101
PID 4940 wrote to memory of 5652	4940	app-knowledge-export.exe	103
PID 4940 wrote to memory of 3360	4940	app-knowledge-export.exe	105
PID 4940 wrote to memory of 4724	4940	app-knowledge-export.exe	107
PID 4940 wrote to memory of 4912	4940	app-knowledge-export.exe	109
PID 4940 wrote to memory of 5824	4940	app-knowledge-export.exe	111
PID 4940 wrote to memory of 5452	4940	app-knowledge-export.exe	113
PID 4940 wrote to memory of 620	4940	app-knowledge-export.exe	115
PID 4940 wrote to memory of 4560	4940	app-knowledge-export.exe	117
PID 4940 wrote to memory of 4484	4940	app-knowledge-export.exe	119
PID 4940 wrote to memory of 916	4940	app-knowledge-export.exe	121
PID 4940 wrote to memory of 4216	4940	app-knowledge-export.exe	123
PID 4940 wrote to memory of 1936	4940	app-knowledge-export.exe	125
PID 4940 wrote to memory of 4840	4940	app-knowledge-export.exe	127
PID 4940 wrote to memory of 860	4940	app-knowledge-export.exe	129
PID 4940 wrote to memory of 1768	4940	app-knowledge-export.exe	131
PID 4940 wrote to memory of 3904	4940	app-knowledge-export.exe	133
PID 4940 wrote to memory of 3180	4940	app-knowledge-export.exe	135
PID 4940 wrote to memory of 3456	4940	app-knowledge-export.exe	137
PID 4940 wrote to memory of 964	4940	app-knowledge-export.exe	139
PID 4940 wrote to memory of 4584	4940	app-knowledge-export.exe	141
PID 4940 wrote to memory of 4748	4940	app-knowledge-export.exe	143
PID 4940 wrote to memory of 2920	4940	app-knowledge-export.exe	145
PID 4940 wrote to memory of 5088	4940	app-knowledge-export.exe	147
PID 4940 wrote to memory of 1620	4940	app-knowledge-export.exe	288
PID 4940 wrote to memory of 2864	4940	app-knowledge-export.exe	153
PID 4940 wrote to memory of 3096	4940	app-knowledge-export.exe	155
PID 4940 wrote to memory of 2312	4940	app-knowledge-export.exe	157
PID 4940 wrote to memory of 4160	4940	app-knowledge-export.exe	295
PID 4940 wrote to memory of 1684	4940	app-knowledge-export.exe	161
PID 4940 wrote to memory of 4280	4940	app-knowledge-export.exe	305
PID 4940 wrote to memory of 4184	4940	app-knowledge-export.exe	165
PID 4940 wrote to memory of 3596	4940	app-knowledge-export.exe	167
PID 4940 wrote to memory of 1444	4940	app-knowledge-export.exe	169
PID 4940 wrote to memory of 5564	4940	app-knowledge-export.exe	171
PID 4940 wrote to memory of 4472	4940	app-knowledge-export.exe	173
PID 4940 wrote to memory of 3312	4940	app-knowledge-export.exe	175
PID 4940 wrote to memory of 1084	4940	app-knowledge-export.exe	177
PID 4940 wrote to memory of 4000	4940	app-knowledge-export.exe	179
PID 4940 wrote to memory of 3512	4940	app-knowledge-export.exe	181
PID 4940 wrote to memory of 2232	4940	app-knowledge-export.exe	259
PID 4940 wrote to memory of 4536	4940	app-knowledge-export.exe	185
PID 4940 wrote to memory of 4736	4940	app-knowledge-export.exe	187
PID 4940 wrote to memory of 2024	4940	app-knowledge-export.exe	189
PID 4940 wrote to memory of 5560	4940	app-knowledge-export.exe	191
PID 4940 wrote to memory of 5892	4940	app-knowledge-export.exe	193
PID 4940 wrote to memory of 6064	4940	app-knowledge-export.exe	195
PID 4940 wrote to memory of 5996	4940	app-knowledge-export.exe	197
PID 4940 wrote to memory of 3380	4940	app-knowledge-export.exe	199
PID 4940 wrote to memory of 3624	4940	app-knowledge-export.exe	278
PID 4940 wrote to memory of 2664	4940	app-knowledge-export.exe	279
PID 4940 wrote to memory of 1868	4940	app-knowledge-export.exe	205
PID 4940 wrote to memory of 6084	4940	app-knowledge-export.exe	207
PID 4940 wrote to memory of 3508	4940	app-knowledge-export.exe	209
PID 4940 wrote to memory of 5972	4940	app-knowledge-export.exe	211
PID 4940 wrote to memory of 2936	4940	app-knowledge-export.exe	213
PID 4940 wrote to memory of 4596	4940	app-knowledge-export.exe	215
PID 4940 wrote to memory of 1696	4940	app-knowledge-export.exe	291
PID 4940 wrote to memory of 368	4940	app-knowledge-export.exe	219

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\app-knowledge-export.exe
"C:\Users\Admin\AppData\Local\Temp\app-knowledge-export.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2868
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" cpu get Name,Manufacturer /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1340
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" "path win32_videocontroller" get Name /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance win32_videocontroller | ForEach-Object { Write-Output ('Name={0}' -f $_.Name); Write-Output '' }"
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3448
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" baseboard get Manufacturer /format:list
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NoLogo -Command "Get-CimInstance Win32_BaseBoard | ForEach-Object { Write-Output ('Manufacturer={0}' -f $_.Manufacturer); Write-Output '' }"
