5a23e31df8a552f29c44e23a37e19616080d46c75eb2d7db462eb01441106742

Resubmissions

21/06/2024, 12:53

240621-p4pdmathqr10

21/06/2024, 12:49

240621-p2vgvstgrr4

Analysis

max time kernel
1777s
max time network
1744s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
21/06/2024, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Oneclick-V6.7.bat
Size 201KB
Sample240621-p4pdmathqr
SHA256 5a23e31df8a552f29c44e23a37e19616080d46c75eb2d7db462eb01441106742
MD5 ea994c0d4dcdf963b7b7bf5cf54a26ae
SHA1 f16c3d7d5f2fd868d9385b601dc411605ba95342
SHA512 0a065d62966e08d34dc00973d5955b918f0d588f2f03361099b7b21a5696f8da4a07cc5bd8ad2e1b2153ff3372c95d3d6a19a0d8d61aacd4607a6608adb298da
SSDEEP 1536:97SPKdigMQgPTjIV4wJzSwTgfGH/ngfHH4pX/WaZSiDk2IWOmXmomk:9nnHgv3h4KmXmomk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery evasion execution exploit persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	reg.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1624	bcdedit.exe
3444	Process not Found
2520	Process not Found
2320	Process not Found

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4736	powershell.exe
436	powershell.exe
4728	powershell.exe
3488	powershell.exe
2512	powershell.exe
3880	powershell.exe
660	powershell.exe
1132	powershell.exe
1752	powershell.exe
3920	powershell.exe
4236	powershell.exe
5052	powershell.exe
3808	powershell.exe
3376	powershell.exe
3808	powershell.exe
1132	Process not Found
2932	powershell.exe
3904	powershell.exe
3480	Process not Found
3660	powershell.exe
4872	powershell.exe
4076	powershell.exe
4956	powershell.exe
3672	powershell.exe
2316	powershell.exe
1620	Process not Found
512	powershell.exe
2240	powershell.exe
1908	powershell.exe
4180	powershell.exe
3940	powershell.exe
5016	powershell.exe
4900	powershell.exe
3332	powershell.exe
3948	powershell.exe
3196	powershell.exe
3716	powershell.exe
3556	powershell.exe
4692	powershell.exe
4460	powershell.exe
2080	powershell.exe
1092	powershell.exe
2676	powershell.exe
436	powershell.exe
3444	Process not Found
4104	powershell.exe
436	powershell.exe
3312	powershell.exe
1620	powershell.exe
1880	powershell.exe
3828	powershell.exe
5112	powershell.exe
5076	powershell.exe
1508	powershell.exe
3900	powershell.exe
3712	powershell.exe
2932	powershell.exe
3492	Process not Found
192	powershell.exe
4084	powershell.exe
4720	powershell.exe
3104	powershell.exe
3588	powershell.exe
3796	powershell.exe

Possible privilege escalation attempt 15 IoCs

exploit

pid	Process
4312	takeown.exe
2136	icacls.exe
3292	takeown.exe
4888	icacls.exe
216	icacls.exe
4984	icacls.exe
3484	icacls.exe
4068	takeown.exe
4004	takeown.exe
3596	takeown.exe
3976	icacls.exe
3996	takeown.exe
5076	takeown.exe
3708	icacls.exe
4044	icacls.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4984	icacls.exe
216	icacls.exe
3996	takeown.exe
4888	icacls.exe
3596	takeown.exe
3708	icacls.exe
4004	takeown.exe
4044	icacls.exe
4312	takeown.exe
3484	icacls.exe
5076	takeown.exe
3976	icacls.exe
2136	icacls.exe
3292	takeown.exe
4068	takeown.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\a4iuzc	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSetup	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSetup	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2600	powercfg.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SRU\SRU.log	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.jfm	svchost.exe
File opened for modification	C:\Windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{08730fd8-c151-403b-b7bb-7644479b9f8d}\snapshot.etl	svchost.exe
File created	C:\Windows\system32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-160447019-1232603106-4168707212-1000_UserData.bin	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRU.chk	svchost.exe
File opened for modification	C:\Windows\system32\SRU\SRUDB.dat	svchost.exe
File created	C:\Windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{08730fd8-c151-403b-b7bb-7644479b9f8d}\snapshot.etl	svchost.exe
File created	C:\Windows\system32\WDI\BootPerformanceDiagnostics_SystemData.bin	svchost.exe
File created	C:\Windows\system32\wdi\LogFiles\StartupInfo\S-1-5-21-160447019-1232603106-4168707212-1000_StartupInfo1.xml	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\4032412167\4002656488.pri	explorer.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	Taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	Taskmgr.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	svchost.exe
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	explorer.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
904	powershell.exe
2224	powershell.exe
2820	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2600	sc.exe
3972	sc.exe
2320	sc.exe
3464	sc.exe
1888	sc.exe
5036	sc.exe
4728	sc.exe
5052	sc.exe
368	sc.exe
3044	sc.exe
3108	sc.exe
2872	sc.exe
1752	sc.exe
1444	sc.exe
2820	sc.exe
2800	sc.exe
192	sc.exe
2224	sc.exe
5044	sc.exe
216	sc.exe
4716	sc.exe
716	sc.exe
4932	sc.exe
3728	sc.exe
4036	sc.exe
4104	sc.exe
1936	sc.exe
2748	sc.exe
4884	sc.exe
3044	sc.exe
436	sc.exe
3212	sc.exe
4548	sc.exe
4720	sc.exe
4684	sc.exe
3912	sc.exe
4196	sc.exe
1604	sc.exe
1476	sc.exe
4600	sc.exe
5036	sc.exe
2192	sc.exe
1912	sc.exe
512	sc.exe
376	sc.exe
5040	sc.exe
4444	sc.exe
3440	sc.exe
1516	sc.exe
2780	sc.exe
3768	sc.exe
2148	sc.exe
2456	sc.exe
1552	sc.exe
504	sc.exe
3440	sc.exe
4516	sc.exe
3436	sc.exe
1936	sc.exe
1648	sc.exe
5048	sc.exe
5004	sc.exe
5048	sc.exe
2024	sc.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 64 IoCs

