matrix | 248e195707624862a4268cae02ff94c6b2cd8135afcb84324142249c494568bf

Analysis

user interaction
yes
max time kernel
114s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/10/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Oneclick-V8.4.bat
Size 272KB
Sample261029-th3rcabf42
SHA256 248e195707624862a4268cae02ff94c6b2cd8135afcb84324142249c494568bf
MD5 b3ea15bf4403b1a9e048e7908bac2db5
SHA1 46647b9ba5eed25a7a4e4d30bb15ca568dcbd7a3
SHA512 4f683bb901f0ac54c9f30624280449d0ab661517c68d7789c8ab7fd0002a5284876b97746f1c8701c8f1c2e2435d521f4461ab71f0b4e39a749f7a9710a2e100
SSDEEP 3072:tkz4FbQpKFfCxn2NqJpZxa2GHPjr3Nm6m:tkz4FbRFfCxn2NqJpZxa2GHPjr3Nzm
TLSH
T1D254C62574001A2541B79E6AC5775C42FB4112C3CB501AEAB4EFA0EC2FB751BEDBBAD0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware costura defense_evasion discovery execution exploit matrix lateral_movement packer persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Signatures

Family: Matrix Ransomware 2 IoCs

Targeted ransomware with information collection and encryption functionality.

ransomware matrix

description	ioc	Process
File created	C:\Program Files\Open-Shell\OpenShellReadme.rtf	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Control Panel\Desktop\TileWallpaper = "0"	reg.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies boot configuration data using bcdedit 3 IoCs

pid	Process
4020	bcdedit.exe
3080	bcdedit.exe
2948	bcdedit.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	3532	curl.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LatMon.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\linpack_xeon64.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinRAR.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\linpack_xeon64.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UnRAR.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rar.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7zG.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VegasPro.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Resolve.exe\PerfOptions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shotcut.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cinebench.exe	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3DMark.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\linpack_xeon64.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vlc.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Adobe Premiere Pro.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Resolve.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3DMark.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LatMon.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TM5.exe	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinRAR.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rar.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HandBrake.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3DMark.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinRAR.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7zFM.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7zG.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vlc.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HandBrake.exe	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TM5.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7z.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capcut.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\PerfOptions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7zFM.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VegasPro.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cinebench.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blender.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HandBrake.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\y-cruncher.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7zFM.exe\PerfOptions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VegasPro.exe\PerfOptions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\PerfOptions\CpuPriorityClass = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capcut.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\y-cruncher.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7z.exe\PerfOptions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vlc.exe\PerfOptions\CpuPriorityClass = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Resolve.exe\PerfOptions\CpuPriorityClass = "3"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\y-cruncher.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
4552	icacls.exe
3420	takeown.exe
5604	takeown.exe
4348	takeown.exe
5788	icacls.exe
992	icacls.exe
5028	takeown.exe
2792	icacls.exe
3484	takeown.exe
2952	icacls.exe
1084	takeown.exe
4500	takeown.exe
5492	takeown.exe
4652	icacls.exe
3296	takeown.exe
2284	icacls.exe
5720	icacls.exe
3916	takeown.exe
4872	takeown.exe
4744	takeown.exe
1376	takeown.exe
1916	icacls.exe
4908	takeown.exe
3908	icacls.exe
4888	icacls.exe
3740	takeown.exe
852	icacls.exe
5636	icacls.exe
1384	icacls.exe
5084	icacls.exe
4908	icacls.exe
3512	takeown.exe
3252	takeown.exe
3204	takeown.exe
5572	takeown.exe
2776	icacls.exe
3760	icacls.exe
432	takeown.exe
5508	takeown.exe
3640	icacls.exe
1808	takeown.exe
1236	takeown.exe
3820	takeown.exe
2404	icacls.exe
5488	icacls.exe
1060	icacls.exe
4912	icacls.exe
1752	takeown.exe
4444	takeown.exe
5868	icacls.exe
2944	icacls.exe
5108	icacls.exe
1564	takeown.exe
3412	icacls.exe
3988	icacls.exe
3496	takeown.exe
960	icacls.exe
3812	takeown.exe
2908	takeown.exe
5396	icacls.exe
4076	icacls.exe
6020	icacls.exe
5448	takeown.exe
4544	takeown.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
3804	NSudoLG.exe
5412	NSudoLG.exe
5524	OOSU10.exe
1988	NSudoLG.exe
4932	setup.exe
784	setup.exe
5712	OpenShellSetup_4_4_196.exe
4944	StartMenu.exe
3496	StartMenu.exe

Loads dropped DLL 6 IoCs

pid	Process
2304	MsiExec.exe
3816	MsiExec.exe
3892	MsiExec.exe
4944	StartMenu.exe
3496	StartMenu.exe
3628	explorer.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4544	takeown.exe
5108	icacls.exe
2776	icacls.exe
4872	takeown.exe
1084	takeown.exe
5508	takeown.exe
5636	icacls.exe
1752	takeown.exe
1264	takeown.exe
2944	icacls.exe
4908	icacls.exe
4076	icacls.exe
4444	takeown.exe
5028	takeown.exe
6020	icacls.exe
5488	icacls.exe
1376	takeown.exe
3420	takeown.exe
5604	takeown.exe
432	takeown.exe
3296	takeown.exe
5084	icacls.exe
4348	takeown.exe
3640	icacls.exe
3820	takeown.exe
4912	icacls.exe
2792	icacls.exe
992	icacls.exe
3496	takeown.exe
3740	takeown.exe
3252	takeown.exe
3412	icacls.exe
1060	icacls.exe
4500	takeown.exe
1384	icacls.exe
3760	icacls.exe
3484	takeown.exe
1236	takeown.exe
5492	takeown.exe
852	icacls.exe
3988	icacls.exe
1916	icacls.exe
5788	icacls.exe
5448	takeown.exe
5396	icacls.exe
3916	takeown.exe
2404	icacls.exe
4744	takeown.exe
5572	takeown.exe
5868	icacls.exe
2952	icacls.exe
3908	icacls.exe
4552	icacls.exe
5720	icacls.exe
4652	icacls.exe
2772	icacls.exe
2284	icacls.exe
3204	takeown.exe
2908	takeown.exe
3812	takeown.exe
1564	takeown.exe
4908	takeown.exe
1808	takeown.exe
4888	icacls.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt\ = "{E595F05F-903F-4318-8B0A-7F633B520D2B}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt\ = "{E595F05F-903F-4318-8B0A-7F633B520D2B}"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt\ = "{E595F05F-903F-4318-8B0A-7F633B520D2B}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt\ = "{E595F05F-903F-4318-8B0A-7F633B520D2B}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Open-Shell Start Menu = "\"C:\\Program Files\\Open-Shell\\StartMenu.exe\" -autorun"	msiexec.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
28	raw.githubusercontent.com
30	raw.githubusercontent.com
2	raw.githubusercontent.com
3	raw.githubusercontent.com
13	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe

Maps connected drives based on registry 3 TTPs 5 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5880	powercfg.exe

Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

lateral_movement

SMB/Windows Admin Shares

T1021.002

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\NullSessionPipes	reg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\StartMenuHelper32.dll	msiexec.exe
File created	C:\Windows\system32\StartMenuHelper64.dll	msiexec.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Control Panel\Desktop\Wallpaper = "C:\\Oneclick Tools\\Oneclick Wallpaper\\Oneclick Purple & Blue 4K Wallpaper.jpg"	powershell.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/files/0x001900000002b66f-114.dat	costura

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File created	C:\Program Files\Open-Shell\Skins\Metro.skin7	msiexec.exe
File created	C:\Program Files\Open-Shell\PolicyDefinitions.zip	msiexec.exe
File created	C:\Program Files\Open-Shell\StartMenuL10N.ini	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Windows 8.skin	msiexec.exe
File created	C:\Program Files\Open-Shell\Start Screen.lnk~RFe59f7c4.TMP	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Windows XP Luna.skin	msiexec.exe
File created	C:\Program Files\Open-Shell\StartMenu.exe	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Immersive.skin7	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Windows 8.skin7	msiexec.exe
File opened for modification	C:\Program Files\Open-Shell\Start Menu Settings.lnk	msiexec.exe
File created	C:\Program Files\Open-Shell\Start Menu Settings.lnk~RFe59f7b4.TMP	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Smoked Glass.skin	msiexec.exe
File created	C:\Program Files\Open-Shell\~tart Menu Settings.tmp	msiexec.exe
File created	C:\Program Files\Open-Shell\Start Screen.lnk	msiexec.exe
File opened for modification	C:\Program Files\Open-Shell\Start Screen.lnk	msiexec.exe
File opened for modification	C:\Program Files\Open-Shell\~tart Screen.tmp	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Classic Skin.skin7	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Full Glass.skin	msiexec.exe
File created	C:\Program Files\Open-Shell\StartMenuDLL.dll	msiexec.exe
File opened for modification	C:\Program Files\Open-Shell\~tart Menu Settings.tmp	msiexec.exe
File created	C:\Program Files\Open-Shell\OpenShell.chm	msiexec.exe
File created	C:\Program Files\Open-Shell\Start Menu Settings.lnk	msiexec.exe
File created	C:\Program Files\Open-Shell\~tart Screen.tmp	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Metallic.skin7	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Midnight.skin7	msiexec.exe
File created	C:\Program Files\Open-Shell\StartMenuHelperL10N.ini	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Windows Aero.skin7	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Windows Basic.skin	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Classic Skin.skin	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Immersive.skin	msiexec.exe
File created	C:\Program Files\Open-Shell\OpenShellReadme.rtf	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Windows Aero.skin	msiexec.exe
File created	C:\Program Files\Open-Shell\Start Screen.lnk~RFe59f7b4.TMP	msiexec.exe
File created	C:\Program Files\Open-Shell\Skins\Metro.skin	msiexec.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{828B8D4B-7BC6-47C7-81CD-9B5CC579C447}\StartScreen.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF87CC39F0C69ACE21.TMP	msiexec.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\pris	cmd.exe
File created	C:\Windows\Installer\e59f41a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF497.tmp	msiexec.exe
File created	C:\Windows\Installer\{828B8D4B-7BC6-47C7-81CD-9B5CC579C447}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\e59f41e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF110738AA092A9105.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF592.tmp	msiexec.exe
File created	C:\Windows\Installer\{828B8D4B-7BC6-47C7-81CD-9B5CC579C447}\StartScreen.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{828B8D4B-7BC6-47C7-81CD-9B5CC579C447}\icon.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF404D31EADFC938B3.TMP	msiexec.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\Installer\e59f41a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{828B8D4B-7BC6-47C7-81CD-9B5CC579C447}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDED42772F627C8D9.TMP	msiexec.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4324	sc.exe
2204	sc.exe
5984	sc.exe
2588	sc.exe
3056	sc.exe
3168	sc.exe
1688	sc.exe
5004	sc.exe
5332	sc.exe
2004	sc.exe
5256	sc.exe
5900	sc.exe
2908	sc.exe
888	sc.exe
4652	sc.exe
3152	sc.exe
5508	sc.exe
5912	sc.exe
5496	sc.exe
3664	sc.exe
4864	sc.exe
2272	sc.exe
548	sc.exe
4624	sc.exe
5640	sc.exe
5500	sc.exe
2056	sc.exe
3492	sc.exe
4040	sc.exe
4508	sc.exe
4952	sc.exe
1608	sc.exe
5556	sc.exe
3316	sc.exe
2028	sc.exe
4276	sc.exe
3416	sc.exe
1828	sc.exe
2096	sc.exe
3412	sc.exe
6076	sc.exe
4976	sc.exe
3744	sc.exe
6096	sc.exe
4436	sc.exe
2740	sc.exe
3320	sc.exe
2400	sc.exe
3672	sc.exe
2400	sc.exe
3376	sc.exe
1640	sc.exe
1244	sc.exe
3720	sc.exe
1132	sc.exe
1688	sc.exe
5460	sc.exe
1888	sc.exe
5792	sc.exe
2060	sc.exe
4464	sc.exe
3972	sc.exe
5976	sc.exe
232	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5672	powershell.exe
4332	powershell.exe
6120	powershell.exe
4308	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5208	cmd.exe
5392	cmd.exe
4900	cmd.exe
5264	cmd.exe
3504	cmd.exe
5024	cmd.exe
5668	cmd.exe
2404	cmd.exe
3264	cmd.exe
4860	cmd.exe
5384	cmd.exe
4156	cmd.exe
5528	cmd.exe
5600	cmd.exe
4052	cmd.exe
2432	cmd.exe
4744	cmd.exe
5132	cmd.exe
5636	cmd.exe
5824	cmd.exe
5544	cmd.exe
5868	cmd.exe
1932	cmd.exe
1628	cmd.exe
5604	cmd.exe
560	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	OOSU10.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	OOSU10.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpenShellSetup_4_4_196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4824	PATHPING.EXE
3304	PATHPING.EXE
3012	PATHPING.EXE
4092	PATHPING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5816	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wermgr.exe

Delays execution with timeout.exe 28 IoCs

defense_evasion

pid	Process
4528	timeout.exe
1192	timeout.exe
3572	timeout.exe
1156	timeout.exe
6100	timeout.exe
1500	timeout.exe
692	timeout.exe
3412	timeout.exe
4324	timeout.exe
4432	timeout.exe
4020	timeout.exe
3720	timeout.exe
1744	timeout.exe
1916	timeout.exe
3528	timeout.exe
6100	timeout.exe
4068	timeout.exe
5540	timeout.exe
4040	timeout.exe
5592	timeout.exe
5392	timeout.exe
3212	timeout.exe
2740	timeout.exe
1484	timeout.exe
2656	timeout.exe
5092	timeout.exe
560	timeout.exe
4976	timeout.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
5116	taskkill.exe
3212	taskkill.exe
5264	taskkill.exe
1916	taskkill.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Control Panel\International\User Profile\HttpAcceptLanguageOptOut = "1"	OOSU10.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ab14324-c087-42c1-b905-a0bfdb4e9532}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	OOSU10.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\HTTP\EXTENSIONS	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\HTTPS\DEFAULTICON	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{31575964-95F7-414B-85E4-0E9A93699E13}	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82e749ed-b971-4550-baf7-06aa2bf7e836}\ShellFolder\Attributes = "2684354560"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ie_to_edge_bho.dll	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E595F05F-903F-4318-8B0A-7F633B520D2B}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEHTM\SHELL\RUNAS\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open\command	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3214FBB-3CA1-406A-B3E8-3EB7C393A15E}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4D8B8286CB77C7418DCB9C55C974C74\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4D8B8286CB77C7418DCB9C55C974C74\SourceList\Media\2 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\StartMenuHelper.DLL	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\StartMenuExt	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4D8B8286CB77C7418DCB9C55C974C74\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4D8B8286CB77C7418DCB9C55C974C74\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ShowSearchSuggestionsGlobal = "0"	OOSU10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000300000014000000494c200603000400540010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004000000001002000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b8b8efc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff6c6c6c864d4d4d637c7c7cd6838383fd838383fd7c7c7cd64c4c4c636464647f0000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff8f8f8fb64d4d4d64818181fa8f8f8ffe828282ff828282ff909090fe818181fa4e4e4e650000000000000000a2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ff4646465a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff3636363a818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff36363639818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffc3c3c3fff6f6f6fffffffffffffffffff6f6f6ff4d4d4d5a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5b5b5b5ffb5b5b5fff6f6f6fffafafaffccccccffccccccfffafafaffa9a9a9b74b4b4b60828282f98f8f8ffd828282ff828282ff909090fd828282f94d4d4d62b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffff656565864b4b4b607a7a7ad4818181fc818181fc7a7a7ad44c4c4c6266666686b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffffb6b6b6ff858585b64444445936363638363636384d4d4d5a8b8b8bb78a8a8adfb5b5b5ffb5b5b5ffecececfffafafaffccccccffc7c7c7fff6f6f6fff6f6f6ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffc3c3c3fff1f1f1fffffffffffffffffff6f6f6ffc3c3c3ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb9b9b9ffbebebeffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffacacacffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb7b7b7ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000a9a9a9efb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffacacacef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000c0000000c000000000000000000000000000000000000000000000000000000000010000000100000001000000010000e0010000e0010000e0010000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000003000000040000002c000000010000000000000001000000000000000100000000000000	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3214FBB-3CA1-406A-B3E8-3EB7C393A15E}\ = "StartMenuEmulation"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LOCALSERVER32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3214FBB-3CA1-406A-B3E8-3EB7C393A15E}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3214FBB-3CA1-406A-B3E8-3EB7C393A15E}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\ShowSearchHistory	OOSU10.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4D8B8286CB77C7418DCB9C55C974C74\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FCBE96C-1697-43AF-9140-2897C7C69767}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\TYPELIB\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\WIN64	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt\ = "{E595F05F-903F-4318-8B0A-7F633B520D2B}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5ab14324-c087-42c1-b905-a0bfdb4e9532}	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	OOSU10.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open\command	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "0"	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82e749ed-b971-4550-baf7-06aa2bf7e836}\ShellFolder	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5ab14324-c087-42c1-b905-a0bfdb4e9532}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{62D2FBE4-89F7-48A5-A35F-DA2B8A3C54B7}	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82e749ed-b971-4550-baf7-06aa2bf7e836}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\StartMenuExt	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B4D8B8286CB77C7418DCB9C55C974C74\ProductName = "Open-Shell"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5ab14324-c087-42c1-b905-a0bfdb4e9532}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\StartMenuExt\ = "{E595F05F-903F-4318-8B0A-7F633B520D2B}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FE47A977ED3217C4CA21E25E5A24DE43\B4D8B8286CB77C7418DCB9C55C974C74	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Launcher.DesktopPackagedApplication\shellex\ContextMenuHandlers\StartMenuExt\ = "{E595F05F-903F-4318-8B0A-7F633B520D2B}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E595F05F-903F-4318-8B0A-7F633B520D2B}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\StartMenuExt	MsiExec.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5648	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4332	powershell.exe
4332	powershell.exe
3804	NSudoLG.exe
3804	NSudoLG.exe
6120	powershell.exe
6120	powershell.exe
5412	NSudoLG.exe
5412	NSudoLG.exe
1988	NSudoLG.exe
1988	NSudoLG.exe
4308	powershell.exe
4308	powershell.exe
4932	setup.exe
4932	setup.exe
4932	setup.exe
4932	setup.exe
4932	setup.exe
4932	setup.exe
3628	explorer.exe
3628	explorer.exe
3596	msiexec.exe
3596	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeBackupPrivilege	4052	TiWorker.exe
Token: SeRestorePrivilege	4052	TiWorker.exe
Token: SeSecurityPrivilege	4052	TiWorker.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeTakeOwnershipPrivilege	1376	takeown.exe
Token: SeDebugPrivilege	3804	NSudoLG.exe
Token: SeDebugPrivilege	6120	powershell.exe
Token: SeIncreaseQuotaPrivilege	6120	powershell.exe
Token: SeSecurityPrivilege	6120	powershell.exe
Token: SeTakeOwnershipPrivilege	6120	powershell.exe
Token: SeLoadDriverPrivilege	6120	powershell.exe
Token: SeSystemProfilePrivilege	6120	powershell.exe
Token: SeSystemtimePrivilege	6120	powershell.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe
3628	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3628	explorer.exe
5772	SearchHost.exe
1052	StartMenuExperienceHost.exe
3628	explorer.exe
4944	StartMenu.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5528 wrote to memory of 5192	5528	cmd.exe	82
PID 5528 wrote to memory of 5208	5528	cmd.exe	83
PID 5208 wrote to memory of 4588	5208	cmd.exe	84
PID 5208 wrote to memory of 5540	5208	cmd.exe	85
PID 5528 wrote to memory of 3504	5528	cmd.exe	87
PID 3504 wrote to memory of 3416	3504	cmd.exe	88
PID 5528 wrote to memory of 892	5528	cmd.exe	89
PID 5528 wrote to memory of 4184	5528	cmd.exe	90
PID 5528 wrote to memory of 2852	5528	cmd.exe	91
PID 5528 wrote to memory of 5136	5528	cmd.exe	92
PID 5528 wrote to memory of 652	5528	cmd.exe	93
PID 5528 wrote to memory of 2800	5528	cmd.exe	94
PID 5528 wrote to memory of 4404	5528	cmd.exe	95
PID 5528 wrote to memory of 5888	5528	cmd.exe	96
PID 5528 wrote to memory of 4568	5528	cmd.exe	97
PID 5528 wrote to memory of 5520	5528	cmd.exe	98
PID 5520 wrote to memory of 5980	5520	net.exe	99
PID 5528 wrote to memory of 4700	5528	cmd.exe	102
PID 5528 wrote to memory of 2540	5528	cmd.exe	103
PID 5528 wrote to memory of 4004	5528	cmd.exe	104
PID 5528 wrote to memory of 852	5528	cmd.exe	105
PID 5528 wrote to memory of 436	5528	cmd.exe	106
PID 5528 wrote to memory of 5036	5528	cmd.exe	107
PID 5528 wrote to memory of 5544	5528	cmd.exe	108
PID 5528 wrote to memory of 4092	5528	cmd.exe	109
PID 5528 wrote to memory of 4824	5528	cmd.exe	110
PID 5528 wrote to memory of 3304	5528	cmd.exe	111
PID 5528 wrote to memory of 3012	5528	cmd.exe	112
PID 5528 wrote to memory of 2280	5528	cmd.exe	113
PID 5528 wrote to memory of 5116	5528	cmd.exe	114
PID 5528 wrote to memory of 560	5528	cmd.exe	115
PID 5528 wrote to memory of 1928	5528	cmd.exe	116
PID 5528 wrote to memory of 324	5528	cmd.exe	117
PID 5528 wrote to memory of 5592	5528	cmd.exe	118
PID 5528 wrote to memory of 1428	5528	cmd.exe	119
PID 5528 wrote to memory of 1192	5528	cmd.exe	120
PID 5528 wrote to memory of 656	5528	cmd.exe	121
PID 5528 wrote to memory of 3660	5528	cmd.exe	122
PID 5528 wrote to memory of 4444	5528	cmd.exe	123
PID 5528 wrote to memory of 3628	5528	cmd.exe	124
PID 5528 wrote to memory of 6100	5528	cmd.exe	125
PID 5528 wrote to memory of 3668	5528	cmd.exe	126
PID 5528 wrote to memory of 1416	5528	cmd.exe	127
PID 5528 wrote to memory of 5744	5528	cmd.exe	128
PID 5528 wrote to memory of 5700	5528	cmd.exe	129
PID 5528 wrote to memory of 1896	5528	cmd.exe	130
PID 5528 wrote to memory of 2256	5528	cmd.exe	131
PID 5528 wrote to memory of 5416	5528	cmd.exe	132
PID 5528 wrote to memory of 5420	5528	cmd.exe	133
PID 5528 wrote to memory of 4988	5528	cmd.exe	134
PID 5528 wrote to memory of 5648	5528	cmd.exe	135
PID 5528 wrote to memory of 5656	5528	cmd.exe	136
PID 5528 wrote to memory of 1692	5528	cmd.exe	137
PID 5528 wrote to memory of 6016	5528	cmd.exe	138
PID 5528 wrote to memory of 4852	5528	cmd.exe	139
PID 5528 wrote to memory of 2004	5528	cmd.exe	140
PID 5528 wrote to memory of 4996	5528	cmd.exe	141
PID 5528 wrote to memory of 664	5528	cmd.exe	142
PID 5528 wrote to memory of 1744	5528	cmd.exe	143
PID 5528 wrote to memory of 2548	5528	cmd.exe	144
PID 5528 wrote to memory of 4652	5528	cmd.exe	145
PID 5528 wrote to memory of 5628	5528	cmd.exe	146
PID 5528 wrote to memory of 3796	5528	cmd.exe	147
PID 5528 wrote to memory of 3568	5528	cmd.exe	148