  2⤵
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  PID:4004
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get Caption /format:list
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5652
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" computersystem get pcsystemtype /value
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3360
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v DisableOverlays
  2⤵
  - Modifies registry key
  PID:4724
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\mouclass\Parameters /v MouseDataQueueSize
  2⤵
  - Modifies registry key
  PID:4912
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\kbdclass\Parameters /v KeyboardDataQueueSize
  2⤵
  - Modifies registry key
  PID:5824
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v GlobalTimerResolutionRequests
  2⤵
  PID:5452
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v HwSchMode
  2⤵
  - Modifies registry key
  PID:620
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v HwSchMode
  2⤵
  - Modifies registry key
  PID:4560
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity
  2⤵
  - Modifies registry key
  PID:4484
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled
  2⤵
  - Modifies registry key
  PID:916
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride
  2⤵
  PID:4216
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions" /v CpuPriorityClass
  2⤵
  PID:4840
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v EnablePreemption
  2⤵
  - Modifies registry key
  PID:860
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v DisableCoalescedTimerExpiration
  2⤵
  - Modifies registry key
  PID:1768
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v LargeSystemCache
  2⤵
  PID:3904
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v DisablePagingExecutive
  2⤵
  PID:3180
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnablePrefetcher
  2⤵
  PID:3456
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v EnableSuperfetch
  2⤵
  PID:964
- C:\Windows\system32\fsutil.exe
  "fsutil" behavior query disablelastaccess
  2⤵
  PID:4584
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v NtfsMemoryUsage
  2⤵
  - Modifies registry key
  PID:4748
- C:\Windows\system32\fsutil.exe
  "fsutil" behavior query disable8dot3
  2⤵
  PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.InterfaceDescription -notmatch 'Virtual|Loopback' } | Sort-Object -Property LinkSpeed -Descending | Select-Object -First 1).Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex
  2⤵
  PID:1620
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
  2⤵
  - Modifies registry key
  PID:2864
- C:\Windows\system32\reg.exe
  "reg" query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{31af70d6-9836-49d1-8767-19a622edd5a1} /v TcpAckFrequency
  2⤵
  PID:3096
- C:\Windows\system32\reg.exe
  "reg" query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{338a52e5-ae39-11f1-a922-806e6f6e6963} /v TcpAckFrequency
  2⤵
  PID:2312
- C:\Windows\system32\reg.exe
  "reg" query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6a3f82c2-2cc1-4bc2-b6ae-1269ba029339} /v TcpAckFrequency
  2⤵
  PID:4160
- C:\Windows\system32\netsh.exe
  "netsh" int tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterAdvancedProperty -Name 'Ethernet' -DisplayName 'Interrupt Moderation' -ErrorAction SilentlyContinue).DisplayValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterAdvancedProperty -Name 'Ethernet' -DisplayName 'Energy-Efficient Ethernet' -ErrorAction SilentlyContinue).DisplayValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterPowerManagement -Name 'Ethernet' -ErrorAction SilentlyContinue).AllowComputerToTurnOffDevice"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetAdapterLso -Name 'Ethernet' -ErrorAction SilentlyContinue).IPv4Enabled"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v AllowCortana
  2⤵
  PID:5564
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowTelemetry
  2⤵
  - Modifies registry key
  PID:4472
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\GameDVR /v AppCaptureEnabled
  2⤵
  - Modifies registry key
  PID:3312
- C:\Windows\system32\reg.exe
  "reg" query HKCU\System\GameConfigStore /v GameDVR_FSEBehaviorMode
  2⤵
  - Modifies registry key
  PID:1084
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Audio" /v "Scheduling Category"
  2⤵
  PID:4000
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Audio /v DisableSystemEffects
  2⤵
  - Modifies registry key
  PID:3512
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness
  2⤵
  PID:2232
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Multimedia\Audio /v UserDuckingPreference
  2⤵
  - Modifies registry key
  PID:4536