evasion

pid	Process
4884	timeout.exe
1648	timeout.exe
708	timeout.exe
1192	Process not Found
3280	Process not Found
1908	timeout.exe
2828	timeout.exe
1388	timeout.exe
3828	timeout.exe
3784	timeout.exe
4304	timeout.exe
3444	Process not Found
4216	timeout.exe
3488	timeout.exe
3704	Process not Found
1620	Process not Found
520	Process not Found
1200	Process not Found
1132	Process not Found
924	timeout.exe
4868	timeout.exe
3292	timeout.exe
1912	timeout.exe
4992	timeout.exe
2044	timeout.exe
292	Process not Found
4216	Process not Found
3700	Process not Found
3932	Process not Found
3280	Process not Found
1444	Process not Found
68	Process not Found
2540	timeout.exe
2004	timeout.exe
4544	timeout.exe
5100	Process not Found
5044	Process not Found
2844	Process not Found
4420	Process not Found
420	Process not Found
3212	Process not Found
192	Process not Found
3688	Process not Found
2888	Process not Found
3428	Process not Found
3952	timeout.exe
3388	Process not Found
3680	Process not Found
5004	timeout.exe
4420	timeout.exe
1040	Process not Found
216	Process not Found
1332	timeout.exe
2668	Process not Found
2028	Process not Found
1468	Process not Found
5052	timeout.exe
376	timeout.exe
1936	Process not Found
988	Process not Found
2644	Process not Found
2196	Process not Found
2776	Process not Found
3704	Process not Found

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe

Kills process with taskkill 12 IoCs

evasion

pid	Process
660	taskkill.exe
3000	taskkill.exe
1888	taskkill.exe
2880	taskkill.exe
1080	taskkill.exe
4304	taskkill.exe
1176	Process not Found
4724	Process not Found
2880	Process not Found
2672	taskkill.exe
3600	taskkill.exe
1724	Process not Found