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	OOSU10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAMeetNow = "1"	OOSU10.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-V8.4.bat"
1⤵
- Drops file in Windows directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5528
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:5192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s -L https://raw.githubusercontent.com/QuakedK/Oneclick/main/Version.md | findstr /i "Latest_Version"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\system32\curl.exe
    curl -s -L https://raw.githubusercontent.com/QuakedK/Oneclick/main/Version.md
    3⤵
    PID:4588
- - C:\Windows\system32\findstr.exe
    findstr /i "Latest_Version"
    3⤵
    PID:5540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
    3⤵
    PID:3416
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "GlobalTimerResolutionRequests" /t REG_DWORD /d "1" /f
  2⤵
  PID:892
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64"
  2⤵
  PID:4184
- C:\Windows\system32\sc.exe
  sc query "ucpd"
  2⤵
  PID:2852
- C:\Windows\system32\find.exe
  find "STATE"
  2⤵
  PID:5136
- C:\Windows\system32\find.exe
  find "RUNNING"
  2⤵
  PID:652
- C:\Windows\system32\sc.exe
  sc qc "TrustedInstaller"
  2⤵
  PID:2800
- C:\Windows\system32\find.exe
  find "START_TYPE"
  2⤵
  PID:4404
- C:\Windows\system32\find.exe
  find "DISABLED"
  2⤵
  PID:5888
- C:\Windows\system32\sc.exe
  sc config TrustedInstaller start=auto
  2⤵
  PID:4568
- C:\Windows\system32\net.exe
  net start TrustedInstaller
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start TrustedInstaller
    3⤵
    PID:5980
- C:\Windows\system32\curl.exe
  curl -s -L "https://github.com/QuakedK/Oneclick/raw/refs/heads/main/Downloads/V8.0/OneclickTools.zip" -o "C:\\Oneclick Tools.zip"
  2⤵
  PID:4700
- C:\Windows\system32\tar.exe
  tar -xf "C:\\Oneclick Tools.zip" --strip-components=1
  2⤵
  PID:2540
- C:\Windows\system32\sc.exe
  sc query "WinDefend"
  2⤵
  PID:4004
- C:\Windows\system32\find.exe
  find "STATE"
  2⤵
  PID:852
- C:\Windows\system32\find.exe
  find "RUNNING"
  2⤵
  PID:436
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5036
- C:\Windows\system32\cmd.exe
  cmd /c "pause >nul & echo.>"C:\Users\Admin\AppData\Local\Temp\Skip.Loop""
  2⤵
  - Executes a command shell one-liner
  PID:5544
- C:\Windows\system32\PATHPING.EXE
  PATHPING 127.0.0.1 -n -q 1 -p 650
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4092
- C:\Windows\system32\PATHPING.EXE
  PATHPING 127.0.0.1 -n -q 1 -p 650
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4824
- C:\Windows\system32\PATHPING.EXE
  PATHPING 127.0.0.1 -n -q 1 -p 650
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3304
- C:\Windows\system32\PATHPING.EXE
  PATHPING 127.0.0.1 -n -q 1 -p 650
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3012
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2280
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5116
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:560
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1928
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:324
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:5592
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d "0" /f
  2⤵
  - Modifies visibility of file extensions in Explorer
  PID:1192
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d "1" /f
  2⤵
  PID:656
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e88865ea-0e1c-4e20-9aa6-edcd0212c87c}" /f
  2⤵
  PID:3660
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{f874310e-b6b7-47dc-bc84-b9e6b38f5903}" /f
  2⤵
  PID:4444
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCAMeetNow" /t REG_DWORD /d "1" /f
  2⤵
  PID:3628
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d "0" /f
  2⤵
  PID:6100
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "SettingsPageVisibility" /t REG_SZ /d "hide:home" /f
  2⤵
  PID:3668
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "BingSearchEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1416
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:5744
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d "0" /f
  2⤵
  PID:5700
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d "0" /f
  2⤵
  PID:1896
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Feeds" /v "EnableFeeds" /t REG_DWORD /d "0" /f
  2⤵
  PID:2256
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Feeds" /v "ShellFeedsTaskbarViewMode" /t REG_DWORD /d "2" /f
  2⤵
  PID:5416
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\NewsAndInterests" /v "AllowNewsAndInterests" /t REG_DWORD /d "0" /f
  2⤵
  PID:5420
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Dsh" /v "AllowNewsAndInterests" /t REG_DWORD /d "0" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v "EnableTransparency" /t REG_DWORD /d "0" /f
  2⤵
  - Modifies registry key
  PID:5648
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Start" /v "HideRecommendedSection" /t REG_DWORD /d "1" /f
  2⤵
  PID:5656
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Education" /v "IsEducationEnvironment" /t REG_DWORD /d "1" /f
  2⤵
  PID:1692
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v "HideRecommendedSection" /t REG_DWORD /d "1" /f
  2⤵
  PID:6016
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /f /v "LaunchTo" /t REG_DWORD /d "1"
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\OperationStatusManager" /v "EnthusiastMode" /t REG_DWORD /d "1" /f
  2⤵
  PID:2004
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "LongPathsEnabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAl" /t REG_DWORD /d "0" /f
  2⤵
  PID:664
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v "DragFullWindows" /t REG_SZ /d "0" /f
  2⤵
  PID:1744
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "200" /f
  2⤵
  PID:2548
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop\WindowMetrics" /v "MinAnimate" /t REG_SZ /d "0" /f
  2⤵
  PID:4652
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\DWM" /v "EnableAeroPeek" /t REG_DWORD /d "0" /f
  2⤵
  PID:5628
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v "UserPreferencesMask" /t REG_BINARY /d "9012038010000000" /f
  2⤵
  PID:3796
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewAlphaSelect" /t REG_DWORD /d "0" /f
  2⤵
  PID:3568
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewShadow" /t REG_DWORD /d "0" /f
  2⤵
  PID:4452
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d "0" /f
  2⤵
  PID:4828
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /t REG_DWORD /d "3" /f
  2⤵
  PID:1796
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /ve /t REG_SZ /d "" /f
  2⤵
  PID:348
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -NoProfile -Command "[void](Add-Type '[DllImport(\"user32.dll\")]public static extern bool SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni);' -Name NativeMethods -Namespace Win32 -PassThru)::SystemParametersInfo(20, 0, 'C:\Oneclick Tools\Oneclick Wallpaper\Oneclick Purple & Blue 4K Wallpaper.jpg', 3)"
  2⤵
  - Sets desktop wallpaper using registry
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4332
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eugxplps\eugxplps.cmdline"
    3⤵
    PID:4884
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96AD.tmp" "c:\Users\Admin\AppData\Local\Temp\eugxplps\CSC89E653D8727249638154B1F6694F950.TMP"
      4⤵
      PID:1832
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /V "WallpaperStyle" /T REG_SZ /F /D "10"
  2⤵
  PID:440
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /V "TileWallpaper" /T REG_SZ /F /D "0"
  2⤵
  - Family: Matrix Ransomware
  PID:948
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1664
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\Branding\Basebrd\basebrd.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\Branding\Basebrd\basebrd.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3988
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation" /v "Manufacturer" /t REG_SZ /d "Quaked Tweaks" /f
  2⤵
  PID:3500
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation" /v "SupportURL" /t REG_SZ /d "https://discord.gg/8NqDSMzYun" /f
  2⤵
  PID:1528
- C:\Windows\system32\sc.exe
  sc create "Quaked Tweaks" binPath="C:\Oneclick.bat" start=disabled
  2⤵
  PID:768
- C:\Windows\system32\sc.exe
  sc description "Quaked Tweaks" "This is a dummy service that does nothing and is used for branding and marketing purposes."
  2⤵
  PID:3828
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:3720
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4880
- C:\Oneclick Tools\NSudo\NSudoLG.exe
  "C:\Oneclick Tools\NSudo\NSudoLG.exe" -ShowWindowMode:hide -U:T -P:E "C:\Oneclick Tools\Update Disabler\Oneclick Update Disabler V1.2.bat"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3804
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\Explorer" /v "DisableNotificationCenter" /t REG_DWORD /d "1" /f
  2⤵
  PID:1488
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v "ToastEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:960
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications" /v "GlobalUserDisabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:2740
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v "MouseSpeed" /t REG_SZ /d "0" /f
  2⤵
  PID:3264
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v "MouseThreshold1" /t REG_SZ /d "0" /f
  2⤵
  PID:1872
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v "MouseThreshold2" /t REG_SZ /d "0" /f
  2⤵
  PID:5028
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\StickyKeys" /v "Flags" /t REG_SZ /d "506" /f
  2⤵
  PID:5668
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\ToggleKeys" /v "Flags" /t REG_SZ /d "58" /f
  2⤵
  PID:3068
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Accessibility\Keyboard Response" /v "Flags" /t REG_SZ /d "122" /f
  2⤵
  PID:2944
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\DirectX\UserGpuPreferences" /v "DirectXUserGlobalSettings" /t REG_SZ /d "SwapEffectUpgradeEnable=1;" /f
  2⤵
  PID:4972
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v "HwSchMode" /t REG_DWORD /d "2" /f
  2⤵
  PID:1172
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_FSEBehaviorMode /t REG_DWORD /d "2" /f
  2⤵
  PID:5684
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_FSEBehavior /t REG_DWORD /d "2" /f
  2⤵
  PID:5508
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_DSEBehavior /t REG_DWORD /d "2" /f
  2⤵
  PID:1220
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_Enabled /t REG_DWORD /d "0" /f
  2⤵
  PID:3208
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_DXGIHonorFSEWindowsCompatible /t REG_DWORD /d "1" /f
  2⤵
  PID:1612
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_HonorUserFSEBehaviorMode /t REG_DWORD /d "1" /f
  2⤵
  PID:1656
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_EFSEFeatureFlags /t REG_DWORD /d "0" /f
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d "0" /f
  2⤵
  PID:3332
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AppCaptureEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:6088
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AudioCaptureEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5108
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "CursorCaptureEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2972
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "MicrophoneCaptureEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1468
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\GameBar" /v "AllowAutoGameMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:3324
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\GameBar" /v "AutoGameModeEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2848
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy" /v "01" /t REG_DWORD /d "0" /f
  2⤵
  PID:5096
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:5016
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v "DisabledComponents" /t REG_DWORD /d "255" /f
  2⤵
  PID:4624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -NoProfile -Command "Disable-NetAdapterBinding -Name '*' -ComponentID ms_tcpip6"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6120
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5980
- C:\Windows\system32\netsh.exe
  netsh interface teredo set state disabled
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1484
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:5912
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v "SystemResponsiveness" /t REG_DWORD /d "10" /f
  2⤵
  PID:2452
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:5392
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5272
- C:\Oneclick Tools\NSudo\NSudoLG.exe
  "C:\Oneclick Tools\NSudo\NSudoLG.exe" -ShowWindowMode:hide -U:T -P:E "C:\Oneclick Tools\Task Destroyer\Oneclick Task Destroyer V1.3.bat"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5412
- C:\Oneclick Tools\OOshutup10\OOSU10.exe
  "C:\Oneclick Tools\OOshutup10\OOSU10.exe" "C:\Oneclick Tools\OOshutup10\QuakedOOshutup10 V2.cfg" /quiet
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Modifies Control Panel
  - Modifies registry class
  - System policy modification
  PID:5524
- C:\Oneclick Tools\NSudo\NSudoLG.exe
  "C:\Oneclick Tools\NSudo\NSudoLG.exe" -ShowWindowMode:hide -U:T -P:E "C:\Oneclick Tools\Autologger Destroyer\Oneclick Autologger Destroyer V1.0.bat"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /t REG_DWORD /d "0" /f
  2⤵
  PID:1740
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "PublishUserActivities" /t REG_DWORD /d "0" /f
  2⤵
  PID:3196
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "UploadUserActivities" /t REG_DWORD /d "0" /f
  2⤵
  PID:4900
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location" /v "Value" /t REG_SZ /d "Deny" /f
  2⤵
  PID:4432
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" /v "SensorPermissionState" /t REG_DWORD /d "0" /f
  2⤵
  PID:2952
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\lfsvc\Service\Configuration" /v "Status" /t REG_DWORD /d "0" /f
  2⤵
  PID:3360
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\Maps" /v "AutoUpdateEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4420
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v AllowTelemetry /t REG_DWORD /d "0" /f
  2⤵
  PID:5228
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d "0" /f
  2⤵
  PID:6072
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "DoNotShowFeedbackNotifications" /t REG_DWORD /d "1" /f
  2⤵
  PID:5796
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:5672
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer" /v "DisableCoInstallers" /t REG_DWORD /d "1" /f
  2⤵
  PID:468
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching" /v "SearchOrderConfig" /t REG_DWORD /d "0" /f
  2⤵
  PID:324
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" /v "Value" /t REG_DWORD /d "0" /f
  2⤵
  PID:2888
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" /v "Value" /t REG_DWORD /d "0" /f
  2⤵
  PID:4772
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d "0" /f
  2⤵
  PID:4748
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" /v "DODownloadMode" /t REG_DWORD /d "1" /f
  2⤵
  PID:2420
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" /v "DODownloadMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator" /v "NoActiveProbe" /t REG_DWORD /d "1" /f
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v "EnableActiveProbing" /t REG_DWORD /d "0" /f
  2⤵
  PID:2496
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Siuf\Rules" /v "NumberOfSIUFInPeriod" /t REG_DWORD /d "0" /f
  2⤵
  PID:580
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Siuf\Rules" /v "PeriodInNanoSeconds" /f
  2⤵
  PID:1852
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "ContentDeliveryAllowed" /t REG_DWORD /d "0" /f
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "OemPreInstalledAppsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2436
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4228
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "PreInstalledAppsEverEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4408
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SilentInstalledAppsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2536
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3848
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338388Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4464
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-353698Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3372
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SystemPaneSuggestionsEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5648
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement" /v "ScoobeSystemSettingEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5656
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v "DisableTailoredExperiencesWithDiagnosticData" /t REG_DWORD /d "1" /f
  2⤵
  PID:1692
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v "DisableWindowsConsumerFeatures" /t REG_DWORD /d "1" /f
  2⤵
  PID:6016
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" /v "DisabledByGroupPolicy" /t REG_DWORD /d "1" /f
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2004
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v "VerifiedAndReputablePolicyState" /t REG_DWORD /d "0" /f
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d "0" /f
  2⤵
  PID:664
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:1744
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1880
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:1500
- C:\Windows\system32\reg.exe
  reg export "HKLM\System\CurrentControlSet\Services" "C:\Oneclick Backup\Services\Services.reg" /y
  2⤵
  - Maps connected drives based on registry
  - Remote Services: SMB/Windows Admin Shares
  PID:5772
- C:\Windows\system32\sc.exe
  sc config AarSvc start=disabled
  2⤵
  PID:1840
- C:\Windows\system32\sc.exe
  sc config ADPSvc start=disabled
  2⤵
  PID:5296
- C:\Windows\system32\sc.exe
  sc config AJRouter start=disabled
  2⤵
  PID:5340
- C:\Windows\system32\sc.exe
  sc config ALG start=disabled
  2⤵
  PID:1796
- C:\Windows\system32\sc.exe
  sc config AppMgmt start=disabled
  2⤵
  PID:348
- C:\Windows\system32\sc.exe
  sc config AppInfo start=demand
  2⤵
  PID:132
- C:\Windows\system32\sc.exe
  sc config AppReadiness start=disabled
  2⤵
  PID:6040
- C:\Windows\system32\sc.exe
  sc config AssignedAccessManagerSvc start=disabled
  2⤵
  PID:2552
- C:\Windows\system32\sc.exe
  sc config autotimesvc start=disabled
  2⤵
  PID:4460
- C:\Windows\system32\sc.exe
  sc config AxInstSV start=disabled
  2⤵
  - Launches sc.exe
  PID:3376
- C:\Windows\system32\sc.exe
  sc config BcastDVRUserService start=disabled
  2⤵
  PID:1244
- C:\Windows\system32\sc.exe
  sc config BDESVC start=disabled
  2⤵
  - Launches sc.exe
  PID:2028
- C:\Windows\system32\sc.exe
  sc config BITS start=disabled
  2⤵
  - Launches sc.exe
  PID:1640
- C:\Windows\system32\sc.exe
  sc config BluetoothUserService start=disabled
  2⤵
  - Launches sc.exe
  PID:3056
- C:\Windows\system32\sc.exe
  sc config BTAGService start=disabled
  2⤵
  PID:3984
- C:\Windows\system32\sc.exe
  sc config BthAvctpSvc start=disabled
  2⤵
  PID:6036
- C:\Windows\system32\sc.exe
  sc config bthserv start=disabled
  2⤵
  PID:6044
- C:\Windows\system32\sc.exe
  sc config CaptureService start=disabled
  2⤵
  PID:5348
- C:\Windows\system32\sc.exe
  sc config cbdhsvc start=disabled
  2⤵
  PID:4784
- C:\Windows\system32\sc.exe
  sc config CDPUserSvc start=disabled
  2⤵
  PID:1164
- C:\Windows\system32\sc.exe
  sc config CDPSvc start=disabled
  2⤵
  PID:5160
- C:\Windows\system32\sc.exe
  sc config CertPropSvc start=disabled
  2⤵
  PID:1664
- C:\Windows\system32\sc.exe
  sc config CloudBackupRestoreSvc start=disabled
  2⤵
  PID:1820
- C:\Windows\system32\sc.exe
  sc config cloudidsvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3168
- C:\Windows\system32\sc.exe
  sc config COMSysApp start=disabled
  2⤵
  - Launches sc.exe
  PID:3316
- C:\Windows\system32\sc.exe
  sc config ConsentUxUserSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:6076
- C:\Windows\system32\sc.exe
  sc config CscService start=disabled
  2⤵
  PID:5856
- C:\Windows\system32\sc.exe
  sc config dcsvc start=disabled
  2⤵
  PID:1848
- C:\Windows\system32\sc.exe
  sc config defragsvc start=demand
  2⤵
  - Launches sc.exe
  PID:548
- C:\Windows\system32\sc.exe
  sc config DeviceAssociationService start=disabled
  2⤵
  PID:2524
- C:\Windows\system32\sc.exe
  sc config DeviceInstall start=disabled
  2⤵
  PID:768
- C:\Windows\system32\sc.exe
  sc config DevicePickerUserSvc start=disabled
  2⤵
  PID:5260
- C:\Windows\system32\sc.exe
  sc config DevicesFlowUserSvc start=disabled
  2⤵
  PID:1460
- C:\Windows\system32\sc.exe
  sc config DevQueryBroker start=disabled
  2⤵
  PID:3812
- C:\Windows\system32\sc.exe
  sc config diagnosticshub.standardcollector.service start=disabled
  2⤵
  PID:2428
- C:\Windows\system32\sc.exe
  sc config DiagTrack start=disabled
  2⤵
  PID:1448
- C:\Windows\system32\sc.exe
  sc config diagsvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3744
- C:\Windows\system32\sc.exe
  sc config DispBrokerDesktopSvc start=auto
  2⤵
  PID:1488
- C:\Windows\system32\sc.exe
  sc config DisplayEnhancementService start=disabled
  2⤵
  PID:960
- C:\Windows\system32\sc.exe
  sc config DmEnrollmentSvc start=disabled
  2⤵
  PID:2740
- C:\Windows\system32\sc.exe
  sc config dmwappushservice start=disabled
  2⤵
  PID:3264
- C:\Windows\system32\sc.exe
  sc config dot3svc start=disabled
  2⤵
  PID:6092
- C:\Windows\system32\sc.exe
  sc config DPS start=disabled
  2⤵
  - Launches sc.exe
  PID:6096
- C:\Windows\system32\sc.exe
  sc config DsmSvc start=disabled
  2⤵
  PID:2124
- C:\Windows\system32\sc.exe
  sc config DsSvc start=disabled
  2⤵
  PID:5444
- C:\Windows\system32\sc.exe
  sc config DusmSvc start=disabled
  2⤵
  PID:3280
- C:\Windows\system32\sc.exe
  sc config Eaphost start=disabled
  2⤵
  PID:1728
- C:\Windows\system32\sc.exe
  sc config edgeupdate start=disabled
  2⤵
  PID:1720
- C:\Windows\system32\sc.exe
  sc config edgeupdatem start=disabled
  2⤵
  PID:792
- C:\Windows\system32\sc.exe
  sc config EFS start=disabled
  2⤵
  PID:5684
- C:\Windows\system32\sc.exe
  sc config EventLog start=disabled
  2⤵
  PID:3092
- C:\Windows\system32\sc.exe
  sc config EventSystem start=demand
  2⤵
  PID:5872
- C:\Windows\system32\sc.exe
  sc config fdPHost start=disabled
  2⤵
  PID:784
- C:\Windows\system32\sc.exe
  sc config FDResPub start=disabled
  2⤵
  PID:1628
- C:\Windows\system32\sc.exe
  sc config fhsvc start=disabled
  2⤵
  - Launches sc.exe
  PID:2056
- C:\Windows\system32\sc.exe
  sc config FontCache start=disabled
  2⤵
  - Launches sc.exe
  PID:3320
- C:\Windows\system32\sc.exe
  sc config FrameServer start=disabled
  2⤵
  PID:4032
- C:\Windows\system32\sc.exe
  sc config FrameServerMonitor start=disabled
  2⤵
  PID:3584
- C:\Windows\system32\sc.exe
  sc config GameInputSvc start=disabled
  2⤵
  PID:5020
- C:\Windows\system32\sc.exe
  sc config GraphicsPerfSvc start=disabled
  2⤵
  PID:5712
- C:\Windows\system32\sc.exe
  sc config hpatchmon start=disabled
  2⤵
  PID:2972
- C:\Windows\system32\sc.exe
  sc config hidserv start=disabled
  2⤵
  PID:492
- C:\Windows\system32\sc.exe
  sc config HvHost start=disabled
  2⤵
  - Launches sc.exe
  PID:4276
- C:\Windows\system32\sc.exe
  sc config icssvc start=disabled
  2⤵
  PID:3324
- C:\Windows\system32\sc.exe
  sc config IKEEXT start=disabled
  2⤵
  PID:2848
- C:\Windows\system32\sc.exe
  sc config InstallService start=disabled
  2⤵
  - Launches sc.exe
  PID:4436
- C:\Windows\system32\sc.exe
  sc config InventorySvc start=disabled
  2⤵
  PID:4504
- C:\Windows\system32\sc.exe
  sc config IpxlatCfgSvc start=disabled
  2⤵
  PID:4476
- C:\Windows\system32\sc.exe
  sc config KtmRm start=disabled
  2⤵
  - Launches sc.exe
  PID:4624
- C:\Windows\system32\sc.exe
  sc config LanmanServer start=disabled
  2⤵
  PID:6064
- C:\Windows\system32\sc.exe
  sc config LanmanWorkstation start=disabled
  2⤵
  PID:4928
- C:\Windows\system32\sc.exe
  sc config lfsvc start=disabled
  2⤵
  PID:2792
- C:\Windows\system32\sc.exe
  sc config LocalKdc start=disabled
  2⤵
  - Launches sc.exe
  PID:3416
- C:\Windows\system32\sc.exe
  sc config LicenseManager start=disabled
  2⤵
  PID:5132
- C:\Windows\system32\sc.exe
  sc config lltdsvc start=disabled
  2⤵
  PID:4628
- C:\Windows\system32\sc.exe
  sc config lmhosts start=disabled
  2⤵
  PID:5556
- C:\Windows\system32\sc.exe
  sc config LxpSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:1688
- C:\Windows\system32\sc.exe
  sc config MapsBroker start=disabled
  2⤵
  PID:6124
- C:\Windows\system32\sc.exe
  sc config McpManagementService start=disabled
  2⤵
  PID:1708
- C:\Windows\system32\sc.exe
  sc config McmSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:5640
- C:\Windows\system32\sc.exe
  sc config MessagingService start=disabled
  2⤵
  - Launches sc.exe
  PID:2400
- C:\Windows\system32\sc.exe
  sc config midisrv start=disabled
  2⤵
  PID:4016
- C:\Windows\system32\sc.exe
  sc config MSDTC start=disabled
  2⤵
  - Launches sc.exe
  PID:3672
- C:\Windows\system32\sc.exe
  sc config MSiSCSI start=disabled
  2⤵
  PID:3364
- C:\Windows\system32\sc.exe
  sc config NaturalAuthentication start=disabled
  2⤵
  PID:4740
- C:\Windows\system32\sc.exe
  sc config NcaSvc start=disabled
  2⤵
  PID:5268
- C:\Windows\system32\sc.exe
  sc config NcbService start=disabled
  2⤵
  PID:3596
- C:\Windows\system32\sc.exe
  sc config NcdAutoSetup start=disabled
  2⤵
  PID:5492
- C:\Windows\system32\sc.exe
  sc config Netlogon start=disabled
  2⤵
  PID:2836
- C:\Windows\system32\sc.exe
  sc config Netman start=disabled
  2⤵
  PID:4616
- C:\Windows\system32\sc.exe
  sc config NetSetupSvc start=disabled
  2⤵
  PID:1484
- C:\Windows\system32\sc.exe
  sc config NetTcpPortSharing start=disabled
  2⤵
  - Launches sc.exe
  PID:5004
- C:\Windows\system32\sc.exe
  sc config NlaSvc start=disabled
  2⤵
  PID:5392
- C:\Windows\system32\sc.exe
  sc config NPSMSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:5496
- C:\Windows\system32\sc.exe
  sc config OneSyncSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:5792
- C:\Windows\system32\sc.exe
  sc config p2pimsvc start=disabled
  2⤵
  PID:1572
- C:\Windows\system32\sc.exe
  sc config p2psvc start=disabled
  2⤵
  PID:5412
- C:\Windows\system32\sc.exe
  sc config P9RdrService start=disabled
  2⤵
  PID:1476
- C:\Windows\system32\sc.exe
  sc config PcaSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3492
- C:\Windows\system32\sc.exe
  sc config PeerDistSvc start=disabled
  2⤵
  PID:3204
- C:\Windows\system32\sc.exe
  sc config PenService start=disabled
  2⤵
  PID:5024
- C:\Windows\system32\sc.exe
  sc config perceptionsimulation start=disabled
  2⤵
  PID:4324
- C:\Windows\system32\sc.exe
  sc config PerfHost start=disabled
  2⤵
  - Launches sc.exe
  PID:5332
- C:\Windows\system32\sc.exe
  sc config PhoneSvc start=disabled
  2⤵
  PID:5696
- C:\Windows\system32\sc.exe
  sc config PimIndexMaintenanceSvc start=disabled
  2⤵
  PID:4004
- C:\Windows\system32\sc.exe
  sc config pla start=disabled
  2⤵
  - Launches sc.exe
  PID:2060
- C:\Windows\system32\sc.exe
  sc config PNRPAutoReg start=disabled
  2⤵
  - Launches sc.exe
  PID:2204
- C:\Windows\system32\sc.exe
  sc config PNRPsvc start=disabled
  2⤵
  PID:1988
- C:\Windows\system32\sc.exe
  sc config PolicyAgent start=disabled
  2⤵
  PID:2412
- C:\Windows\system32\sc.exe
  sc config PrintDeviceConfigurationService start=disabled
  2⤵
  - Launches sc.exe
  PID:1828
- C:\Windows\system32\sc.exe
  sc config PrintNotify start=disabled
  2⤵
  PID:5408
- C:\Windows\system32\sc.exe
  sc config PrintScanBrokerService start=disabled
  2⤵
  - Launches sc.exe
  PID:2908
- C:\Windows\system32\sc.exe
  sc config PushToInstall start=disabled
  2⤵
  PID:2224
- C:\Windows\system32\sc.exe
  sc config QWAVE start=disabled
  2⤵
  PID:2920
- C:\Windows\system32\sc.exe
  sc config RasAuto start=disabled
  2⤵
  PID:5840
- C:\Windows\system32\sc.exe
  sc config RasMan start=disabled
  2⤵
  PID:6116
- C:\Windows\system32\sc.exe
  sc config refsdedupsvc start=disabled
  2⤵
  PID:1684
- C:\Windows\system32\sc.exe
  sc config RemoteAccess start=disabled
  2⤵
  PID:4120
- C:\Windows\system32\sc.exe
  sc config RemoteRegistry start=disabled
  2⤵
  PID:5796
- C:\Windows\system32\sc.exe
  sc config RetailDemo start=disabled
  2⤵
  PID:1928
- C:\Windows\system32\sc.exe
  sc config RmSvc start=disabled
  2⤵
  PID:692
- C:\Windows\system32\sc.exe
  sc config RpcLocator start=disabled
  2⤵
  PID:6052
- C:\Windows\system32\sc.exe
  sc config SamSs start=disabled
  2⤵
  PID:444
- C:\Windows\system32\sc.exe
  sc config SCardSvr start=disabled
  2⤵
  PID:576
- C:\Windows\system32\sc.exe
  sc config ScDeviceEnum start=disabled
  2⤵
  PID:1564
- C:\Windows\system32\sc.exe
  sc config SCPolicySvc start=disabled
  2⤵
  PID:4748
- C:\Windows\system32\sc.exe
  sc config SDRSVC start=disabled
  2⤵
  PID:2420
- C:\Windows\system32\sc.exe
  sc config seclogon start=disabled
  2⤵
  - Launches sc.exe
  PID:4040
- C:\Windows\system32\sc.exe
  sc config SENS start=disabled
  2⤵
  PID:4444
- C:\Windows\system32\sc.exe
  sc config Sense start=disabled
  2⤵
  PID:3628
- C:\Windows\system32\sc.exe
  sc config SensorDataService start=disabled
  2⤵
  PID:6100
- C:\Windows\system32\sc.exe
  sc config SensorService start=disabled
  2⤵
  PID:2284
- C:\Windows\system32\sc.exe
  sc config SensrSvc start=disabled
  2⤵
  PID:5784
- C:\Windows\system32\sc.exe
  sc config SEMgrSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:888
- C:\Windows\system32\sc.exe
  sc config SessionEnv start=disabled
  2⤵
  PID:5744
- C:\Windows\system32\sc.exe
  sc config SharedAccess start=disabled
  2⤵
  - Launches sc.exe
  PID:5976
- C:\Windows\system32\sc.exe
  sc config SharedRealitySvc start=disabled
  2⤵
  - Launches sc.exe
  PID:5984
- C:\Windows\system32\sc.exe
  sc config ShellHWDetection start=disabled
  2⤵
  - Launches sc.exe
  PID:3664
- C:\Windows\system32\sc.exe
  sc config shpamsvc start=disabled
  2⤵
  PID:5416
- C:\Windows\system32\sc.exe
  sc config SmsRouter start=disabled
  2⤵
  PID:5624
- C:\Windows\system32\sc.exe
  sc config smphost start=disabled
  2⤵
  PID:1180
- C:\Windows\system32\sc.exe
  sc config SNMPTrap start=disabled
  2⤵
  - Launches sc.exe
  PID:4464
- C:\Windows\system32\sc.exe
  sc config spectrum start=disabled
  2⤵
  PID:2184
- C:\Windows\system32\sc.exe
  sc config Spooler start=disabled
  2⤵
  - Launches sc.exe
  PID:4864
- C:\Windows\system32\sc.exe
  sc config SSDPSRV start=disabled
  2⤵
  PID:5152
- C:\Windows\system32\sc.exe
  sc config ssh-agent start=disabled
  2⤵
  PID:5656
- C:\Windows\system32\sc.exe
  sc config SstpSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3972
- C:\Windows\system32\sc.exe
  sc config stisvc start=disabled
  2⤵
  PID:5128
- C:\Windows\system32\sc.exe
  sc config StorSvc start=disabled
  2⤵
  PID:1976
- C:\Windows\system32\sc.exe
  sc config svsvc start=disabled
  2⤵
  PID:780
- C:\Windows\system32\sc.exe
  sc config SysMain start=disabled
  2⤵
  - Launches sc.exe
  PID:2004
- C:\Windows\system32\sc.exe
  sc config TapiSrv start=disabled
  2⤵
  PID:5988
- C:\Windows\system32\sc.exe
  sc config TermService start=disabled
  2⤵
  PID:3604
- C:\Windows\system32\sc.exe
  sc config Themes start=disabled
  2⤵
  PID:1184
- C:\Windows\system32\sc.exe
  sc config TieringEngineService start=disabled
  2⤵
  PID:2324
- C:\Windows\system32\sc.exe
  sc config TokenBroker start=disabled
  2⤵
  - Launches sc.exe
  PID:4652
- C:\Windows\system32\sc.exe
  sc config TrkWks start=disabled
  2⤵
  PID:5628
- C:\Windows\system32\sc.exe
  sc config TroubleshootingSvc start=disabled
  2⤵
  PID:3592
- C:\Windows\system32\sc.exe
  sc config tzautoupdate start=disabled
  2⤵
  PID:5720
- C:\Windows\system32\sc.exe
  sc config UevAgentService start=disabled
  2⤵
  PID:3800
- C:\Windows\system32\sc.exe
  sc config uhssvc start=disabled
  2⤵
  PID:808
- C:\Windows\system32\sc.exe
  sc config UmRdpService start=disabled
  2⤵
  - Launches sc.exe
  PID:4508
- C:\Windows\system32\sc.exe
  sc config UnistoreSvc start=disabled
  2⤵
  PID:4836
- C:\Windows\system32\sc.exe
  sc config upnphost start=disabled
  2⤵
  PID:5340
- C:\Windows\system32\sc.exe
  sc config UserDataSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:232
- C:\Windows\system32\sc.exe
  sc config VacSvc start=disabled
  2⤵
  PID:5308
- C:\Windows\system32\sc.exe
  sc config VaultSvc start=disabled
  2⤵
  PID:5896
- C:\Windows\system32\sc.exe
  sc config vds start=disabled
  2⤵
  PID:5068
- C:\Windows\system32\sc.exe
  sc config vmicguestinterface start=disabled
  2⤵
  - Launches sc.exe
  PID:5500
- C:\Windows\system32\sc.exe
  sc config vmicheartbeat start=disabled
  2⤵
  PID:1704
- C:\Windows\system32\sc.exe
  sc config vmickvpexchange start=disabled
  2⤵
  PID:4792
- C:\Windows\system32\sc.exe
  sc config vmicrdv start=disabled
  2⤵
  - Launches sc.exe
  PID:5256
- C:\Windows\system32\sc.exe
  sc config vmicshutdown start=disabled
  2⤵
  - Launches sc.exe
  PID:1244
- C:\Windows\system32\sc.exe
  sc config vmictimesync start=disabled
  2⤵
  PID:2028
- C:\Windows\system32\sc.exe
  sc config vmicvmsession start=disabled
  2⤵
  PID:4816
- C:\Windows\system32\sc.exe
  sc config vmicvss start=disabled
  2⤵
  PID:5428
- C:\Windows\system32\sc.exe
  sc config W32Time start=disabled
  2⤵
  - Launches sc.exe
  PID:5900
- C:\Windows\system32\sc.exe
  sc config WalletService start=disabled
  2⤵
  PID:6048
- C:\Windows\system32\sc.exe
  sc config WarpJITSvc start=disabled
  2⤵
  PID:5788
- C:\Windows\system32\sc.exe
  sc config wbengine start=disabled
  2⤵
  PID:5244
- C:\Windows\system32\sc.exe
  sc config WbioSrvc start=disabled
  2⤵
  PID:4008
- C:\Windows\system32\sc.exe
  sc config Wcmsvc start=disabled
  2⤵
  PID:4784
- C:\Windows\system32\sc.exe
  sc config wcncsvc start=disabled
  2⤵
  PID:1164
- C:\Windows\system32\sc.exe
  sc config WdiServiceHost start=disabled
  2⤵
  PID:1412
- C:\Windows\system32\sc.exe
  sc config WdiSystemHost start=disabled
  2⤵
  PID:4124
- C:\Windows\system32\sc.exe
  sc config WebClient start=disabled
  2⤵
  - Launches sc.exe
  PID:3152
- C:\Windows\system32\sc.exe
  sc config webthreatdefusersvc start=disabled
  2⤵
  PID:4528
- C:\Windows\system32\sc.exe
  sc config webthreatdefsvc start=disabled
  2⤵
  PID:1600
- C:\Windows\system32\sc.exe
  sc config Wecsvc start=disabled
  2⤵
  PID:3500
- C:\Windows\system32\sc.exe
  sc config WEPHOSTSVC start=disabled
  2⤵
  PID:1528
- C:\Windows\system32\sc.exe
  sc config wercplsupport start=disabled
  2⤵
  PID:2176
- C:\Windows\system32\sc.exe
  sc config WerSvc start=disabled
  2⤵
  PID:2524
- C:\Windows\system32\sc.exe
  sc config WFDSConMgrSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:3720
- C:\Windows\system32\sc.exe
  sc config whesvc start=disabled
  2⤵
  - Launches sc.exe
  PID:1132
- C:\Windows\system32\sc.exe
  sc config WiaRpc start=disabled
  2⤵
  - Launches sc.exe
  PID:4952
- C:\Windows\system32\sc.exe
  sc config WinRM start=disabled
  2⤵
  PID:5536
- C:\Windows\system32\sc.exe
  sc config wisvc start=disabled
  2⤵
  - Launches sc.exe
  PID:1608
- C:\Windows\system32\sc.exe
  sc config WlanSvc start=disabled
  2⤵
  PID:5488
- C:\Windows\system32\sc.exe
  sc config wlidsvc start=disabled
  2⤵
  PID:1884
- C:\Windows\system32\sc.exe
  sc config wlpasvc start=disabled
  2⤵
  PID:4028
- C:\Windows\system32\sc.exe
  sc config WManSvc start=disabled
  2⤵
  PID:5452
- C:\Windows\system32\sc.exe
  sc config wmiApSrv start=disabled
  2⤵
  - Launches sc.exe
  PID:2740
- C:\Windows\system32\sc.exe
  sc config WMPNetworkSvc start=disabled
  2⤵
  PID:3264
- C:\Windows\system32\sc.exe
  sc config workfolderssvc start=disabled
  2⤵
  PID:6092
- C:\Windows\system32\sc.exe
  sc config WpcMonSvc start=disabled
  2⤵
  PID:6096
- C:\Windows\system32\sc.exe
  sc config WPDBusEnum start=disabled
  2⤵
  PID:5028
- C:\Windows\system32\sc.exe
  sc config WpnUserService start=disabled
  2⤵
  PID:3068
- C:\Windows\system32\sc.exe
  sc config WpnService start=disabled
  2⤵
  - Launches sc.exe
  PID:2272
- C:\Windows\system32\sc.exe
  sc config wuqisvc start=disabled
  2⤵
  PID:4148
- C:\Windows\system32\sc.exe
  sc config WSAIFabricSvc start=disabled
  2⤵
  PID:1728
- C:\Windows\system32\sc.exe
  sc config WSearch start=disabled
  2⤵
  PID:5328
- C:\Windows\system32\sc.exe
  sc config WwanSvc start=disabled
  2⤵
  PID:2356
- C:\Windows\system32\sc.exe
  sc config XblAuthManager start=disabled
  2⤵
  - Launches sc.exe
  PID:5508
- C:\Windows\system32\sc.exe
  sc config XblGameSave start=disabled
  2⤵
  PID:1220
- C:\Windows\system32\sc.exe
  sc config XboxGipSvc start=disabled
  2⤵
  PID:4932
- C:\Windows\system32\sc.exe
  sc config XboxNetApiSvc start=disabled
  2⤵
  PID:4912
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\AppIDSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5780
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\BFE" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3320
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\ClipSVC" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4032
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\CredentialEnrollmentManagerUserSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3584
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\DeviceAssociationBrokerSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5020
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\DoSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1116
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\EntAppSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3804
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\embeddedmode" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4276
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\PrintWorkflowUserSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3324
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\SgrmBroker" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5096
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\WinHttpAutoProxySvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5016
- C:\Windows\system32\sc.exe
  sc config jhi_service start=disabled
  2⤵
  PID:988
- C:\Windows\system32\sc.exe
  sc config WMIRegistrationService start=disabled
  2⤵
  - Launches sc.exe
  PID:2096
- C:\Windows\system32\sc.exe
  sc config ipfsvc start=disabled
  2⤵
  PID:6060
- C:\Windows\system32\sc.exe
  sc config igccservice start=disabled
  2⤵
  PID:5280
- C:\Windows\system32\sc.exe
  sc config cplspcon start=disabled
  2⤵
  - Launches sc.exe
  PID:3412
- C:\Windows\system32\sc.exe
  sc config esifsvc start=disabled
  2⤵
  PID:5132
- C:\Windows\system32\sc.exe
  sc config LMS start=disabled
  2⤵
  PID:4628
- C:\Windows\system32\sc.exe
  sc config ibtsiva start=disabled
  2⤵
  - Launches sc.exe
  PID:5556
- C:\Windows\system32\sc.exe
  sc config cphs start=disabled
  2⤵
  - Launches sc.exe
  PID:1688
- C:\Windows\system32\sc.exe
  sc config DSAService start=disabled
  2⤵
  PID:2448
- C:\Windows\system32\sc.exe
  sc config DSAUpdateService start=disabled
  2⤵
  PID:4224
- C:\Windows\system32\sc.exe
  sc config RstMwService start=disabled
  2⤵
  PID:5640
- C:\Windows\system32\sc.exe
  sc config SystemUsageReportSvc_QUEENCREEK start=disabled
  2⤵
  - Launches sc.exe
  PID:2400
- C:\Windows\system32\sc.exe
  sc config iaStorAfsService start=disabled
  2⤵
  PID:5204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc query state= all | findstr /i "SERVICE_NAME" | findstr /i "igfxCUIService"
  2⤵
  - Executes a command shell one-liner
  PID:5600
- - C:\Windows\system32\sc.exe
    sc query state= all
    3⤵
    PID:2684
- - C:\Windows\system32\findstr.exe
    findstr /i "SERVICE_NAME"
    3⤵
    PID:5180
- - C:\Windows\system32\findstr.exe
    findstr /i "igfxCUIService"
    3⤵
    PID:544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc query state= all | findstr /i "SERVICE_NAME" | findstr /i "Intel"
  2⤵
  - Executes a command shell one-liner
  PID:4052
- - C:\Windows\system32\sc.exe
    sc query state= all
    3⤵
    - Launches sc.exe
    PID:5912
- - C:\Windows\system32\findstr.exe
    findstr /i "SERVICE_NAME"
    3⤵
    PID:2452
- - C:\Windows\system32\findstr.exe
    findstr /i "Intel"
    3⤵
    PID:5480
- C:\Windows\system32\reg.exe
  reg query "HKLM\System\CurrentControlSet\Services\AUEPLauncher"
  2⤵
  PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc query state= all | findstr /i "SERVICE_NAME" | findstr /i "AMD"
  2⤵
  - Executes a command shell one-liner
  PID:5392
- - C:\Windows\system32\sc.exe
    sc query state= all
    3⤵
    PID:2492
- - C:\Windows\system32\findstr.exe
    findstr /i "SERVICE_NAME"
    3⤵
    PID:5792
- - C:\Windows\system32\findstr.exe
    findstr /i "AMD"
    3⤵
    PID:3740
- C:\Windows\system32\sc.exe
  sc config NVDisplay.ContainerLocalSystem start=disabled
  2⤵
  PID:1152
- C:\Windows\system32\sc.exe
  sc config NvContainerLocalSystem start=disabled
  2⤵
  - Launches sc.exe
  PID:5460
- C:\Windows\system32\sc.exe
  sc config FvSVC start=disabled
  2⤵
  - Launches sc.exe
  PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc query state= all | findstr /i "SERVICE_NAME" | findstr /i "HP"
  2⤵
  - Executes a command shell one-liner
  PID:5024
- - C:\Windows\system32\sc.exe
    sc query state= all
    3⤵
    - Launches sc.exe
    PID:4324
- - C:\Windows\system32\findstr.exe
    findstr /i "SERVICE_NAME"
    3⤵
    PID:1888
- - C:\Windows\system32\findstr.exe
    findstr /i "HP"
    3⤵
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo shpamsvc "
  2⤵
  PID:4576
- C:\Windows\system32\findstr.exe
  findstr /i "hpatchmon shpamsvc"
  2⤵
  PID:2060
- C:\Windows\system32\sc.exe
  sc config RzActionSvc start=disabled
  2⤵
  PID:2528
- C:\Windows\system32\sc.exe
  sc config CortexLauncherService start=disabled
  2⤵
  PID:2504
- C:\Windows\system32\sc.exe
  sc config HapticService start=disabled
  2⤵
  PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc query state= all | findstr /i "SERVICE_NAME" | findstr /i "Razer"
  2⤵
  - Executes a command shell one-liner
  PID:4900
- - C:\Windows\system32\sc.exe
    sc query state= all
    3⤵
    PID:4432
- - C:\Windows\system32\findstr.exe
    findstr /i "SERVICE_NAME"
    3⤵
    PID:5356
- - C:\Windows\system32\findstr.exe
    findstr /i "Razer"
    3⤵
    PID:2952
- C:\Windows\system32\sc.exe
  sc config logi_lamparray_service start=disabled
  2⤵
  PID:5840
- C:\Windows\system32\sc.exe
  sc config LGHUBUpdaterService start=disabled
  2⤵
  PID:5116
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control" /v "SvcHostSplitThresholdInKB" /t REG_DWORD /d "4294967295" /f
  2⤵
  PID:1808
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:3212
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5360
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:692
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\1394ohci" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:6052
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\AcpiDev" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:444
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\acpipagr" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:576
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\AcpiPmi" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:656
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\acpitime" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4048
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\amdsata" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1000
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\amdsbs" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\amdxata" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:932
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\AppvVemgr" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:6100
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\arcsas" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1852
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\atapi" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\b06bdrv" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2544
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\bam" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2392
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\beep" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5984
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\bowser" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BthA2dp" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5416
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BthEnum" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4988
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BthHFEnum" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1652
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BthLEEnum" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2184
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BthMini" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4864
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BTHMODEM" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5996
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4372
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\BTHUSB" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:6016
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\bttflt" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4852
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\cdfs" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:780
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\cdrom" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\cht4tiscsi" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\cht4vbd" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1184
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\circlass" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2324
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\CSC" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4652
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\dam" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5628
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\ebdrv" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4192
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\fdc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3852
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\flpydisk" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4828
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\gencounter" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4508
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\HidBth" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:220
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\HidIr" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1796
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\hvcrash" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:348
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\hvservice" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4216
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\hyperkbd" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5068
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\HyperVideo" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5500
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\i8042prt" /v "Start" /t REG_DWORD /d "3" /f
  2⤵
  PID:1704
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\ItSas35i" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1832
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\MEIx64" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4176
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Microsoft_Bluetooth_AvrcpTransport" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4776
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\NdisCap" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4232
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\NdisVirtualBus" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5428
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Ndu" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:6032
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\rdpbus" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1084
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\RFCOMM" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5860
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\scfilter" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3704
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\sfloppy" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:440
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SgrmAgent" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1992
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\SpatialGraphFilter" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1412
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Synth3dVsc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4244
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\TsUsbFlt" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5044
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\TsUsbGD" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3624
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\tsusbhub" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1568
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\udfs" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:432
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\UevAgentDriver" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4744
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\umbus" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1848
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\usbcir" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5816
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\usbprint" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5220
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Vid" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3160
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\vmgid" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1460
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\vwifibus" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4952
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\vwififlt" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:5536
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\vwifimp" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:1608
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\WacomPen" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2900
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\wanarp" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\wanarpv6" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2656
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:2740
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\Roblox\Versions\version-*" /ad /b /o:-d 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Roblox\Versions\version-*" /ad /b /o:-d 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Discord\app-*" /ad /b /o:-d 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5868
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /f
  2⤵
  PID:3280
- C:\Windows\system32\reg.exe
  reg export "HKCU\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" "C:\Oneclick Backup\Priority\GraphicsPreferences.reg" /y
  2⤵
  PID:4148
- C:\Windows\system32\reg.exe
  reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" "C:\Oneclick Backup\Priority\Priority.reg" /y
  2⤵
  PID:5684
- C:\Windows\system32\reg.exe
  reg export "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" "C:\Oneclick Backup\Priority\FSO.reg" /y
  2⤵
  PID:1220
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\Program Files\VideoLAN\VLC\vlc.exe" /t REG_SZ /d "GpuPreference=1" /f
  2⤵
  PID:5388
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vlc.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "1" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:4252
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\DirectX\UserGpuPreferences" /v "C:\Program Files\Google\Chrome\Application\chrome.exe" /t REG_SZ /d "GpuPreference=1" /f
  2⤵
  PID:4032
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "1" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:2424
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Adobe Premiere Pro.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:1648
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VegasPro.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:4060
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Resolve.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:5264
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blender.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:3324
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shotcut.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:4504
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HandBrake.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:5504
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capcut.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:6064
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cinebench.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:6060
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\3DMark.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:5372
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LatMon.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:5636
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\y-cruncher.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:5572
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TM5.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:4644
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\linpack_xeon64.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:2448
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:4768
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinRAR.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:2400
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UnRAR.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:1056
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rar.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:5268
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7zFM.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:544
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7zG.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:2836
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7z.exe\PerfOptions" /v "CpuPriorityClass" /t REG_DWORD /d "3" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:4616
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:1484
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5004
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -NoProfile -ExecutionPolicy Bypass -Command Get-AppxPackage *Clipchamp.Clipchamp* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ApplicationCompatibilityEnhancements* | Remove-AppxPackage; Get-AppxPackage *Microsoft.AV1VideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.AVCEncoderVideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.BingNews* | Remove-AppxPackage; Get-AppxPackage *Microsoft.BingSearch* | Remove-AppxPackage; Get-AppxPackage *Microsoft.BingWeather* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Copilot* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Edge.GameAssist* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Family* | Remove-AppxPackage; Get-AppxPackage *Microsoft.GamingApp* | Remove-AppxPackage; Get-AppxPackage *Microsoft.GamingServices* | Remove-AppxPackage; Get-AppxPackage *Microsoft.GetHelp* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Getstarted* | Remove-AppxPackage; Get-AppxPackage *Microsoft.HEIFImageExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.HEVCVideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftEdge.Stable* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftOfficeHub* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftSolitaireCollection* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MicrosoftStickyNotes* | Remove-AppxPackage; Get-AppxPackage *Microsoft.MPEG2VideoExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.OneDriveSync* | Remove-AppxPackage; Get-AppxPackage *Microsoft.OutlookForWindows* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Paint* | Remove-AppxPackage; Get-AppxPackage *Microsoft.People* | Remove-AppxPackage; Get-AppxPackage *Microsoft.PowerAutomateDesktop* | Remove-AppxPackage; Get-AppxPackage *Microsoft.RawImageExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ScreenSketch* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Services.Store.Engagement* | Remove-AppxPackage; Get-AppxPackage *Microsoft.StartExperiencesApp* | Remove-AppxPackage; Get-AppxPackage *Microsoft.StorePurchaseApp* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Todos* | Remove-AppxPackage; Get-AppxPackage *Microsoft.VP9VideoExtensions* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WebMediaExtensions* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WebpImageExtension* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsAlarms* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsCalculator* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsCamera* | Remove-AppxPackage; Get-AppxPackage *microsoft.windowscommunicationsapps* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Windows.DevHome* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsFeedbackHub* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsMaps* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsNotepad* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Windows.Photos* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsSoundRecorder* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsStore* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WindowsTerminal* | Remove-AppxPackage; Get-AppxPackage *Microsoft.Xbox.TCUI* | Remove-AppxPackage; Get-AppxPackage *Microsoft.XboxGameOverlay* | Remove-AppxPackage; Get-AppxPackage *Microsoft.XboxGamingOverlay* | Remove-AppxPackage; Get-AppxPackage *Microsoft.XboxIdentityProvider* | Remove-AppxPackage; Get-AppxPackage *Microsoft.XboxSpeechToTextOverlay* | Remove-AppxPackage; Get-AppxPackage *Microsoft.YourPhone* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ZuneMusic* | Remove-AppxPackage; Get-AppxPackage *Microsoft.ZuneVideo* | Remove-AppxPackage; Get-AppxPackage *MicrosoftCorporationII.MicrosoftFamily* | Remove-AppxPackage; Get-AppxPackage *MicrosoftCorporationII.QuickAssist* | Remove-AppxPackage; Get-AppxPackage *MicrosoftWindows.CrossDevice* | Remove-AppxPackage; Get-AppxPackage *MicrosoftWindows.LKG.TwinSxS* | Remove-AppxPackage; Get-AppxPackage *Microsoft.WidgetsPlatformRuntime* | Remove-AppxPackage; Get-AppxPackage *MSTeams* | Remove-AppxPackage; Get-AppxPackage *MicrosoftWindows.Client.WebExperience* | Remove-AppxPackage
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2984
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:2656
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3264
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
    3⤵
    PID:5668
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B" /t REG_BINARY /d 0300000000000000 /f
  2⤵
  PID:3068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2432
- - C:\Windows\system32\reg.exe
    reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
    3⤵
    PID:1728
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "_phxji" /t REG_BINARY /d 0300000000000000 /f
  2⤵
  PID:1720
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:1156
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1392
- C:\Oneclick Tools\Edge Remover\setup.exe
  "C:\Oneclick Tools\Edge Remover\setup.exe" --uninstall --system-level --force-uninstall
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Installs/modifies Browser Helper Object
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- - C:\Oneclick Tools\Edge Remover\setup.exe
    "C:\Oneclick Tools\Edge Remover\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Oneclick Tools\Edge Remover\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff6dd96eb10,0x7ff6dd96eb20,0x7ff6dd96eb30
    3⤵
    - Executes dropped EXE
    PID:784
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4932" "1708" "1712" "1560" "0" "0" "0" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:2972
- C:\Windows\system32\taskkill.exe
  taskkill /f /im MicrosoftEdgeUpdate.exe
  2⤵
  - Kills process with taskkill
  PID:5264
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe /fi "IMAGENAME eq msedge.exe"
  2⤵
  - Kills process with taskkill
  PID:1916
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" /f
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" /f
  2⤵
  PID:3412
- C:\Windows\system32\takeown.exe
  takeown /f "C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe" /r /d y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3420
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe" /grant Administrators:F /t
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" | findstr /I "MicrosoftEdge" | findstr /V "HKEY_"
  2⤵
  - Executes a command shell one-liner
  PID:1932
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
    3⤵
    PID:5640
- - C:\Windows\system32\findstr.exe
    findstr /I "MicrosoftEdge"
    3⤵
    PID:4020
- - C:\Windows\system32\findstr.exe
    findstr /V "HKEY_"
    3⤵
    PID:6120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc query state= all | findstr /i "SERVICE_NAME" | findstr /i "Edge"
  2⤵
  - Executes a command shell one-liner
  PID:4860
- - C:\Windows\system32\sc.exe
    sc query state= all
    3⤵
    PID:3596
- - C:\Windows\system32\findstr.exe
    findstr /i "SERVICE_NAME"
    3⤵
    PID:3364
- - C:\Windows\system32\findstr.exe
    findstr /i "Edge"
    3⤵
    PID:2816
- C:\Windows\system32\net.exe
  net stop "edgeupdate"
  2⤵
  PID:2452
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "edgeupdate"
    3⤵
    PID:4908
- C:\Windows\system32\sc.exe
  sc config "edgeupdate" start=disabled
  2⤵
  PID:5492
- C:\Windows\system32\sc.exe
  sc delete "edgeupdate"
  2⤵
  PID:1380
- C:\Windows\system32\net.exe
  net stop "edgeupdatem"
  2⤵
  PID:1572
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "edgeupdatem"
    3⤵
    PID:3492
- C:\Windows\system32\sc.exe
  sc config "edgeupdatem" start=disabled
  2⤵
  - Launches sc.exe
  PID:2588
- C:\Windows\system32\sc.exe
  sc delete "edgeupdatem"
  2⤵
  - Launches sc.exe
  PID:1888
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:4976
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:560
- C:\Windows\system32\taskkill.exe
  taskkill.exe /F /IM "explorer.exe"
  2⤵
  - Kills process with taskkill
  PID:5116
- C:\Windows\system32\taskkill.exe
  taskkill.exe /F /IM "OneDrive.exe"
  2⤵
  - Kills process with taskkill
  PID:3212
- C:\Windows\system32\reg.exe
  reg add "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d "0" /f
  2⤵
  - Modifies registry class
  PID:496
- C:\Windows\system32\reg.exe
  reg add "HKCR\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d "0" /f
  2⤵
  PID:5592
- C:\Windows\system32\reg.exe
  reg load "hku\Default" "C:\Users\Default\NTUSER.DAT"
  2⤵
  PID:4948
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\Default\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveSetup" /f
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  reg unload "hku\Default"
  2⤵
  PID:3660
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3628
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:6100
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3324
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5604
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1916
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:3412
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4336
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\smartscreen.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4908
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\smartscreen.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1384
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1752
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5396
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:4324
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2992
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Control\FeatureManagement\Overrides\8\1387020943" /v "EnabledStateOptions" /t REG_DWORD /d "0" /f
  2⤵
  PID:4212
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Control\FeatureManagement\Overrides\8\1387020943" /v "EnabledState" /t REG_DWORD /d "1" /f
  2⤵
  PID:4980
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Control\FeatureManagement\Overrides\8\1387020943" /v "Variant" /t REG_DWORD /d "0" /f
  2⤵
  PID:3300
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Control\FeatureManagement\Overrides\8\1387020943" /v "VariantPayload" /t REG_DWORD /d "0" /f
  2⤵
  PID:4144
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\ControlSet001\Control\FeatureManagement\Overrides\8\1387020943" /v "VariantPayloadKind" /t REG_DWORD /d "0" /f
  2⤵
  PID:4936
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\mobsync.exe"
  2⤵
  - Possible privilege escalation attempt
  PID:3512
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\mobsync.exe" /grant administrators:F
  2⤵
  - Modifies file permissions
  PID:2772
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:4432
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4220
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\GameBarPresenceWriter.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3296
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\GameBarPresenceWriter.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5084
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\GameBarPresenceWriter.proxy.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3916
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\GameBarPresenceWriter.proxy.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2776
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\GameChatOverlayExt.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4348
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\GameChatOverlayExt.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3640
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\GameChatTranscription.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1808
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\GameChatTranscription.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4076
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\GamePanel.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4444
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\GamePanel.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3760
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\GamePanelExternalHook.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3484
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\GamePanelExternalHook.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2952
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\gamestreamingext.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1236
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\gamestreamingext.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2284
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\GameSystemToastIcon.contrast-white.png"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3820
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\GameSystemToastIcon.contrast-white.png" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3908
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\GameSystemToastIcon.png"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4544
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\GameSystemToastIcon.png" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4552
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\gameux.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4872
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\gameux.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4888
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\gamingtcui.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3496
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\gamingtcui.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5720
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\XblAuthManager.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1084
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\XblAuthManager.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5788
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\XblAuthManagerProxy.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:432
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\XblAuthManagerProxy.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  PID:960
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\XblAuthTokenBrokerExt.dll"
  2⤵
  - Modifies file permissions
  PID:1264
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\XblAuthTokenBrokerExt.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2404
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\XblGameSave.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5028
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\XblGameSave.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5868
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\XblGameSaveExt.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3812
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\XblGameSaveExt.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:6020
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\XblGameSaveProxy.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3740
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\XblGameSaveProxy.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5488
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\XblGameSaveTask.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3252
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\XblGameSaveTask.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2944
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\XboxNetApiSvc.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5508
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\XboxNetApiSvc.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1060
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\Windows.Gaming.Preview.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4744
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\Windows.Gaming.Preview.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4912
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\Windows.Gaming.UI.GameBar.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1564
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\Windows.Gaming.UI.GameBar.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5108