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\USB /v DisableSelectiveSuspend
  2⤵
  - Modifies registry key
  PID:4736
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5
  2⤵
  - Power Settings
  PID:2024
- C:\Windows\system32\powercfg.exe
  "powercfg" /getactivescheme
  2⤵
  - Power Settings
  PID:5560
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\NVIDIA Corporation\Global\NVTweak" /v "Threaded optimization"
  2⤵
  PID:5892
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\NVIDIA Corporation\Global\NVTweak" /v NVShaderCacheMaxSize
  2⤵
  PID:6064
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Software\NVIDIA Corporation\Global\NVTweak" /v CPLPreRenderLimit
  2⤵
  PID:5996
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR /v AppCaptureEnabled
  2⤵
  - Modifies registry key
  PID:3380
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Mouse" /v MouseSpeed
  2⤵
  PID:3624
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Mouse" /v MouseThreshold1
  2⤵
  PID:2664
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Mouse" /v MouseThreshold2
  2⤵
  PID:1868
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Accessibility\StickyKeys" /v Flags
  2⤵
  PID:6084
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Accessibility\Keyboard Response" /v Flags
  2⤵
  PID:3508
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\PriorityControl /v Win32PrioritySeparation
  2⤵
  - Modifies registry key
  PID:5972
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\0cc5b647-c1df-4637-891a-dec35c318583 /v ValueMax
  2⤵
  - Modifies registry key
  PID:2936
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMIN
  2⤵
  - Power Settings
  PID:4596
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\WSearch /v Start
  2⤵
  - Modifies registry key
  PID:1696
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications /v GlobalUserDisabled
  2⤵
  - Modifies registry key
  PID:368
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization /v DODownloadMode
  2⤵
  - Modifies registry key
  PID:3860
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR /v AllowGameDVR
  2⤵
  - Modifies registry key
  PID:2764
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\xbgm /v Start
  2⤵
  - Modifies registry key
  PID:2520
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Cursors" /v ContactVisualization
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "GPU Priority"
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v Priority
  2⤵
  PID:1264
- C:\Windows\system32\reg.exe
  "reg" query "HKCU\Control Panel\Desktop" /v MenuShowDelay
  2⤵
  PID:5812
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /v EnableTFO
  2⤵
  - Modifies registry key
  PID:5676
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v SubscribedContent-338389Enabled
  2⤵
  - Modifies registry key
  PID:728
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v RotatingLockScreenEnabled
  2⤵
  - Modifies registry key
  PID:4664
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v AllowClipboardHistory
  2⤵
  - Modifies registry key
  PID:1724
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v EnableActivityFeed
  2⤵
  - Modifies registry key
  PID:4712
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SOFTWARE\Policies\Microsoft\Windows\System /v PublishUserActivities
  2⤵
  - Modifies registry key
  PID:4236
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Policies\Microsoft\Windows\Explorer /v DisableSearchBoxSuggestions
  2⤵
  - Modifies registry key
  PID:5824
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search /v BingSearchEnabled
  2⤵
  - Modifies registry key
  PID:5956
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency
  2⤵
  - Modifies registry key
  PID:1120
- C:\Windows\system32\reg.exe
  "reg" query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager /v OemPreInstalledAppsEnabled
  2⤵
  - Modifies registry key
  PID:5528
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\DiagTrack /v Start
  2⤵
  - Modifies registry key
  PID:620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command (Get-MMAgent).MemoryCompression
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6028
- C:\Windows\system32\schtasks.exe
  "schtasks" /Query /TN \Microsoft\Windows\Defrag\ScheduledDefrag
  2⤵
  PID:2232
- C:\Windows\system32\fsutil.exe
  "fsutil" behavior query DisableDeleteNotify
  2⤵
  PID:2852
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy /v 01
  2⤵
  - Modifies registry key
  PID:2756
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power" /v HiberbootEnabled
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v fAllowToGetHelp
  2⤵
  PID:1452
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\Spooler /v Start
  2⤵
  - Modifies registry key