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%windir%\system32\drivers\ndisuio.sys,-501 = "NDIS Usermode I/O Protocol"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%windir%\System32\drivers\ndiscap.sys,-5000 = "Microsoft NDIS Capture"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%systemroot%\system32\wkssvc.dll,-1010 = "Client for Microsoft Networks"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%windir%\System32\drivers\wfplwfs.sys,-6005 = "WFP 802.3 MAC Layer LightWeight Filter"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard	reg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%SystemRoot%\system32\drivers\tcpip.sys,-10100 = "Internet Protocol Version 4 (TCP/IPv4)"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%windir%\System32\drivers\wfplwfs.sys,-6006 = "WFP Native MAC Layer LightWeight Filter"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators = "80000002"	reg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%SystemRoot%\system32\drivers\tcpip.sys,-10108 = "Microsoft RDMA - NDK"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%SystemRoot%\system32\drivers\mslldp.sys,-211 = "Microsoft LLDP Protocol Driver"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%windir%\system32\mprmsg.dll,-32015 = "Point to Point Protocol Over Ethernet"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%systemroot%\system32\srvsvc.dll,-109 = "File and Printer Sharing for Microsoft Networks"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%windir%\system32\drivers\netbios.sys,-501 = "NetBIOS Interface"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%windir%\system32\drivers\netbt.sys,-3 = "WINS Client(TCP/IP) Protocol"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@%SystemRoot%\system32\drivers\tcpip.sys,-10102 = "Internet Protocol Version 6 (TCP/IPv6)"	svchost.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\CLSID	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80706004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c0000000000000000000000000bc92036dac3da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80706004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c0000000000000000000000005e1af135dac3da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000003631b1288a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567065867241975"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"	SearchUI.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4900	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3900	powershell.exe
3900	powershell.exe
3900	powershell.exe
436	powershell.exe
436	powershell.exe
436	powershell.exe
1100	powershell.exe
1100	powershell.exe
1100	powershell.exe
904	powershell.exe
904	powershell.exe
904	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
3572	powershell.exe
3572	powershell.exe
3572	powershell.exe
712	powershell.exe
712	powershell.exe
712	powershell.exe
4736	powershell.exe
4736	powershell.exe
4736	powershell.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
2224	powershell.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
4180	powershell.exe
4180	powershell.exe
4180	powershell.exe
4180	powershell.exe
2820	powershell.exe
2820	powershell.exe
2820	powershell.exe
2820	powershell.exe
2196	powershell.exe
2196	powershell.exe
2196	powershell.exe
3920	powershell.exe
3920	powershell.exe
3920	powershell.exe
3920	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4784	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeBackupPrivilege	4996	vssvc.exe
Token: SeRestorePrivilege	4996	vssvc.exe
Token: SeAuditPrivilege	4996	vssvc.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeBackupPrivilege	1512	srtasks.exe
Token: SeRestorePrivilege	1512	srtasks.exe
Token: SeSecurityPrivilege	1512	srtasks.exe
Token: SeTakeOwnershipPrivilege	1512	srtasks.exe
Token: SeBackupPrivilege	1512	srtasks.exe
Token: SeRestorePrivilege	1512	srtasks.exe
Token: SeSecurityPrivilege	1512	srtasks.exe
Token: SeTakeOwnershipPrivilege	1512	srtasks.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeShutdownPrivilege	2600	powercfg.exe
Token: SeCreatePagefilePrivilege	2600	powercfg.exe
Token: SeShutdownPrivilege	2600	powercfg.exe
Token: SeCreatePagefilePrivilege	2600	powercfg.exe
Token: SeDebugPrivilege	712	powershell.exe
Token: SeIncreaseQuotaPrivilege	712	powershell.exe
Token: SeSecurityPrivilege	712	powershell.exe
Token: SeTakeOwnershipPrivilege	712	powershell.exe
Token: SeLoadDriverPrivilege	712	powershell.exe
Token: SeSystemProfilePrivilege	712	powershell.exe
Token: SeSystemtimePrivilege	712	powershell.exe
Token: SeProfSingleProcessPrivilege	712	powershell.exe
Token: SeIncBasePriorityPrivilege	712	powershell.exe
Token: SeCreatePagefilePrivilege	712	powershell.exe
Token: SeBackupPrivilege	712	powershell.exe
Token: SeRestorePrivilege	712	powershell.exe
Token: SeShutdownPrivilege	712	powershell.exe
Token: SeDebugPrivilege	712	powershell.exe
Token: SeSystemEnvironmentPrivilege	712	powershell.exe
Token: SeRemoteShutdownPrivilege	712	powershell.exe
Token: SeUndockPrivilege	712	powershell.exe
Token: SeManageVolumePrivilege	712	powershell.exe
Token: 33	712	powershell.exe
Token: 34	712	powershell.exe
Token: 35	712	powershell.exe
Token: 36	712	powershell.exe
Token: SeShutdownPrivilege	1620	svchost.exe
Token: SeCreatePagefilePrivilege	1620	svchost.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	5032	Taskmgr.exe
Token: SeSystemProfilePrivilege	5032	Taskmgr.exe
Token: SeCreateGlobalPrivilege	5032	Taskmgr.exe
Token: SeDebugPrivilege	660	taskkill.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeIncreaseQuotaPrivilege	3064	powershell.exe
Token: SeSecurityPrivilege	3064	powershell.exe
Token: SeTakeOwnershipPrivilege	3064	powershell.exe
Token: SeLoadDriverPrivilege	3064	powershell.exe
Token: SeSystemProfilePrivilege	3064	powershell.exe
Token: SeSystemtimePrivilege	3064	powershell.exe
Token: SeProfSingleProcessPrivilege	3064	powershell.exe
Token: SeIncBasePriorityPrivilege	3064	powershell.exe
Token: SeCreatePagefilePrivilege	3064	powershell.exe
Token: SeBackupPrivilege	3064	powershell.exe
Token: SeRestorePrivilege	3064	powershell.exe
Token: SeShutdownPrivilege	3064	powershell.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
5032	Taskmgr.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe
4784	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4392	SearchUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 5024	2804	cmd.exe	74
PID 2804 wrote to memory of 5024	2804	cmd.exe	74
PID 2804 wrote to memory of 192	2804	cmd.exe	75
PID 2804 wrote to memory of 192	2804	cmd.exe	75
PID 2804 wrote to memory of 3572	2804	cmd.exe	76
PID 2804 wrote to memory of 3572	2804	cmd.exe	76
PID 2804 wrote to memory of 220	2804	cmd.exe	77
PID 2804 wrote to memory of 220	2804	cmd.exe	77
PID 2804 wrote to memory of 1104	2804	cmd.exe	78
PID 2804 wrote to memory of 1104	2804	cmd.exe	78
PID 2804 wrote to memory of 4960	2804	cmd.exe	79
PID 2804 wrote to memory of 4960	2804	cmd.exe	79
PID 2804 wrote to memory of 2196	2804	cmd.exe	80
PID 2804 wrote to memory of 2196	2804	cmd.exe	80
PID 2804 wrote to memory of 3020	2804	cmd.exe	81
PID 2804 wrote to memory of 3020	2804	cmd.exe	81
PID 2804 wrote to memory of 4392	2804	cmd.exe	82
PID 2804 wrote to memory of 4392	2804	cmd.exe	82
PID 4392 wrote to memory of 2164	4392	net.exe	83
PID 4392 wrote to memory of 2164	4392	net.exe	83
PID 2804 wrote to memory of 2044	2804	cmd.exe	86
PID 2804 wrote to memory of 2044	2804	cmd.exe	86
PID 2804 wrote to memory of 3108	2804	cmd.exe	87
PID 2804 wrote to memory of 3108	2804	cmd.exe	87
PID 2804 wrote to memory of 1908	2804	cmd.exe	88
PID 2804 wrote to memory of 1908	2804	cmd.exe	88
PID 2804 wrote to memory of 4124	2804	cmd.exe	89
PID 2804 wrote to memory of 4124	2804	cmd.exe	89
PID 2804 wrote to memory of 4468	2804	cmd.exe	90
PID 2804 wrote to memory of 4468	2804	cmd.exe	90
PID 2804 wrote to memory of 3900	2804	cmd.exe	91
PID 2804 wrote to memory of 3900	2804	cmd.exe	91
PID 2804 wrote to memory of 436	2804	cmd.exe	92
PID 2804 wrote to memory of 436	2804	cmd.exe	92
PID 2804 wrote to memory of 2112	2804	cmd.exe	95
PID 2804 wrote to memory of 2112	2804	cmd.exe	95
PID 2804 wrote to memory of 4992	2804	cmd.exe	96
PID 2804 wrote to memory of 4992	2804	cmd.exe	96
PID 2804 wrote to memory of 4936	2804	cmd.exe	97
PID 2804 wrote to memory of 4936	2804	cmd.exe	97
PID 2804 wrote to memory of 5076	2804	cmd.exe	98
PID 2804 wrote to memory of 5076	2804	cmd.exe	98
PID 2804 wrote to memory of 1100	2804	cmd.exe	99
PID 2804 wrote to memory of 1100	2804	cmd.exe	99
PID 2804 wrote to memory of 3416	2804	cmd.exe	105
PID 2804 wrote to memory of 3416	2804	cmd.exe	105
PID 2804 wrote to memory of 3624	2804	cmd.exe	106
PID 2804 wrote to memory of 3624	2804	cmd.exe	106
PID 2804 wrote to memory of 924	2804	cmd.exe	107
PID 2804 wrote to memory of 924	2804	cmd.exe	107
PID 2804 wrote to memory of 192	2804	cmd.exe	108
PID 2804 wrote to memory of 192	2804	cmd.exe	108
PID 2804 wrote to memory of 2924	2804	cmd.exe	109
PID 2804 wrote to memory of 2924	2804	cmd.exe	109
PID 2804 wrote to memory of 4736	2804	cmd.exe	110
PID 2804 wrote to memory of 4736	2804	cmd.exe	110
PID 2804 wrote to memory of 4712	2804	cmd.exe	111
PID 2804 wrote to memory of 4712	2804	cmd.exe	111
PID 2804 wrote to memory of 1552	2804	cmd.exe	112
PID 2804 wrote to memory of 1552	2804	cmd.exe	112
PID 2804 wrote to memory of 4984	2804	cmd.exe	113
PID 2804 wrote to memory of 4984	2804	cmd.exe	113
PID 2804 wrote to memory of 3212	2804	cmd.exe	114
PID 2804 wrote to memory of 3212	2804	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Oneclick-V6.7.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:5024
- C:\Windows\system32\sc.exe
  sc query "WinDefend"
  2⤵
  PID:192
- C:\Windows\system32\find.exe
  find "STATE"
  2⤵
  PID:3572
- C:\Windows\system32\find.exe
  find "RUNNING"
  2⤵
  PID:220
- C:\Windows\system32\sc.exe