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\Windows.Gaming.XboxLive.Storage.dll"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4500
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\Windows.Gaming.XboxLive.Storage.dll" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2792
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:1916
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4840
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:6124
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5204
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:4020
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:6120
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft EdgeWebView" /f
  2⤵
  PID:4016
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\UdkUserSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:2948
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5448
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3412
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5492
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4908
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3204
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:852
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\taskhostw.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5572
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\taskhostw.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4652
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:4528
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1888
- C:\Windows\system32\curl.exe
  curl -s -L "https://github.com/Open-Shell/Open-Shell-Menu/releases/download/v4.4.196/OpenShellSetup_4_4_196.exe" -o "C:\Oneclick Tools\OpenShell\OpenShellSetup_4_4_196.exe"
  2⤵
  - Downloads MZ/PE file
  PID:3532
- C:\Windows\system32\curl.exe
  curl -s -L "https://github.com/QuakedK/Oneclick/raw/refs/heads/main/Downloads/V8.0/OpenShellTheme.xml" -o "C:\Oneclick Tools\OpenShell\OpenShellTheme.xml"
  2⤵
  PID:4980
- C:\Oneclick Tools\OpenShell\OpenShellSetup_4_4_196.exe
  "C:\Oneclick Tools\OpenShell\OpenShellSetup_4_4_196.exe" /qn ADDLOCAL=StartMenu
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5712
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe /i "C:\ProgramData\OpenShellSetup64_4_4_196.msi" /qn ADDLOCAL=StartMenu
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2772
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:3528
- C:\Program Files\Open-Shell\StartMenu.exe
  "C:\Program Files\Open-Shell\StartMenu.exe" -xml "C:\Oneclick Tools\OpenShell\OpenShellTheme.xml"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3496
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3812
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5792
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1608
- C:\Windows\system32\curl.exe
  curl -s -L "https://github.com/QuakedK/Oneclick/raw/refs/heads/main/Downloads/V8.0/nvcplui.exe" -o "C:\Oneclick Tools\Nvidia\Nvidia Control Panel\nvcplui.exe"
  2⤵
  PID:5452
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer\Shell\Nvidia Control Panel" /v HasLUAShield /t REG_SZ /d "" /f
  2⤵
  PID:4140
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer\Shell\Nvidia Control Panel" /v MUIVerb /t REG_SZ /d "Nvidia Control Panel" /f
  2⤵
  PID:1172
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer\Shell\Nvidia Control Panel\command" /ve /t REG_SZ /d "C:\Oneclick Tools\Nvidia\Nvidia Control Panel\nvcplui.exe" /f
  2⤵
  PID:1416
- C:\Windows\system32\reg.exe
  reg add "HKCR\Directory\Background\shellex\ContextMenuHandlers\NvCplDesktopContext" /ve /t REG_SZ /d "{}" /f
  2⤵
  PID:932
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:6100
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4032
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:1192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "ProviderName" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4744
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000" /v "ProviderName"
    3⤵
    PID:576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0001" /v "ProviderName" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1628
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0001" /v "ProviderName"
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0002" /v "ProviderName" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5264
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0002" /v "ProviderName"
    3⤵
    PID:5676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0003" /v "ProviderName" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5604
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0003" /v "ProviderName"
    3⤵
    PID:6060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0004" /v "ProviderName" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5132
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0004" /v "ProviderName"
    3⤵
    PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0005" /v "ProviderName" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5636
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0005" /v "ProviderName"
    3⤵
    PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0006" /v "ProviderName" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5384
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0006" /v "ProviderName"
    3⤵
    PID:4152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0007" /v "ProviderName" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:560
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0007" /v "ProviderName"
    3⤵
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0008" /v "ProviderName" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5824
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0008" /v "ProviderName"
    3⤵
    PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0009" /v "ProviderName" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4156
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0009" /v "ProviderName"
    3⤵
    PID:5244
- C:\Windows\system32\reg.exe
  reg export "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" "C:\Oneclick Backup\GPU\Nvidia.reg" /y
  2⤵
  PID:2980
- C:\Oneclick Tools\Nvidia\Nvidia Profile Inspector\nvidiaProfileInspector.exe
  "C:\Oneclick Tools\Nvidia\Nvidia Profile Inspector\nvidiaProfileInspector.exe" -SilentImport "C:\Oneclick Tools\Nvidia\Nvidia Profile Inspector\QuakedV2.nip"
  2⤵
  PID:5252
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer" /v Icon /t REG_SZ /d "C:\Oneclick Tools\Nvidia\Nvidia Profile Inspector\nvidiaProfileInspector.exe,0" /f
  2⤵
  PID:5448
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer" /v MUIVerb /t REG_SZ /d "Nvidia Container" /f
  2⤵
  PID:3412
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer" /v Position /t REG_SZ /d "Bottom" /f
  2⤵
  PID:5912
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer" /v SubCommands /t REG_SZ /d "" /f
  2⤵
  PID:1484
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer\Shell\EnableNvContainer" /v HasLUAShield /t REG_SZ /d "" /f
  2⤵
  PID:5004
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer\Shell\EnableNvContainer" /v MUIVerb /t REG_SZ /d "Enable Container" /f
  2⤵
  PID:5460
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer\Shell\EnableNvContainer\command" /ve /t REG_SZ /d "C:\Oneclick Tools\Nvidia\Nvidia Container\Nvidia Container ON.bat" /f
  2⤵
  PID:5696
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer\Shell\DisableNvContainer" /v HasLUAShield /t REG_SZ /d "" /f
  2⤵
  PID:852
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer\Shell\DisableNvContainer" /v MUIVerb /t REG_SZ /d "Disable Container" /f
  2⤵
  PID:6072
- C:\Windows\system32\reg.exe
  reg add "HKCR\DesktopBackground\Shell\NvidiaContainer\Shell\DisableNvContainer\command" /ve /t REG_SZ /d "C:\Oneclick Tools\Nvidia\Nvidia Container\Nvidia Container OFF.bat" /f
  2⤵
  PID:4224
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\NVIDIA Corporation\Global\GFExperience" /v "NotifyNewDisplayUpdates" /t REG_DWORD /d "0" /f
  2⤵
  PID:5556
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\NVTweak" /v "NvDevToolsVisible" /t REG_DWORD /d "1" /f
  2⤵
  PID:5160
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\NVIDIA Corporation\NvTray" /v "StartOnLogin" /t REG_DWORD /d "0" /f
  2⤵
  PID:1376
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\NVTweak" /v "HideXGpuTrayIcon" /t REG_DWORD /d "1" /f
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\NVIDIA Corporation\Global\CoProcManager" /v "ShowTrayIcon" /t REG_DWORD /d "0" /f
  2⤵
  PID:1888
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\NVTweak" /v "DisplayPowerSaving" /t REG_DWORD /d "0" /f
  2⤵
  PID:5228
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\NVIDIA Corporation\Global\NVTweak" /v "DisplayPowerSaving" /t REG_DWORD /d "0" /f
  2⤵
  PID:4124
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "EnableRuntimePowerManagement" /t REG_DWORD /d "0" /f
  2⤵
  PID:2928
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmProfilingAdminOnly" /t REG_DWORD /d "0" /f
  2⤵
  PID:3012
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\NVTweak" /v "RmProfilingAdminOnly" /t REG_DWORD /d "0" /f
  2⤵
  PID:3256
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\NVIDIA Corporation\Global\NGXCore" /v "ShowDlssIndicator" /t REG_DWORD /d "0" /f
  2⤵
  PID:5188
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "EnableHDAudioD3Cold" /t REG_DWORD /d "0" /f
  2⤵
  PID:4144
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmDisableHwFaultBuffer" /t REG_DWORD /d "1" /f
  2⤵
  PID:5184
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMDisablePerIntrDPCQueueing" /t REG_DWORD /d "1" /f
  2⤵
  PID:1228
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMElcg" /t REG_DWORD /d "1431655765" /f
  2⤵
  PID:4432
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMBlcg" /t REG_DWORD /d "286331153" /f
  2⤵
  PID:4260
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMElpg" /t REG_DWORD /d "4095" /f
  2⤵
  PID:2144
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMSlcg" /t REG_DWORD /d "262131" /f
  2⤵
  PID:5084
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMFspg" /t REG_DWORD /d "15" /f
  2⤵
  PID:4716
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMGC6Feature" /t REG_DWORD /d "699050" /f
  2⤵
  PID:2248
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMGC6Parameters" /t REG_DWORD /d "85" /f
  2⤵
  PID:2776
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMDidleFeatureGC5" /t REG_DWORD /d "44731050" /f
  2⤵
  PID:1208
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMHotPlugSupportDisable" /t REG_DWORD /d "1" /f
  2⤵
  PID:4108
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmFbsrPagedDMA" /t REG_DWORD /d "1" /f
  2⤵
  PID:4748
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMDisablePostL2Compression" /t REG_DWORD /d "1" /f
  2⤵
  PID:5796
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmRcWatchdog" /t REG_DWORD /d "0" /f
  2⤵
  PID:2888
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmLogonRC" /t REG_DWORD /d "0" /f
  2⤵
  PID:5592
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMIntrDetailedLogs" /t REG_DWORD /d "0" /f
  2⤵
  PID:4076
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMCtxswLog" /t REG_DWORD /d "0" /f
  2⤵
  PID:2388
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMNvLog" /t REG_DWORD /d "0" /f
  2⤵
  PID:4680
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMSuppressGPIOIntrErrLog" /t REG_DWORD /d "0" /f
  2⤵
  PID:3468
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Parameters" /v "LogDisableMasks" /t REG_BINARY /d "00ffff0f01ffff0f02ffff0f03ffff0f04ffff0f05ffff0f06ffff0f07ffff0f08ffff0f09ffff0f0affff0f0bffff0f0cffff0f0dffff0f0effff0f0fffff0f10ffff0f11ffff0f12ffff0f13ffff0f14ffff0f15ffff0f16ffff0f00ffff1f01ffff1f02ffff1f03ffff1f04ffff1f05ffff1f06ffff1f07ffff1f08ffff1f09ffff1f0affff1f0bffff1f0cffff1f0dffff1f0effff1f0fffff1f00ffff2f01ffff2f02ffff2f03ffff2f04ffff2f05ffff2f06ffff2f07ffff2f08ffff2f09ffff2f0affff2f0bffff2f0cffff2f0dffff2f0effff2f0fffff2f00ffff3f01ffff3f02ffff3f03ffff3f04ffff3f05ffff3f06ffff3f07ffff3f" /f
  2⤵
  PID:3620
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\services\nvlddmkm\Parameters" /v "LogWarningEntries" /t REG_DWORD /d "0" /f
  2⤵
  PID:3692
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\services\nvlddmkm\Parameters" /v "LogPagingEntries" /t REG_DWORD /d "0" /f
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\services\nvlddmkm\Parameters" /v "LogEventEntries" /t REG_DWORD /d "0" /f
  2⤵
  PID:3880
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\services\nvlddmkm\Parameters" /v "LogErrorEntries" /t REG_DWORD /d "0" /f
  2⤵
  PID:2284
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMUsbcDebugMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:4328
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMDisableFeatureDisablement" /t REG_DWORD /d "0" /f
  2⤵
  PID:6024
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmBreakonRC" /t REG_DWORD /d "0" /f
  2⤵
  PID:5860
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMDebugSetSMCMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:3260
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMDisableLRCCoalescing" /t REG_DWORD /d "1" /f
  2⤵
  PID:4100
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmEnableI2CNanny" /t REG_DWORD /d "0" /f
  2⤵
  PID:8
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMPcieLtrOverride" /t REG_DWORD /d "1" /f
  2⤵
  PID:4540
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMPcieLtrL12ThresholdOverride" /t REG_DWORD /d "0" /f
  2⤵
  PID:4552
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMDeepL1EntryLatencyUsec" /t REG_DWORD /d "1" /f
  2⤵
  PID:4544
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmDisablePreosapps" /t REG_DWORD /d "1" /f
  2⤵
  PID:3936
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmPerfLimitsOverride" /t REG_DWORD /d "21" /f
  2⤵
  PID:3904
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMGCOffFeature" /t REG_DWORD /d "2" /f
  2⤵
  PID:5116
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmOverrideSupportChipsetAspm" /t REG_DWORD /d "1" /f
  2⤵
  PID:5656
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMEnableASPMDT" /t REG_DWORD /d "1" /f
  2⤵
  PID:4120
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMDisableGpuASPMFlags" /t REG_DWORD /d "3" /f
  2⤵
  PID:344
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMEnableASPMAtLoad" /t REG_DWORD /d "0" /f
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMEnableEventTracer" /t REG_DWORD /d "0" /f
  2⤵
  PID:3432
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "SkipSwStateErrChecks" /t REG_DWORD /d "1" /f
  2⤵
  PID:3512
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMAERRForceDisable" /t REG_DWORD /d "1" /f
  2⤵
  PID:1828
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RM580312" /t REG_DWORD /d "1" /f
  2⤵
  PID:1768
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmWar1760398" /t REG_DWORD /d "1" /f
  2⤵
  PID:5348
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMLpwrArch" /t REG_DWORD /d "349525" /f
  2⤵
  PID:2440
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmLpwrGrPgSwFilterFunction" /t REG_DWORD /d "0" /f
  2⤵
  PID:6048
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmLpwrCtrlMsDifrSwAsrParameters" /t REG_DWORD /d "5461" /f
  2⤵
  PID:792
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmLpwrCacheStatsOnD3" /t REG_DWORD /d "0" /f
  2⤵
  PID:5272
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmPgCtrlParameters" /t REG_DWORD /d "1431655765" /f
  2⤵
  PID:3652
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmDwbMscg" /t REG_DWORD /d "1" /f
  2⤵
  PID:3108
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmDisableInforomBBX" /t REG_DWORD /d "15" /f
  2⤵
  PID:3568
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "PreferSystemMemoryContiguous" /t REG_DWORD /d "1" /f
  2⤵
  PID:6084
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "PreferSystemMemoryContiguous" /t REG_DWORD /d "1" /f
  2⤵
  PID:1560
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmSec2EnableApm" /t REG_DWORD /d "0" /f
  2⤵
  PID:2272
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmOverrideIdleSlowdownSettings" /t REG_DWORD /d "0" /f
  2⤵
  PID:3040
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMClkSlowDown" /t REG_DWORD /d "71303168" /f
  2⤵
  PID:3232
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RM2644249" /t REG_DWORD /d "1" /f
  2⤵
  PID:4984
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmDisableACPI" /t REG_DWORD /d "1023" /f
  2⤵
  PID:5848
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMNativePcieL1WarFlags" /t REG_DWORD /d "16" /f
  2⤵
  PID:4788
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMResetPerfMonD4" /t REG_DWORD /d "0" /f
  2⤵
  PID:1152
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmFbsrWDDMMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:400
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmFbsrFileMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:2384
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "PerfLevelSrc" /t REG_DWORD /d "8738" /f
  2⤵
  PID:4672
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMElpgStateOnInit" /t REG_DWORD /d "3" /f
  2⤵
  PID:1884
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmMIONoPowerOff" /t REG_DWORD /d "1" /f
  2⤵
  PID:1608
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMDisableOptimalPowerForPadlinkPll" /t REG_DWORD /d "1" /f
  2⤵
  PID:3368
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmClkPowerOffDramPllWhenUnused" /t REG_DWORD /d "0" /f
  2⤵
  PID:3252
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMOPSB" /t REG_DWORD /d "10914" /f
  2⤵
  PID:5328
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "DisableDynamicPstate" /t REG_DWORD /d "1" /f
  2⤵
  PID:3068
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "DisableAsyncPstates" /t REG_DWORD /d "1" /f
  2⤵
  PID:5664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "SlideMCLK" /t REG_DWORD /d "0" /f
  2⤵
  PID:932
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMNvlinkUPHYInitControl" /t REG_DWORD /d "16" /f
  2⤵
  PID:5724
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmGpsGenoa" /t REG_DWORD /d "0" /f
  2⤵
  PID:5220
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Nvidia Corporation\NvControlPanel2\Client" /v "OptInOrOutPreference" /t REG_DWORD /d "0" /f
  2⤵
  PID:6088
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\nvlddmkm\Global\Startup" /v "SendTelemetryData" /t REG_DWORD /d "0" /f
  2⤵
  PID:5532
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\NVIDIA Corporation\Global\FTS" /v EnableRID44231 /t REG_DWORD /d "0" /f
  2⤵
  PID:4912
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\NVIDIA Corporation\Global\FTS" /v EnableRID64640 /t REG_DWORD /d "0" /f
  2⤵
  PID:4924
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\NVIDIA Corporation\Global\FTS" /v EnableRID66610 /t REG_DWORD /d "0" /f
  2⤵
  PID:1564
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmDisableRegistryCaching" /t REG_DWORD /d "15" /f
  2⤵
  PID:988
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "D3PCLatency" /t REG_DWORD /d "1" /f
  2⤵
  PID:5676
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "EnableMsHybrid" /t REG_DWORD /d "0" /f
  2⤵
  PID:6060
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMDisableIntrIllegalCompstatAccess" /t REG_DWORD /d "1" /f
  2⤵
  PID:1916
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "SetPanelRefreshRate" /t REG_DWORD /d "0" /f
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMDisableNoncontigAlloc" /t REG_DWORD /d "1" /f
  2⤵
  PID:6124
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RMHdcpKeyglobZero" /t REG_DWORD /d "1" /f
  2⤵
  PID:4840
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\" /v "RmDisableHdcp22" /t REG_DWORD /d "1" /f
  2⤵
  PID:4976
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "NvBackend" /f
  2⤵
  PID:1068
- C:\Windows\system32\takeown.exe
  Takeown /F "C:\Windows\System32\drivers\NVIDIA Corporation" /R /D Y
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2908
- C:\Windows\system32\icacls.exe
  Icacls "C:\Windows\System32\drivers\NVIDIA Corporation" /grant "Admin":F /T
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:992
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:4068
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4092
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:5092
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5244
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue useplatformclock
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4020
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3080
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2948
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:5540
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2832
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "AllowHibernate" /t REG_DWORD /d "0" /f
  2⤵
  PID:4336
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "EnergySaverState" /t REG_DWORD /d "0" /f
  2⤵
  PID:1384
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "EventProcessorEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3764
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2684
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HiberbootEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:1752
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "HibernateEnabledDefault" /t REG_DWORD /d "0" /f
  2⤵
  PID:2588
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v "TimerCoalescing" /t REG_BINARY /d "0000000000000000000000000000000000000000000000000000000000000000" /f
  2⤵
  PID:4420
- C:\Windows\system32\powercfg.exe
  powercfg /hibernate off
  2⤵
  - Power Settings
  PID:5880
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "PlatformAoAcOverride" /t REG_DWORD /d "0" /f
  2⤵
  PID:1708
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "PlatformRoleOverride" /t REG_DWORD /d "0" /f
  2⤵
  PID:5992
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power" /v "MSDisabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:4812
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -Command "Get-WmiObject MSPowerDeviceEnable -Namespace root\wmi | ForEach-Object { $_.Enable = $false; $_.psbase.Put() }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5672
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3296
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:3572
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5840
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "DynamicHeteroCpuPolicyMask" /t REG_DWORD /d "3" /f
  2⤵
  PID:4940
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "DefaultDynamicHeteroCpuPolicy" /t REG_DWORD /d "3" /f
  2⤵
  PID:3676
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "DynamicHeteroCpuPolicyImportant" /t REG_DWORD /d "1" /f
  2⤵
  PID:4416
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "DynamicHeteroCpuPolicyImportantShort" /t REG_DWORD /d "1" /f
  2⤵
  PID:3452
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "DynamicHeteroCpuPolicyImportantPriority" /t REG_DWORD /d "8" /f
  2⤵
  PID:5464
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "SerializeTimerExpiration" /t REG_DWORD /d "2" /f
  2⤵
  PID:1684
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "EnablePerCpuClockTickScheduling" /t REG_DWORD /d "2" /f
  2⤵
  PID:496
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel" /v "TimerCheckFlags" /t REG_DWORD /d "0" /f
  2⤵
  PID:2244
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:4040
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2496