  PID:5856
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled
  2⤵
  PID:5400
- C:\Windows\system32\netsh.exe
  "netsh" int tcp show supplemental
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4512
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v TdrDelay
  2⤵
  - Modifies registry key
  PID:5712
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v EnablePreemption
  2⤵
  - Modifies registry key
  PID:4748
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3624
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Scheduler /v PreemptionLevel
  2⤵
  - Modifies registry key
  PID:2664
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:5340
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0001 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:4604
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0002 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:5900
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0003 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:1340
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1620
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0004 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:5740
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0005 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:1696
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0006 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:2948
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0007 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:4160
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0008 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:1736
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0009 /v EnableULPS
  2⤵
  - Modifies registry key
  PID:5524
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Services\WpnService /v Start
  2⤵
  - Modifies registry key
  PID:5536
- C:\Windows\system32\reg.exe
  "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance" /v MaintenanceDisabled
  2⤵
  PID:5924
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\Power /v CsEnabled
  2⤵
  - Modifies registry key
  PID:4428
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-NetAdapterAdvancedProperty -Name * -RegistryKeyword '*ReceiveBuffers' -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty RegistryValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4004
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5676
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers /v SwapEffectUpgradeCache
  2⤵
  - Modifies registry key
  PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-NetAdapterAdvancedProperty -Name * -RegistryKeyword '*ITR' -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty RegistryValue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Enum\PCI\VEN_10DE*\*\Device Parameters\Interrupt Management\Affinity Policy' -ErrorAction SilentlyContinue | Select-Object -ExpandProperty DevicePolicy -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Windows\system32\secedit.exe
  "secedit" /export /cfg C:\Users\Admin\AppData\Local\Temp\pulse_secpol_query.cfg
  2⤵
  PID:1940
- C:\Windows\system32\whoami.exe
  "whoami" /user /fo csv /nh
  2⤵
  PID:3120
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 be337238-0d82-4146-a960-4f3749d470c7
  2⤵
  - Power Settings
  PID:2736
- C:\Windows\system32\powercfg.exe
  "powercfg" /query SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 bae08b81-2d5e-4688-ad6a-13243356654b
  2⤵
  - Power Settings
  PID:4328
- C:\Windows\system32\powercfg.exe
  "powercfg" /q SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 5d76a2ca-e8c0-402f-a133-2158492d58ad
  2⤵
  - Power Settings
  PID:3768
- C:\Windows\system32\reg.exe
  "reg" query HKLM\SYSTEM\CurrentControlSet\Control /v WaitToKillServiceTimeout
  2⤵
  - Modifies registry key
  PID:5364
- C:\Windows\system32\netsh.exe
  "netsh" int tcp show global
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:948
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\DirectX\GraphicsSettings /v DirectXUserGlobalSettings
  2⤵
  - Modifies registry key
  PID:4512
- C:\Windows\system32\powercfg.exe
  "powercfg" /q SCHEME_CURRENT 54533251-82be-4824-96c1-47b60b740d00 619b7505-003b-4e82-b7a6-4dd29c300971
  2⤵
  - Power Settings
  PID:3744
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Policies\Microsoft\Windows\WindowsCopilot /v TurnOffWindowsCopilot
  2⤵
  - Modifies registry key
  PID:5708
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Policies\Microsoft\Windows\WindowsAI /v DisableAIDataAnalysis
  2⤵
  - Modifies registry key
  PID:5904

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 99Jj2AsLOkSSVsUqOar/1w.0.2
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact