HyperStack sets the registry key HKLM\SYSTEM\CurrentControlSet\Control\LSA\Restrict Anonymous value to 0 so anonymous logon users (i.e. null session connections) can list all account names and enumerate all shared resources on a remote share. The implant can then use the WNetAddConnection2 API call to connect to another remote device's IPC$ share. IPC$ is a share that facilitates inter-process communication (IPC) by exposing named pipes to write to or read from