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:4272

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.BingNews_8wekyb3d8bbwe
1⤵
PID:2852

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}
1⤵
PID:6052

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.BingWeather_8wekyb3d8bbwe
1⤵
PID:3248

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Edge.GameAssist_8wekyb3d8bbwe
1⤵
PID:4464

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.GamingApp_8wekyb3d8bbwe
1⤵
PID:4856

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.GetHelp_8wekyb3d8bbwe
1⤵
PID:4708

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.HEIFImageExtension_8wekyb3d8bbwe
1⤵
PID:4488

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe
1⤵
PID:1744

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe
1⤵
PID:5476

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe
1⤵
PID:3800

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe
1⤵
PID:4836

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.OneDriveSync_8wekyb3d8bbwe
1⤵
PID:232

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.People_8wekyb3d8bbwe
1⤵
PID:3376

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.PowerAutomateDesktop_8wekyb3d8bbwe
1⤵
PID:4176

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.StorePurchaseApp_8wekyb3d8bbwe
1⤵
PID:4232

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Todos_8wekyb3d8bbwe
1⤵
PID:6032

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VP9VideoExtensions_8wekyb3d8bbwe
1⤵
PID:5860

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WebMediaExtensions_8wekyb3d8bbwe
1⤵
PID:1664

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WebpImageExtension_8wekyb3d8bbwe
1⤵
PID:3152

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsCalculator_8wekyb3d8bbwe
1⤵
PID:3624

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.UI.Xaml.2.4_8wekyb3d8bbwe
1⤵
PID:432

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe
1⤵
PID:1848

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe
1⤵
- System Time Discovery
PID:5816

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe
1⤵
PID:2428

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.WindowsMaps_8wekyb3d8bbwe
1⤵
PID:5488

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5772

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1052

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Family: Matrix Ransomware
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3596
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A12596B086DF6B4D6938A637C1C8C4B9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2304
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\StartMenuHelper32.dll"
  2⤵
  - Loads dropped DLL
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3816
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Windows\system32\StartMenuHelper64.dll"
  2⤵
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Modifies registry class
  PID:3892
- C:\Program Files\Open-Shell\StartMenu.exe
  "C:\Program Files\Open-Shell\StartMenu.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4944

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Remote Services

T1021

SMB/Windows Admin Shares

T1021.002

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e59f41d.rbs

Path C:\Config.Msi\e59f41d.rbs
Size 18KB
SHA256 228353163ca22bb14b00e9012d308ab735884c8f90c98c6388cb6fe8a8a16d7e
MD5 ae3ab3fb6ca56123f6ed551fc43df467
SHA1 7a95f576a65e9e62df6cb5c79546f5f88756b493
SHA512 6adde88956cdf34a53c3adf3b63cd8d958095d5f4072da17204b33ceb510e606d876d091ad70859c08283997818467cca2933b25586e1f59b69908d966ac6807
SSDEEP 384:brNzyo83FLiojHtjFubHrcATvbCrlHQLPzHijITHRrrWMV71sGqioGAZYZYn1MQA:bxzyo83FLiojHtjFubHrcATvbeBQLPzl
TLSH
T1CF8250815702C3C3DC972770CB5B1B11B7B6DBE6D311865F868C81B08F4AB869FA96C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FSO.reg

Path C:\Oneclick Backup\Priority\FSO.reg
Size 264B
SHA256 41ca96b5736681f5669e9e61a05cfd1a167dec9178e34aab3c30f78556b7d04f
MD5 d546be2f17b29fa61ba33815b88cab7d
SHA1 164f6139c7238eb0ff34c221048ec7bdb603133a
SHA512 0db698adf814cb98aad23f4196b767a44a1cab4baadfeec192c551f2439c28d86dd60eff3387d3f12018f0ae93f5edfa927d2073e95e20657557e3604b0cf5f2
TLSH
T1C5D05E1227F41109F7F36EC00AF5B9689B37E8A40C25D09C0284810E45F0A60D430777
MD5 SHA1 SHA512 TLSH

Submit Download

GraphicsPreferences.reg

Path C:\Oneclick Backup\Priority\GraphicsPreferences.reg
Size 348B
SHA256 0b60adb951beaa469cd91104e7329e70396e6a9676e861c60a34ebbdd02f066f
MD5 12e4e21127ad970e50ef6b435c968123
SHA1 950aa9001dcfc5b4eb39edfbc9f6c146ead7c1d0
SHA512 877032651c5f69d5c351f11e88dd98631b23d8ccb759026977d9d716bd721844eaff3b84afd54342c22b8f8dbee31999b89fb62122eb95104dbf872c604ca338
TLSH
T172E0865223E04009F1F62E589EFDB4E99E167C445D1DD48E00985A0F01F0E14C521BF7
MD5 SHA1 SHA512 TLSH

Submit Download

Priority.reg

Path C:\Oneclick Backup\Priority\Priority.reg
Size 18KB
SHA256 0220f76f46dc16d0565f4e242616b385245cfba6c2c6b5fc4bbed4458aece5a3
MD5 5ddab879c5bb02f3b28488e250ff8c30
SHA1 1f04769918a5f87dd053a63acdb9b2ae0cb97234
SHA512 cc2f9baed6484c3dd3785a70cbd0fadd3e57496414d4b3040aed8ff4ae41404470d38fde4729718d7d547cad39205726c695878734ee495364d0527935022f8b
SSDEEP 96:Ax83G83EpPBqrSJnSwAH8dR+8+OmV9vfgoP7PchCzVomtFA3rwWL383p83hxZoPI:M8W8z8q8H858Z1
TLSH
T1BA826201ABF91509F7F37F85DEFE99175B37BD98882EC06C2190470D01A2AA1D861B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Services.reg

Path C:\Oneclick Backup\Services\Services.reg
Size 4.5MB
SHA256 000613c7ad4ad0744d26c768bce21c4b6ef35f493308958af6e52e392fe31766
MD5 2b349a401fc57ec13d002ef0153e1d6e
SHA1 b94f636548a262a9a25da25f1683b09379f8634e
SHA512 9e6fc1876ce5e9041609e22fdf8c9d94594202dcbc3219e23e9398044ae8324fca3d00cc0520cff871a5c74d9455c81bca2bd96317ea30d83949fb0366c63c51
SSDEEP 6144:JfQtB64JmJEjkTkOgRNzZXLhkRV59RgTiRS+kSSM:6jhkRKC
TLSH
T17A26D336DBF92515A3738E65DFF79463EA663813352DC88D00C2274D08A2B45A8B277F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xbox Bloat Log.txt