  sc qc "TrustedInstaller"
  2⤵
  PID:1104
- C:\Windows\system32\find.exe
  find "START_TYPE"
  2⤵
  PID:4960
- C:\Windows\system32\find.exe
  find "DISABLED"
  2⤵
  PID:2196
- C:\Windows\system32\sc.exe
  sc config TrustedInstaller start=auto
  2⤵
  PID:3020
- C:\Windows\system32\net.exe
  net start TrustedInstaller
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start TrustedInstaller
    3⤵
    PID:2164
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:2044
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3108
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:1908
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4124
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:4468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host 'Recommended!' -ForegroundColor White -BackgroundColor Red"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
  2⤵
  PID:2112
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
  2⤵
  PID:4936
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Checkpoint-Computer -Description 'OneClick V6.7 Restore Point'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  PID:3416
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3624
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:924
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:192
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /t REG_DWORD /d 0 /f
  2⤵
  PID:2924
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "PublishUserActivities" /t REG_DWORD /d 0 /f
  2⤵
  PID:4736
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "UploadUserActivities" /t REG_DWORD /d 0 /f
  2⤵
  PID:4712
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:1552
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location" /v "Value" /t REG_SZ /d "Deny" /f
  2⤵
  PID:4984
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Sensor\Overrides\{BFA794E4-F964-4FDB-90F6-51056BFE4B44}" /v "SensorPermissionState" /t REG_DWORD /d 0 /f
  2⤵
  PID:3212
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\lfsvc\Service\Configuration" /v "Status" /t REG_DWORD /d 0 /f
  2⤵
  PID:2520
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\Maps" /v "AutoUpdateEnabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:2120
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:4344
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d 1 /f
  2⤵
  PID:3464
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:1672
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:4444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Remove-Item -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\StorageSense\Parameters\StoragePolicy' -Recurse -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Control Panel\Accessibility\StickyKeys" /v Flags /t REG_SZ /d 506 /f
  2⤵
  PID:1328
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:5004
- C:\Windows\system32\reg.exe
  reg.exe add "HKU\.DEFAULT\Control Panel\Keyboard" /v InitialKeyboardIndicators /t REG_DWORD /d 80000002 /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:4576
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:2540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "New-Item -Path 'HKCU:\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}' -Name 'InprocServer32' -Force -Value ''"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:5052
- C:\Windows\system32\reg.exe
  reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 0 /f
  2⤵
  - Modifies visibility of file extensions in Explorer
  PID:4972
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:1812
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 1 /f
  2⤵
  PID:4040
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:1508
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarDa /t REG_DWORD /d 0 /f
  2⤵
  PID:212
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:2672
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v "DragFullWindows" /t REG_SZ /d "0" /f
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v "MenuShowDelay" /t REG_SZ /d "200" /f
  2⤵
  PID:4080
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop\WindowMetrics" /v "MinAnimate" /t REG_SZ /d "0" /f
  2⤵
  PID:1332
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Keyboard" /v "KeyboardDelay" /t REG_DWORD /d 0 /f
  2⤵
  PID:520
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewAlphaSelect" /t REG_DWORD /d 0 /f
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewShadow" /t REG_DWORD /d 0 /f
  2⤵
  PID:776
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d 0 /f
  2⤵
  PID:4292
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects" /v "VisualFXSetting" /t REG_DWORD /d 3 /f
  2⤵
  PID:1312
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\DWM" /v "EnableAeroPeek" /t REG_DWORD /d 0 /f
  2⤵
  PID:1444
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarMn" /t REG_DWORD /d 0 /f
  2⤵
  PID:652
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarDa" /t REG_DWORD /d 0 /f
