reg.exe
Named by 2 kept items in this workspace.
Search every workspace for reg.exe. It matches the name as written, so it can find other things that share it.
The items that name it 2
Used to add AnyDesk to the Safe Mode minimal-service registry list (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk) so it would still run in Safe Mode.
Windows Registry tool used by the attacker (invoked via PowerShell) to copy SECURITY and SYSTEM registry hives
All technologies in this workspace.