Path C:\Oneclick Logs\Extra\Xbox Bloat Log.txt
Size 4KB
SHA256 a5e2b65fde16629ade70695acf10aec556ee32d45438fff6cb6287740d3a3492
MD5 7a1f7eda82c958ab2e68ac7e35501de9
SHA1 db52e7ed447350bf42ffea6f4fac077a0750ae08
SHA512 4b282616b5a736d981118a6ac3f715063f111b6c82ec86ac9c015a551a666ff08a5c7086111b43bfb46ccfb25c18a7b68d567c954daff26044e329104726f8c2
SSDEEP 24:YPXtDS7XtDOXtFsU7XtF9XoMuR7XoMMXoLf7XoLjXO27XOzDqX7g8m397X7g8myT:9r9X8ykx0LD9dTqasJM
TLSH
T19691B4B64ED253D0C4F92D42B80F5DDFA08E5866C21919337597D7C4EA02A0F1EE269B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oneclick Log.txt

Path C:\Oneclick Logs\Oneclick Log.txt
Size 4KB
SHA256 4a0a91aa892415e44f2c21b3829e2f360b1559a6b23b3473924988d30802b4f2
MD5 37b3d1c513de4015c16501df7e3a63ef
SHA1 03bdb11f7f38c12ca9ce07e96cc9e36b54a88bb2
SHA512 df9ede6686349884398aba37fa249a538c2e7e04a683d5234a7710d4974ddd28b6dc4169a7c2dc84d2060fc36b1e15bc1cf1f331df0839109ef821d39791a52b
SSDEEP 96:uQeGcMnPgjI14AIXItnPYEdMx5nUbySpteBhqKc:uQeGcMnPgjI14AIXItnEjUb5Pf
TLSH
T1929147766AD313D281A275626507C9EFB3890AE3C9B5141BF6DDC384FB0496B32C72D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oneclick Tools.zip

Path C:\Oneclick Tools.zip
Size 3.3MB
SHA256 429ad05a592fd17481f8a89f56c5a09cab009fcf17dc126b73825622a39a8749
MD5 d52a470e76bc2a5bc4d67dc9412a0a22
SHA1 bc3201d0d41aa47941d5dece666880149b19a6dd
SHA512 57ba6c70923852d2a27db9649b02bfc28d1d0c708b6e170d2d51f74e8501f8bd176b121b0c94172eddff83af9442cd36ce1f349af119a15c06679452cf75f8b5
SSDEEP 98304:dT1NsECz7ri5NajufXM0FZezzwV//Hr2E9:ZLo/2sufc6VV//X9
TLSH
T193F53340DF2D999CFB8BD27E8158D9148DA40B3B8771A43FE225C39A3C2564F4ED6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Oneclick Tools\Edge Remover\setup.exe
Size 3.6MB
SHA256 4963532e63884a66ecee0386475ee423ae7f7af8a6c6d160cf1237d085adf05e
MD5 593b7497327222d69048f7f6204b1886
SHA1 56ee397b91b5235ad5fb3259e35676c633b46022
SHA512 45999be23e1ae2229575e6f32e56b57a732f51f015b2edb31653837a5592d6ed0edb29783eb21a18a42585ea5c0a50a8a996732233a2202f66eb1242d2a56fc1
SSDEEP 49152:n23IetlomzqbeWsLf83Won5L3s9x1OxGBcq2exk74gcAFu4OuDmGRmR/1HLiTs7V:pbm71OxRR9Sl1xB
TLSH
T13F064B03A2F541D8F0BAD6789B359B32D977BC855B38A1DF029056191E36FE09F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSudoLG.exe

Path C:\Oneclick Tools\NSudo\NSudoLG.exe
Size 174KB
SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
MD5 423129ddb24fb923f35b2dd5787b13dd
SHA1 575e57080f33fa87a8d37953e973d20f5ad80cfd
SHA512 d3f904c944281e9be9788acea9cd31f563c5a764e927bcda7bae6bedcc6ae550c0809e49fd2cf00d9e143281d08522a4f484acc8d90b37111e2c737e91ae21ce
SSDEEP 3072:XVLC09ymR7sITY17jR7h05cDnxngU9yInRU+Wi+StbaoJLQfo8BuA6N3ls:XT9yO7sITYNmYnbyInRU+Wi+StbaoJLR
TLSH
T1CA046C0BB3A9C5ACD0B692B866825502F375741A132097CF3791437EEF36BD0AE36712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvidiaProfileInspector.exe

Path C:\Oneclick Tools\Nvidia\Nvidia Profile Inspector\nvidiaProfileInspector.exe
Size 622KB
SHA256 3787c83b51ec7795931e1a02978db20984a1e007d65f13dafcf166e5e7642409
MD5 5125ca7bd7b5e1f3c07f85a7a00f5997
SHA1 8653cc0fde08beae42bdce2a352d8f8fa64c06bd
SHA512 e371a2fc01c602e099e952a84c8c0eb60e59d510fd8ed53938d78d38b38e53a9bcd9ad5d3a4a626591243f6a37a7268a483d428719b7ba3ac97f16872706f572
SSDEEP 6144:5bE9RmU8UrDZleWDUo579SVhrTYyFcTUh50U8Ku50:5bi8UPn4o50VhwfzUv/
TLSH
T133D49C4D35ECA99AEB0804F2F13F25299A6FEA560A85532DB97C26737153DC821C0D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OOSU10.exe

Path C:\Oneclick Tools\OOshutup10\OOSU10.exe
Size 2.0MB
SHA256 6ff124adbd65b5c74edcc5a60b386919542ca2a83bc4fcf95db1274af7963c6e
MD5 ae5d8c9dfacd114a70b250341cc5e3c9
SHA1 93fea4816fad20993c254341957f7ae612c3d0d7
SHA512 ec4efbe17df3a0ef881361d01f3112d6a2f42bf702fd9f6f3c587397bf3e31bde787939f2b546753f77c64150b7a0f3959cad636de025f43b4ea2fec8f5ae3ff
SSDEEP 49152:SE6GsEyW+92SJEJTJxJROfOrh3rukxanVyBWkC4Ui8TLsO6XERRjmNE:JykxWsW9RMERRai
TLSH
T1EAA54B6213EC115CF1F71B76EA399641BD7ABDFE7E12E21E0065240D21B2B44CA7A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuakedOOshutup10 V2.cfg

Path C:\Oneclick Tools\OOshutup10\QuakedOOshutup10 V2.cfg
Size 20KB
SHA256 418cbecd9cbaf731b53ef7ae8706ad742924655ae1b5524956e764ec1be7883f
MD5 5d522e80b020c3634cc50e7087a62c7f
SHA1 1d7f20e4b9302eb679a1a90465306975dcb63170
SHA512 7741bfd977b0ee56b48e8aa385c3f6e62a2db899d822dbba0ad5ef5c16da920a827ece1f892d8c86dd906420fb5354c57382fb0db826a8cf83b752135345776c
SSDEEP 384:ustVUV3y8atdHh3dcMQdgwBrCpsa31J1vby/Ue8aGE:bmV3y8atdHhNcMQawBrCpscN5e8aN
TLSH
T1FE927BBD822C28A56B13D2578EF5DD2C3F9220A6BDAF5DB10419E94C613F4C4921FCA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenShellSetup_4_4_196.exe

Path C:\Oneclick Tools\OpenShell\OpenShellSetup_4_4_196.exe
Size 9.4MB
SHA256 5a8c5afac76973dd0c26b423ede8453813a01953c28f46b640549f7f2e9ae443
MD5 08d295f1ea71228278e11b532f070f72
SHA1 244e1c49111cf00b8779874d770f14b69f264923
SHA512 0898ad7209c48f510819ee2873151bbfe9848badca6e384cd0d0c4fb1d657cd233216ac707465a2db9b83daebe134f2fb589e75e09fe98e86eb11ec5c1cd7ed1
SSDEEP 196608:AFavDAl3g8tus/Axe6nmyiGDJKMQP2Wl/C0aVUlsEmd8yUrf9W4m:AFGAl1tus/AVnTic4tX/VB1NV
TLSH
T10BA62310E4B1D920E0248E30D8E618F7440B5E31FD08A967756FFEA77BBB1F6558782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenShellTheme.xml

Path C:\Oneclick Tools\OpenShell\OpenShellTheme.xml
Size 1KB
SHA256 0746b463c94a10b4008361e1fb57f647296d4b51b91fb893665829a7135bf244
MD5 eb7ea67ba6153d37282b8558780c0ca6
SHA1 352f11a44041e29f673153c93ac61097e8862080
SHA512 53bc748ab9da90825bc255617fc3586252ee7a2e219e51909a2b927c6da9393d4b162bb31909a86ef344a44cc685f26eb5c8b5844efa885ebb6f2221ebdef8e9
TLSH
T16F21D268B9C8FF390356CC8BA6F74E440A5F48CF6E3412EDC81831372267D21B675162
MD5 SHA1 SHA512 TLSH

Submit Download

basebrd.dll

Path C:\Oneclick Tools\Winver Logo\basebrd.dll
Size 109KB
SHA256 f393d0e378ddf0e57b0d19af028d78c005e404734a5e49355664a7a0cbe7b26f
MD5 7b0c4f5e23eb46dde912f24894d904ce
SHA1 5106139a7f1373233ed1c670f13dde81aa130c1f
SHA512 0579819c737c190230ecd5344fd369b7fe3bd22da052b48319ecead0b640c8b7050ca5f84a44067072b0677cc710b400c72ab8c83e87482a0e8f81a6f44a1d1c
SSDEEP 1536:8prFZwnwXQg9CYFhXvTlxdHVVaXrB2hIPJXfPmG1aT//MMwRWaSo5DX5LFPmSEpy:YrvzXMOd1VaXCYPPhqMpSYDpLFeSXD
TLSH
T126B3E0E282E40641F5B7A7B519E3A2528E35FDDA0D70C09E6660E18C1D36B44EF307BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Start Menu Settings.lnk

Path C:\Program Files\Open-Shell\Start Menu Settings.lnk
Size 1KB
SHA256 1c4eef4bb15caeb09e3fb67aeeeaa758acee5d135228d250ad829667da4d38fa
MD5 436927834963f2f95f4188820ba319fc
SHA1 3cc72761b2a314ef1921a872cd421330ee51eb77
SHA512 42bdb63188bcbd5b466f7d549cbd58231430c85ec70262fa1bcba3a52dc1b816e908702301f9e40babd65c5cf3fe3d51a4745b839fa70a037fe28d0b5b82a664
TLSH
T15C11AF100FCA1A5AD1B787322E3647119BA5FC02992B8E2F5A89C18D487070199ACF7B
MD5 SHA1 SHA512 TLSH

Submit Download

Start Screen.lnk

Path C:\Program Files\Open-Shell\Start Screen.lnk
Size 1KB
SHA256 8c1ee991a8a7647b971f63082c8bcbf47c96fc04dc5ce12de0cec16236e93116
MD5 16416cde8dd7e2db22afda65641ded1a
SHA1 9963b0d2a6764a13f3da3c5fc69a2c59c561cc08
SHA512 26826773894fbc164a81aa4263e5c7b29590a302661c7f424f8ca030b5e56f1fbbe3c82267b429a0892fe911e81e3a6ea9628001a79add2fa33b6c1d1a07ca0e
TLSH
T1BA41BB201FD9062AE2B343F77E334711DAA0FC11A116CE7F5A85C18D0671605A9EDF2B
MD5 SHA1 SHA512 TLSH

Submit Download

Start Screen.lnk

Path C:\Program Files\Open-Shell\Start Screen.lnk
Size 1KB
SHA256 9af3477200288afc3ecb009001b9fae845a9070971b02e0039f1938c3e07ab03
MD5 ed7234035bbf0909d842b83bf02ecb27
SHA1 9ebd6c1195aaeb04fa6919caa1ddb66dd4f2af8e
SHA512 df159d6bf44544a7a2f5a4d8cd7456a0fa2f0cbff7c1f51e1c1c64d6b53ea510f6e0527118bc54ff0dfeed54281f4d3d07b204e13b589635949db2885e162fbd
TLSH
T1C3419A201FD5066AE2B383F76E734720EAA0FC11A1078E7F5A8581890271606A5EDF2B
MD5 SHA1 SHA512 TLSH

Submit Download

StartMenu.exe

Path C:\Program Files\Open-Shell\StartMenu.exe
Size 261KB
SHA256 011a3cdcc5cb9b7d3804cb62cf03cb2827cfca53f29664d7c15eb8e2ba65081f
MD5 259cf2397889471df57c07fbb9b5c72f
SHA1 6970356d079d933f7e6f57b6b203ad69cae3bf06
SHA512 44d8adafb87e80c0b86248b8832450d1ab9e66f3a6523a10e2a62fb7edd43c00d8efd4e20f8b9dad6f6104c23ee835202f9908fd620234724be5c23388a239c0
SSDEEP 3072:S4NToNXPtfdTmZJLsSSIegmmcD+HmkQ96Dpv7TqSCJDL5j/2bx47J6VJ3AVVC:S4xULmZ9TSIYxSk9LdobwVQ
TLSH
T17D449E46B6E400F9F56781358A621602F3777C260B60DBDF03A4577AAF236D1AD3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenuDLL.dll

Path C:\Program Files\Open-Shell\StartMenuDLL.dll
Size 2.6MB
SHA256 f632c9a1662ea5ebe4be997fa9b7b326d0f6a1a5f95c17d73aa1f1c619082c9c
MD5 556eea6c896807cdb8d7510304e138de
SHA1 60c657f72db17428b6485a6e82d43f846981f2b5
SHA512 f502051d2ef25cdeddfcbf8af7b13f1129cd6b41cec5e39dd26986cba5244aa2c69bcf9bb368ece089465495b1a588610ee6dd97d2425d637811fe4208c7425e
SSDEEP 49152:daWpI37NNY1VrtbFA5u1/Ig06vsd9j85QPBuv0rz2u204gwj5:d9I3PY1Pbnpauv0/xA
TLSH
T1B4D59E0632F900A8E0FA9275DE7651EFDA727C525F30C6DF1190B99D1F33A928A39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenuHelperL10N.ini

Path C:\Program Files\Open-Shell\StartMenuHelperL10N.ini
Size 11KB
SHA256 53cafbc10e671b2885775dc7d7b66e93156a4fb661aee95e03c2dd74ea99fa84
MD5 29221f620ea6b5893add15dd6c307684
SHA1 97c31bb9585a0896e1fcea8efa3f05ff16823da2
SHA512 b4c98f1352d7f8c60eb785b1849673bfa880242fe3daceb2bf9e69ec7ddd6c707df905c7b18b2888d87ba47a36f967761c8ff69d8082ebbf5dbf3a21aba55f42
SSDEEP 96:rWmJ2nrYW2Rmvnr7mx4Dnrsjmq7nrmbhmPk7nr/dmtynrUdmQTnr0BmkAnrw1cm0:LxW2h4VZo0wnLxZm/f70/hulAzTvd
TLSH
T1194294132FDD8210F6F36B80AE7145641B1BBD599A3ACE4D1380AC2E09F5C4895E9FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenuL10N.ini

Path C:\Program Files\Open-Shell\StartMenuL10N.ini
Size 288KB
SHA256 571ee9fe4d0c035cf0cd27a0b99ce251afd67e89bd0bf1280d907890d406a060
MD5 0503d87b03c8174a68d9aee97039a308
SHA1 0465e4170582fb352e29ed67d2775de9ac0ef4eb
SHA512 e6d3c85dc5b57c6ee0aacfe857fb997723059de17f5945340639602ef8d408386621274b51485b4aa1cf886a2a0939b1a22a457ac5d7b0b4eca3ec12b2713ffe
SSDEEP 6144:MlMJnsOE426513ghopr7natxnNfg1AdU719k2uS4tIR6:MlMJnsOE4223gho8HnNG19k2um4
TLSH
T1D454E6FA619F39DA48D27202C3CB3A5C2D7A64797713A0C4246DF70C69A1D9DC0F9E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~tart Menu Settings.tmp

Path C:\Program Files\Open-Shell\~tart Menu Settings.tmp
Size 1KB
SHA256 bac4cc62459dcec4760a13bf5bd1f4ba028b5d0627c21b81cc7b0fb66981748c
MD5 9e6d51d9954b6a8ac1089cc938f8882e
SHA1 f85f999b6bb127938be82b124c7c9330c5cce867
SHA512 37503851632fb8cd3e9a24601f5149e573d35acd74ea87e4c0ef3a027d454a8e53c53122cb61d6bec0a07cdd323c1001163b25ea7b5083154ff3d69a2b8e6ef8
TLSH
T1D6217D104FCE1B5AD1B797322E3647129BA1FC03E92BCE2F5A49918C487064199ACF7B
MD5 SHA1 SHA512 TLSH

Submit Download

~tart Screen.tmp

Path C:\Program Files\Open-Shell\~tart Screen.tmp
Size 2KB
SHA256 37d41c5858fe1c82a768d666834cc863a96ee654695d6789db5ae5027ec8dfdf
MD5 f9c62ee1111cc974a6429b21ed27ae41
SHA1 bc27c3509b6db3a38eac28e0ce1d60e53d247e68
SHA512 e13211219299781d2058ed35e90333f6b43edb861df111878ec745bcce40c15b20b21f3c058758111347613046c53c0e3d945e25b2cface897ceea95e62159e3
TLSH
T136419C201FD5062AE2B343B77E734711DAA1FC11A116CE7F5A4581890671605A9DDF2A
MD5 SHA1 SHA512 TLSH

Submit Download

~tart Screen.tmp

Path C:\Program Files\Open-Shell\~tart Screen.tmp
Size 2KB
SHA256 a22f4f3b20e5faf4237b05a9da7cb0dbc291f6e186b480a78007360125c769c0
MD5 222d92c635c95de7eecfcfdd3c6d01cc
SHA1 ae871b7e5c3c395c57e20079f63c4213481cc377
SHA512 c721d3ca792951ef302ec066edbccab9f29c137fb1e619df89485f3d65b5d9dfad389b9b4e069e58fd540792a16f6a4cfdc8ff441a6a207ffd655b9d5de5464b
TLSH
T1FE4199201FD9062AE2B343B77E734721DAA1FC11A11ACE7F5A85818D0671605A9EDF2A
MD5 SHA1 SHA512 TLSH

Submit Download

Open-Shell Help.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Help.lnk
Size 1KB
SHA256 ce84bdf3af5b415af0e7c5d52e1da9f52f5171498015ad6df04a3530448808ae
MD5 bd3edcf917c370b00d0c9e3b6d6d5808
SHA1 770ce6ae1cd0a5ff3096ab9be816894ea5c9ced2
SHA512 87320f7ad4932d6816743b681d28a3bea63a727b368e89559376fc440888fdf1789f24d29a8d7c7e5ef5b4e411b3cdb7a0e36dd46dec24d7dd503081897e6778
TLSH
T16011EF1017EE2B1AD25382373D320A21DBB6FC01EA678F2F5AD490850470201A6CDF7B
MD5 SHA1 SHA512 TLSH