  2⤵
  PID:4888
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d 0 /f
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v "SearchboxTaskbarMode" /t REG_DWORD /d 0 /f
  2⤵
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKCU:\Control Panel\Desktop' -Name 'UserPreferencesMask' -Type Binary -Value ([byte[]](144,18,3,128,16,0,0,0))"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:708
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_FSEBehavior /t REG_DWORD /d 2 /f
  2⤵
  PID:1580
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2984
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_DXGIHonorFSEWindowsCompatible /t REG_DWORD /d 1 /f
  2⤵
  PID:4332
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_HonorUserFSEBehaviorMode /t REG_DWORD /d 1 /f
  2⤵
  PID:1148
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v GameDVR_EFSEFeatureFlags /t REG_DWORD /d 0 /f
  2⤵
  PID:2044
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f
  2⤵
  PID:4796
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Search" /v BingSearchEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:1912
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:3068
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\Microsoft\GameBar" /v "AllowAutoGameMode" /t REG_DWORD /d 0 /f
  2⤵
  PID:828
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\Microsoft\GameBar" /v "AutoGameModeEnabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:3008
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:404
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers" /v "HwSchMode" /t REG_DWORD /d 2 /f
  2⤵
  PID:1500
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:4216
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v EnableTransparency /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4900
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:3728
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v MouseSpeed /t REG_SZ /d 0 /f
  2⤵
  PID:832
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v MouseThreshold1 /t REG_SZ /d 0 /f
  2⤵
  PID:3460
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v MouseThreshold2 /t REG_SZ /d 0 /f
  2⤵
  PID:2308
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:3952
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Power" /v HibernateEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2872
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FlyoutMenuSettings" /v ShowHibernateOption /t REG_DWORD /d 0 /f
  2⤵
  PID:4120
- C:\Windows\system32\powercfg.exe
  powercfg.exe /hibernate off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:2004
- C:\Windows\system32\sc.exe
  sc config HomeGroupListener start=demand
  2⤵
  PID:3444
- C:\Windows\system32\sc.exe
  sc config HomeGroupProvider start=demand
  2⤵
  - Launches sc.exe
  PID:3044
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:4884
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\PolicyManager\default\WiFi\AllowWiFiHotSpotReporting" /v "Value" /t REG_DWORD /d 0 /f
  2⤵
  PID:768
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\PolicyManager\default\WiFi\AllowAutoConnectToWiFiSenseHotspots" /v "Value" /t REG_DWORD /d 0 /f
  2⤵
  PID:2304
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:4868
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 1 /f
  2⤵
  PID:4992
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:4312
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v "DisabledComponents" /t REG_DWORD /d 255 /f
  2⤵
  PID:3800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Disable-NetAdapterBinding -Name '*' -ComponentID ms_tcpip6"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:712
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:3292
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /f /v EnableLUA /t REG_DWORD /d 0
  2⤵
  - UAC bypass
  PID:3196
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:4404
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:2572
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:4968
- C:\Windows\system32\sc.exe
  sc config AJRouter start=disabled
  2⤵
  PID:2924
- C:\Windows\system32\sc.exe
  sc config ALG start=demand
  2⤵
  PID:2080
- C:\Windows\system32\sc.exe
  sc config AppIDSvc start=demand
  2⤵
  PID:4984
- C:\Windows\system32\sc.exe
  sc config AppMgmt start=demand
  2⤵
  - Launches sc.exe
  PID:2192
- C:\Windows\system32\sc.exe
  sc config AppReadiness start=demand
  2⤵
  PID:2520
- C:\Windows\system32\sc.exe
  sc config AppVClient start=disabled
  2⤵
  PID:4564
- C:\Windows\system32\sc.exe
  sc config AppXSvc start=demand
  2⤵
  PID:2196
- C:\Windows\system32\sc.exe
  sc config Appinfo start=demand
  2⤵
  PID:1104
- C:\Windows\system32\sc.exe
  sc config AssignedAccessManagerSvc start=disabled
  2⤵
  PID:4716
- C:\Windows\system32\sc.exe
  sc config AudioEndpointBuilder start=auto
  2⤵
  PID:4684
