Windows Registry
Named by 4 kept items in this workspace.
3 items name it under affected products and 1 under tools.
Search every workspace for Windows Registry. It matches the name as written, so it can find other things that share it.
The items that name it 4
Used by ModeloRAT for persistence, including value names 'MonitoringService' and mimicked software names like Spotify47, Adobe2841.
Source (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall) read by Dev Machine Guard for version information on Windows
All technologies in this workspace.