Submit Download

Open-Shell Menu Settings.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Menu Settings.lnk
Size 1KB
SHA256 c33907d75289ef33ba849adf175bca37599b4bf0fa92ac4b14fc097d80b0ebda
MD5 f9926c0c7f24c12d0034cb4e55d7b7a0
SHA1 5d76f0df0d50cb2db00194a4700565e7637e2a71
SHA512 72b93661d2125fdb1418ec81ea293d33d63ca63b8d8a4e550d3b2f18e7312a5151e48c9ce6190e7691b46e347ec139bb10db9c7e174cbe72f80653b189d4f6c2
TLSH
T198217D141BCA2B1AD2B387322D3247219BB6FC02E9778F2F558981CD0470601999DF7B
MD5 SHA1 SHA512 TLSH

Submit Download

Open-Shell Readme.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\Open-Shell Readme.lnk
Size 1KB
SHA256 c41b840d81887ceaf04825afdbce188c14e75498243ac1626929fb637935040d
MD5 8aeae813865e20c4229f165ed16d6c2f
SHA1 06b6ee4a914613155a56c5511bff315ab6aae5b3
SHA512 b22e15b5d867bb4107531b198b86f833eaae7c9e969764326d8cb2cacafdbaaa62cc232ee45169f59805c95a91e4fdd4cc5861c4e8315dc46ddfe737e367d7e8
TLSH
T1F511C01417DA2B19D56342363D361E30EBB9FC02E7B74F6F168480DA0870604D299F7B
MD5 SHA1 SHA512 TLSH

Submit Download

~pen-Shell Menu Settings.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open-Shell\~pen-Shell Menu Settings.tmp
Size 1KB
SHA256 27d03fef1a76e672e1594ad60cdb3081e10e05d6e20f584bb11988d29916e484
MD5 5e4ad39855f76ab6e2842c8bf094ce63
SHA1 0fcd462fc84f5a3b32f7d60457cf5caf7953ec5d
SHA512 c14d60dac03ba46cf16aa03c1453c361a6e586ee4ce04f8dd995c08ea9f444505e7170f768bc8d263dc221031e26bafe73ebcfe19033cc8afbc22b9a83771c17
TLSH
T1A6215C101BCA1B5AE2B357322D32472257B6BC02E977CF2F554991CC0874601999DF7B
MD5 SHA1 SHA512 TLSH

Submit Download

OpenShellSetup64_4_4_196.msi

Path C:\ProgramData\OpenShellSetup64_4_4_196.msi
Size 5.5MB
SHA256 433d65acfa978ee12a6d0013b3298414dcf0953d0f2c09e0ed526e4a74b7c95c
MD5 6210ed5f51998ec78457734121bb652b
SHA1 180118fa551b43f26e431e7522e40ff34863357c
SHA512 d91b35845c358eb385c5e49ac347d578f07ecead594f4035906586b424af33742d495e0cc20e3ce74b60ebc4f1fc4e43040f2743657bfc9ad14ae705a8851137
SSDEEP 98304:SiJl4EhGy2A0xq3pLr72z9uaqkSi1uUMLjPycjkAjm4qp7tHpwsjEr0pKdBElvsJ:S0ldhGykxqZL25skSiiLj3jkAjuNpCsU
TLSH
T1B946231278E1407AE9B60A314565C671AE3EAE705B50CA6B33CD3C5F3F312C15BB36A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 4672b83e99a529fa94a87cd0b606c76bb88df0d87edfb05954a66303e0e49014
MD5 656aad331aac1c1e5fb11d0596b0ebf5
SHA1 b1e7bfb0df49c0bb4fbbe70a583fb9188f3d1d8e
SHA512 9e13eba713c7bed9afdf82eef65e376d1b96c472f19364772641e29ad5624d51c38d04e83662058913963cc3a2bbc25a5599a9401c2951a6edbaa750c62c1823
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMFYoeOV3CNBQkj2zMrxf:KflJd+qiUTYkzvHgfKQaUpeE711kDa5E
TLSH
T1C5538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c0db9d1e25c16ac1562af9c9af70372f3d66af4ad23bac83967c327bb3f61d44
MD5 f27bd397fae4f4adfc151b305c196079
SHA1 c42d95148d59ddeaa522ecb475f8340dbad3a91b
SHA512 5e11b9e4822f45dbb7cd32054136aa3231f9b6f3ee43197516a08aba79675a833f10a7aab5896362e67ce398a667de6c2c3637b7124498efcab397900e43b55c
TLSH
T175216533B3ECC125C8D9117A208CAD00B2B5C3C7449E8F8B6A84C619957F9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e1fd2ff48710365d8a1bc3008ad4e84ee50bf9d4b20f97f843511ec9a4abaab4
MD5 b552bbfd98610bca3d0a6880cbde2166
SHA1 c360198c5f2a566b530a542be786a46489fb1951
SHA512 b66aefd36409d43d42edad8f55654ae17305e67e8007011bd961a21649d73e2dff724d439b11bceea56c5f6289f88bbe380d69be33b59cb40eaf6b94794363a2
TLSH
T1EE217867B79CC162C899013A5889AE0072B5C3DB049E8ECB6BC4CD18E57F58AEB546A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 92d5a76ed593d1450f8f5309d806ef2ec37be8839f1e0e20763e75180345feac
MD5 a766b59cb8764029e0daa42ff2d21c3f
SHA1 9ca2e4735a93ab8ddf2d8e6928f1c570aa4ff80b
SHA512 e92fe19a450bc93cfcbaed70586d580470d239cd41997e0bdebdb45f1b6ba02604b4e839ab6ee40d5112ba683c647ecd10751183ab2f89226994e17680c52eae
TLSH
T1DA117A33B79CC135C8D9157A108DAD01B2B5C3CB049EDE8B7A84C509E57F58ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VQCF1QP\microsoftwindows.client[1].xml
Size 328B
SHA256 37e278aa6ce3f3e110c7ea69e4273c25df96a72446ef810709370453e07ca6b8
MD5 542377b1d4945aed6833bdc8ac510ce8
SHA1 77c5bd5695ce00e53d47268cc0bf75c23fc63765
SHA512 2f82cd216008a5b5c241daa04ad4f42e0b511d0253d2b1cfef1e695fa15466c9fa93323a1fbbbd423d2e4869e842f467beaa015670e3e7da79df7859fe18fd11
TLSH
T1F6E0D8102A4C9C2C1A05957C1D1D60E036BD0087570A607934B5BCC5E8C6A86C01A9F4
MD5 SHA1 SHA512 TLSH

Submit Download

AppCache134377635489472713.txt.~tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134377635489472713.txt.~tmp
Size 68KB
SHA256 3bdec40a32e3d77f72ecfa2b454c335328f76ff90ed593636e1eb0acee990748
MD5 a6541deb2232b9f8c29e769a2bf6435a
SHA1 642d218eb70aae1ade1db8e3cd470eedc09b99db
SHA512 c5cd53d9c3ea2e1be3d570fc80998f62ff107799131d3b443d730802866ec513729ad43776a89c6b65fb9cc496e955a4c89c1f0f5aef17166f01042cf03afa95
SSDEEP 384:99HMhTfi+WAgeFztUFJb8XRyOQtmMp2dRN5Tkvql2G2EbPsu690l+HPI0Y6bvpW6:nTvyKJ5D
TLSH
T1CC63DBA53280CBF6327962A578DDF525F12D22B1E0A88F41A5FB9116FD5ADCC22313D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~earchUnifiedTileModelCache.tmp

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchUnifiedTileModelCache.tmp
Size 18KB
SHA256 7cd3e812d74be3fbb129fa5c5ec2d62ffe759aa097c3b187ca93245e1e152cd7
MD5 5ee3e0439319ba733b59ef54c47588e5
SHA1 aff99df6a7b06c68c75111c96b0b5fc3d8211b94
SHA512 6977619c127e4cc5e32358937f6bac09c15273fcfc97fd4275ea802924b787cd20cd622ac6afc7d0c263faaf6b1216963d1d3a6490aee031136ddbb9f1c4bedf
SSDEEP 384:PLkpSPPWpi9JE2sP0JLpwlMBefQOVjeQ8RJoT:MS28LE2sPALWl8RJs
TLSH
T150821B742AF51761F3B18B708BF5AAAA6836B861AD00DB9D016243490937D53C971F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES96AD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES96AD.tmp
Size 1KB
SHA256 14b33d07774cacd6963db4b3fcaa02563866fffcc6224ba3eadb83ac68c070e1
MD5 81731a226bd989bb49bd78f4b5e5f9ee
SHA1 cd2e1045363117de4565edf4880c328be43391e9
SHA512 9b96e15f51aa51dd437c56011613fd4d7b9aa9dc9f0954b1944d224f3b79370db6695cabb11efc76a8bf29d87679ed23d33c0b30f2d567abcae412b22c3fab57
TLSH
T16F21EB0593E90B1EF0730732BDFA172FA638FCA4EF61539B884052282C51604FEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nmtvij3n.d1z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nmtvij3n.d1z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

eugxplps.dll

Path C:\Users\Admin\AppData\Local\Temp\eugxplps\eugxplps.dll
Size 3KB
SHA256 14941998eadd8a9b67912e6f2bcea8d118dbabdea7eee8eeecf86b58aca17fff
MD5 8c3cfb708b3df3d5678c97bb793b0418
SHA1 399925defd09ea7a6097913f254ac76b516e3fd3
SHA512 6c7c91e2034822d0a32facf8322a9cb64b63fe643749ffb498d1ec813dbbf1f9c434d04e4a8d9b45d4ab6083d39d042fe943abb78d487bf79ddaee71929afbed
TLSH
T1D051CC1AA7E8466BE4770B306DF343662778F8109FB2935D18C44268AC616685E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

MSIF497.tmp

Path C:\Windows\Installer\MSIF497.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenuHelper32.dll

Path C:\Windows\SysWOW64\StartMenuHelper32.dll
Size 354KB
SHA256 779c13a11234785b7718a6f5cfb463bfdce76b215beb2aac04d55bb42bd633c5
MD5 239da49e3f282c54dd05c3c8c9fa324c
SHA1 70b52fafacec2cd69f29794f013a03514b132d86
SHA512 b17d1c5fcf4795dd83a574d5d0eb355f5afdbeb72bfd1dad34baca59f9dae3f711e57213ee10506ef2e1505275a2b54e1b16088062e98b4ac0bbdc2bfcc9882d
SSDEEP 6144:Ih4QGK+dtIOMZx0KKK3CIsw4NAmsCd12/Jr9y5ur:INq3LKKKy29U1L0
TLSH
T13E746C10B682C0B1D49D01307D2ADBEA5A7DB9314FE185DBB3D41B7E9D312C26B35A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenuHelper64.dll

Path C:\Windows\System32\StartMenuHelper64.dll
Size 428KB
SHA256 8eff3aa5106c801d61874a25234b8af4c3f272fbf1de9817ee77f688731cc045
MD5 f7f8aa1e8141cfa966a18adcef157a3e
SHA1 589c0082958e1c0f5e5228974facb0de478cbcad
SHA512 597657af822713ab1edb6e6cace1cc488e2e641e6618c2081787185e774acce76e45adc2e70a3b12643db83e6455eb36b0fac9dcdb60a7ac337f94c31b573c77
SSDEEP 6144:rw64bToqMxoIHNoiq71hwSZrpgjlZowbrvSuobFCVR9OKnrykI:rwFbooP1h7OZoQroh3
TLSH
T123947C16FAA800A5D06B9135CD778606E7727C890B608BDF33A4476E2F33FE15A3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC89E653D8727249638154B1F6694F950.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\eugxplps\CSC89E653D8727249638154B1F6694F950.TMP
Size 652B
SHA256 7f4fd6ee8dacbc7f9ab365e5ff9875fdcb37d50a29bc507bb910da99c79ed520
MD5 db5b0fffc58d67cf5fae2fd8428ce6e1
SHA1 0a1f70266cbf4ab8bc20e59fd1bafab81bbdc2d6
SHA512 e55ea189e00438042fa3df8afef1d4b82c921f8252bab5891e95443dd35130dfe099c4d00e0b090da38c6d0ba9f3e15da5232e8ec6f55f5987a4a0b27554d7a0
TLSH
T1EBF03A0973F8020EF4F34B30BDF6836395ADBC65DE3293ED284053592864510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

eugxplps.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\eugxplps\eugxplps.0.cs
Size 254B
SHA256 0cea0a4b5842f375994d72c8cadc03abec938d30b1df96200a0cfdd920df835c
MD5 6fb30522105e0dc241a5ec0477c6decf
SHA1 ed5b567e7a8605dbef8747b551dc86ec713a92b2
SHA512 25655663941097bea2a72383090b75404439cf0372b908e2e84f61a052bf5d82fc2e4a3b24e9bfede014cc7e685b2d73b3dcd22473550062c7d8a02a0b913722
TLSH
T1CED05B1837A39A648047441A5C52A0B46736816A76DF6A05B9E54110CFCB4141673A19
MD5 SHA1 SHA512 TLSH

Submit Download

eugxplps.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\eugxplps\eugxplps.cmdline
Size 369B
SHA256 c9e430ddee212eecb66fec2d6e5b06bae0577d087bf06a89523c9e07bd1817ad
MD5 7c22d9300703371abf850c05cf5c8683
SHA1 ac0b55c27048b24c9896e50ff19a5ad240b3bd45
SHA512 99683ec919b80c51dba40e0efdff5b99063c2c898dcbb606f72b5ff2348f031319f1a50b655d571227d1ac615dcc06a5530ce1176a426d636378f1b4873eabb9
TLSH
T1A1E06F3A5246C2BE2AE9100B2A7AE4EC8272079BB9803F889047842DE0774003BD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1052-528-0x00007FF794730000-0x00007FF794826000-memory.dmp

Download

memory/3596-670-0x00000140367C0000-0x0000014037282000-memory.dmp

Download

memory/4272-253-0x00000221390C0000-0x00000221390C1000-memory.dmp

Download

memory/4272-221-0x0000022139220000-0x0000022139221000-memory.dmp

Download

memory/4272-251-0x0000022138FB0000-0x0000022138FB1000-memory.dmp

Download

memory/4272-252-0x0000022138FB0000-0x0000022138FB1000-memory.dmp

Download

memory/4272-225-0x0000022139240000-0x0000022139241000-memory.dmp

Download

memory/4272-205-0x0000022128C40000-0x0000022128C50000-memory.dmp

Download

memory/4272-238-0x0000022138E60000-0x0000022138E61000-memory.dmp

Download

memory/4272-189-0x0000022128B40000-0x0000022128B50000-memory.dmp

Download

memory/4272-232-0x0000022138E70000-0x0000022138E71000-memory.dmp

Download

memory/4272-222-0x0000022139240000-0x0000022139241000-memory.dmp

Download

memory/4272-249-0x0000022138FA0000-0x0000022138FA1000-memory.dmp

Download

memory/4272-231-0x0000022139240000-0x0000022139241000-memory.dmp

Download

memory/4272-233-0x0000022138E60000-0x0000022138E61000-memory.dmp

Download

memory/4272-223-0x0000022139240000-0x0000022139241000-memory.dmp

Download

memory/4272-241-0x0000022138DA0000-0x0000022138DA1000-memory.dmp

Download

memory/4272-230-0x0000022139240000-0x0000022139241000-memory.dmp

Download

memory/4272-229-0x0000022139240000-0x0000022139241000-memory.dmp

Download

memory/4272-235-0x0000022138E70000-0x0000022138E71000-memory.dmp

Download

memory/4272-228-0x0000022139240000-0x0000022139241000-memory.dmp

Download

memory/4272-227-0x0000022139240000-0x0000022139241000-memory.dmp

Download

memory/4272-226-0x0000022139240000-0x0000022139241000-memory.dmp

Download

memory/4272-224-0x0000022139240000-0x0000022139241000-memory.dmp

Download

memory/4308-185-0x000002E42E6C0000-0x000002E42E773000-memory.dmp

Download

memory/4308-187-0x000002E42E6A0000-0x000002E42E6AA000-memory.dmp

Download

memory/4308-186-0x000002E42E8F0000-0x000002E42E90C000-memory.dmp

Download

memory/4308-188-0x000002E42E940000-0x000002E42E966000-memory.dmp

Download

memory/4332-67-0x00000226EBB70000-0x00000226EBB92000-memory.dmp

Download

memory/4332-81-0x00000226EBB40000-0x00000226EBB48000-memory.dmp

Download

memory/5252-681-0x0000020E239D0000-0x0000020E23A72000-memory.dmp

Download

memory/5524-119-0x00000203EB7B0000-0x00000203EB7CA000-memory.dmp

Download

memory/5524-118-0x00000203ED620000-0x00000203ED6CC000-memory.dmp

Download

memory/5524-117-0x00000203EB770000-0x00000203EB79E000-memory.dmp

Download

memory/5524-116-0x00000203E9930000-0x00000203E9B38000-memory.dmp

Download

memory/5524-120-0x00000203ED960000-0x00000203EDA1A000-memory.dmp

Download

memory/5672-697-0x0000014189180000-0x0000014189C42000-memory.dmp

Download

memory/5772-281-0x00000151502A0000-0x00000151503A0000-memory.dmp

Download

memory/5772-527-0x00007FF6EFA60000-0x00007FF6EFA67000-memory.dmp

Download

memory/5772-290-0x0000015151F90000-0x0000015151FB0000-memory.dmp

Download

memory/5772-280-0x00000151502A0000-0x00000151503A0000-memory.dmp

Download

memory/5772-297-0x00000151533E0000-0x0000015153400000-memory.dmp

Download

memory/5772-329-0x0000015153650000-0x0000015153670000-memory.dmp

Download

memory/5772-330-0x0000015153670000-0x0000015153690000-memory.dmp

Download

memory/5772-284-0x000001494FEE0000-0x000001494FFE0000-memory.dmp

Download

memory/5772-279-0x00000151502A0000-0x00000151503A0000-memory.dmp

Download

memory/6120-106-0x000001FFF78D0000-0x000001FFF78EC000-memory.dmp

Download

memory/6120-107-0x000001FFF7900000-0x000001FFF79B3000-memory.dmp

Download

memory/6120-108-0x000001FFF79C0000-0x000001FFF79CA000-memory.dmp

Download

memory/6120-109-0x000001FFF79F0000-0x000001FFF7A0C000-memory.dmp

Download