- C:\Windows\system32\sc.exe
  sc config AudioSrv start=auto
  2⤵
  PID:4552
- C:\Windows\system32\sc.exe
  sc config Audiosrv start=auto
  2⤵
  PID:4392
- C:\Windows\system32\sc.exe
  sc config AxInstSV start=demand
  2⤵
  PID:924
- C:\Windows\system32\sc.exe
  sc config BDESVC start=demand
  2⤵
  PID:3436
- C:\Windows\system32\sc.exe
  sc config BFE start=auto
  2⤵
  PID:1468
- C:\Windows\system32\sc.exe
  sc config BITS start=delayed-auto
  2⤵
  PID:4924
- C:\Windows\system32\sc.exe
  sc config BTAGService start=demand
  2⤵
  PID:2576
- C:\Windows\system32\sc.exe
  sc config BcastDVRUserService_dc2a4 start=demand
  2⤵
  PID:4332
- C:\Windows\system32\sc.exe
  sc config BluetoothUserService_dc2a4 start=demand
  2⤵
  PID:4344
- C:\Windows\system32\sc.exe
  sc config BrokerInfrastructure start=auto
  2⤵
  PID:3108
- C:\Windows\system32\sc.exe
  sc config Browser start=demand
  2⤵
  PID:1908
- C:\Windows\system32\sc.exe
  sc config BthAvctpSvc start=auto
  2⤵
  PID:3032
- C:\Windows\system32\sc.exe
  sc config BthHFSrv start=auto
  2⤵
  - Launches sc.exe
  PID:1648
- C:\Windows\system32\sc.exe
  sc config CDPSvc start=demand
  2⤵
  PID:2316
- C:\Windows\system32\sc.exe
  sc config CDPUserSvc_dc2a4 start=auto
  2⤵
  PID:3056
- C:\Windows\system32\sc.exe
  sc config COMSysApp start=demand
  2⤵
  PID:504
- C:\Windows\system32\sc.exe
  sc config CaptureService_dc2a4 start=demand
  2⤵
  PID:4632
- C:\Windows\system32\sc.exe
  sc config CertPropSvc start=demand
  2⤵
  PID:3060
- C:\Windows\system32\sc.exe
  sc config ClipSVC start=demand
  2⤵
  PID:2152
- C:\Windows\system32\sc.exe
  sc config ConsentUxUserSvc_dc2a4 start=demand
  2⤵
  PID:3260
- C:\Windows\system32\sc.exe
  sc config CoreMessagingRegistrar start=auto
  2⤵
  PID:1992
- C:\Windows\system32\sc.exe
  sc config CredentialEnrollmentManagerUserSvc_dc2a4 start=demand
  2⤵
  PID:2188
- C:\Windows\system32\sc.exe
  sc config CryptSvc start=auto
  2⤵
  PID:4216
- C:\Windows\system32\sc.exe
  sc config CscService start=demand
  2⤵
  PID:4900
- C:\Windows\system32\sc.exe
  sc config DPS start=auto
  2⤵
  PID:4468
- C:\Windows\system32\sc.exe
  sc config DcomLaunch start=auto
  2⤵
  PID:4912
- C:\Windows\system32\sc.exe
  sc config DcpSvc start=demand
  2⤵
  - Launches sc.exe
  PID:1476
- C:\Windows\system32\sc.exe
  sc config DevQueryBroker start=demand
  2⤵
  PID:904
- C:\Windows\system32\sc.exe
  sc config DeviceAssociationBrokerSvc_dc2a4 start=demand
  2⤵
  PID:2308
- C:\Windows\system32\sc.exe
  sc config DeviceAssociationService start=demand
  2⤵
  PID:2036
- C:\Windows\system32\sc.exe
  sc config DeviceInstall start=demand
  2⤵
  PID:4608
- C:\Windows\system32\sc.exe
  sc config DevicePickerUserSvc_dc2a4 start=demand
  2⤵
  PID:3100
- C:\Windows\system32\sc.exe
  sc config DevicesFlowUserSvc_dc2a4 start=demand
  2⤵
  PID:2472
- C:\Windows\system32\sc.exe
  sc config Dhcp start=auto
  2⤵
  - Launches sc.exe
  PID:2600
- C:\Windows\system32\sc.exe
  sc config DiagTrack start=disabled
  2⤵
  PID:440
- C:\Windows\system32\sc.exe
  sc config DialogBlockingService start=disabled
  2⤵
  PID:4328
- C:\Windows\system32\sc.exe
  sc config DispBrokerDesktopSvc start=auto
  2⤵
  PID:3444
- C:\Windows\system32\sc.exe
  sc config DisplayEnhancementService start=demand
  2⤵
  PID:3044
- C:\Windows\system32\sc.exe
  sc config DmEnrollmentSvc start=demand
  2⤵
  PID:4948
- C:\Windows\system32\sc.exe
  sc config Dnscache start=auto
  2⤵
  PID:3912
- C:\Windows\system32\sc.exe
  sc config DoSvc start=delayed-auto
  2⤵
  PID:4324
- C:\Windows\system32\sc.exe
  sc config DsSvc start=demand
  2⤵
  PID:2304
- C:\Windows\system32\sc.exe
  sc config DsmSvc start=demand
  2⤵
  PID:3052
- C:\Windows\system32\sc.exe
  sc config DusmSvc start=auto
  2⤵
  PID:2224
- C:\Windows\system32\sc.exe
  sc config EFS start=demand
  2⤵
  PID:4936
- C:\Windows\system32\sc.exe
  sc config EapHost start=demand
  2⤵
  PID:4312
- C:\Windows\system32\sc.exe
  sc config EntAppSvc start=demand
  2⤵
  PID:3632
- C:\Windows\system32\sc.exe
  sc config EventLog start=auto
  2⤵
  - Launches sc.exe
  PID:4548
- C:\Windows\system32\sc.exe
  sc config EventSystem start=auto
  2⤵
  PID:3000
- C:\Windows\system32\sc.exe
  sc config FDResPub start=demand
  2⤵
  PID:2680
- C:\Windows\system32\sc.exe
  sc config Fax start=demand
  2⤵
  PID:4516
- C:\Windows\system32\sc.exe
  sc config FontCache start=auto
  2⤵
  PID:3736
- C:\Windows\system32\sc.exe
  sc config FrameServer start=demand
  2⤵
  PID:3828
- C:\Windows\system32\sc.exe
  sc config FrameServerMonitor start=demand
  2⤵
  PID:2456
- C:\Windows\system32\sc.exe
  sc config GraphicsPerfSvc start=demand
  2⤵
  PID:4628
- C:\Windows\system32\sc.exe
  sc config HomeGroupListener start=demand
  2⤵
  - Launches sc.exe
  PID:1752
- C:\Windows\system32\sc.exe
  sc config HomeGroupProvider start=demand
  2⤵
  PID:5008
- C:\Windows\system32\sc.exe
  sc config HvHost start=demand
  2⤵
  PID:4040
- C:\Windows\system32\sc.exe
  sc config IEEtwCollectorService start=demand
  2⤵
  PID:8
- C:\Windows\system32\sc.exe
  sc config IKEEXT start=demand
  2⤵
  PID:4036
- C:\Windows\system32\sc.exe
  sc config InstallService start=demand
  2⤵
  PID:212
- C:\Windows\system32\sc.exe
  sc config InventorySvc start=demand
  2⤵
  PID:2880
- C:\Windows\system32\sc.exe
  sc config IpxlatCfgSvc start=demand
  2⤵
  - Launches sc.exe
  PID:4720
- C:\Windows\system32\sc.exe
  sc config KeyIso start=auto
  2⤵
  PID:2236
- C:\Windows\system32\sc.exe
  sc config KtmRm start=demand
  2⤵
  - Launches sc.exe
  PID:4728
- C:\Windows\system32\sc.exe
  sc config LSM start=auto
  2⤵
  PID:4644
- C:\Windows\system32\sc.exe
  sc config LanmanServer start=auto
  2⤵
  PID:2512
- C:\Windows\system32\sc.exe
  sc config LanmanWorkstation start=auto
  2⤵
  PID:5080
- C:\Windows\system32\sc.exe
  sc config LicenseManager start=demand
  2⤵
  PID:4972
- C:\Windows\system32\sc.exe
  sc config LxpSvc start=demand
  2⤵
  PID:3548
- C:\Windows\system32\sc.exe
  sc config MSDTC start=demand
  2⤵
  PID:2244
- C:\Windows\system32\sc.exe
  sc config MSiSCSI start=demand
  2⤵
  PID:1444
- C:\Windows\system32\sc.exe
  sc config MapsBroker start=delayed-auto
  2⤵
  PID:3292
- C:\Windows\system32\sc.exe
  sc config McpManagementService start=demand
  2⤵
  PID:3196
- C:\Windows\system32\sc.exe
  sc config MessagingService_dc2a4 start=demand
  2⤵
  PID:4888
- C:\Windows\system32\sc.exe
  sc config MicrosoftEdgeElevationService start=demand
  2⤵
  PID:1568
- C:\Windows\system32\sc.exe
  sc config MixedRealityOpenXRSvc start=demand
  2⤵
  PID:5060
- C:\Windows\system32\sc.exe
  sc config MpsSvc start=auto
  2⤵
  - Launches sc.exe
  PID:1552
- C:\Windows\system32\sc.exe
  sc config MsKeyboardFilter start=demand
  2⤵
  PID:2820
- C:\Windows\system32\sc.exe
  sc config NPSMSvc_dc2a4 start=demand
  2⤵
  PID:1624
- C:\Windows\system32\sc.exe
  sc config NaturalAuthentication start=demand
  2⤵
  PID:4460
- C:\Windows\system32\sc.exe
  sc config NcaSvc start=demand
  2⤵
  PID:2520
- C:\Windows\system32\sc.exe
  sc config NcbService start=demand
  2⤵
  PID:5036
- C:\Windows\system32\sc.exe
  sc config NcdAutoSetup start=demand
  2⤵
  PID:2020
- C:\Windows\system32\sc.exe
  sc config NetSetupSvc start=demand
  2⤵
  PID:4416
- C:\Windows\system32\sc.exe
  sc config NetTcpPortSharing start=disabled
  2⤵
  PID:2544
- C:\Windows\system32\sc.exe
  sc config Netlogon start=demand
  2⤵
  - Launches sc.exe
  PID:4684
- C:\Windows\system32\sc.exe
  sc config Netman start=demand
  2⤵
  PID:4552
- C:\Windows\system32\sc.exe
  sc config NgcCtnrSvc start=demand
  2⤵
  PID:4528
- C:\Windows\system32\sc.exe
  sc config NgcSvc start=demand
  2⤵
  PID:1020
- C:\Windows\system32\sc.exe
  sc config NlaSvc start=demand
  2⤵
  PID:1740
- C:\Windows\system32\sc.exe
  sc config OneSyncSvc_dc2a4 start=auto
  2⤵
  PID:880
- C:\Windows\system32\sc.exe
  sc config P9RdrService_dc2a4 start=demand
  2⤵
  PID:2748
- C:\Windows\system32\sc.exe
  sc config PNRPAutoReg start=demand
  2⤵
  PID:3756
- C:\Windows\system32\sc.exe
  sc config PNRPsvc start=demand
  2⤵
  - Launches sc.exe
  PID:5040
- C:\Windows\system32\sc.exe
  sc config PcaSvc start=demand
  2⤵
  - Launches sc.exe
  PID:3108
- C:\Windows\system32\sc.exe
  sc config PeerDistSvc start=demand
  2⤵
  PID:1908
- C:\Windows\system32\sc.exe
  sc config PenService_dc2a4 start=demand
  2⤵
  - Launches sc.exe
  PID:1912
- C:\Windows\system32\sc.exe
  sc config PerfHost start=demand
  2⤵
  - Launches sc.exe
  PID:716
- C:\Windows\system32\sc.exe
  sc config PhoneSvc start=demand
  2⤵
  PID:4356
- C:\Windows\system32\sc.exe
  sc config PimIndexMaintenanceSvc_dc2a4 start=demand
  2⤵
  - Launches sc.exe
  PID:4932
- C:\Windows\system32\sc.exe
  sc config PlugPlay start=demand
  2⤵
  PID:3056
- C:\Windows\system32\sc.exe
  sc config PolicyAgent start=demand
  2⤵
  - Launches sc.exe
  PID:504
- C:\Windows\system32\sc.exe
  sc config Power start=auto
  2⤵
  PID:4632
- C:\Windows\system32\sc.exe
  sc config PrintNotify start=demand
  2⤵
  PID:3060
- C:\Windows\system32\sc.exe
  sc config PrintWorkflowUserSvc_dc2a4 start=demand
  2⤵
  PID:2152
- C:\Windows\system32\sc.exe
  sc config ProfSvc start=auto
  2⤵
  PID:3260
- C:\Windows\system32\sc.exe
  sc config PushToInstall start=demand
  2⤵
  PID:4196
- C:\Windows\system32\sc.exe
  sc config QWAVE start=demand
  2⤵
  PID:1604
- C:\Windows\system32\sc.exe
  sc config RasAuto start=demand
  2⤵
  PID:4216
- C:\Windows\system32\sc.exe
  sc config RasMan start=demand
  2⤵
  PID:4900
- C:\Windows\system32\sc.exe
  sc config RemoteAccess start=disabled
  2⤵
  PID:4468
- C:\Windows\system32\sc.exe
  sc config RemoteRegistry start=disabled
  2⤵
  PID:832
- C:\Windows\system32\sc.exe
  sc config RetailDemo start=demand
  2⤵
  PID:4612
- C:\Windows\system32\sc.exe
  sc config RmSvc start=demand
  2⤵
  PID:904
- C:\Windows\system32\sc.exe
  sc config RpcEptMapper start=auto
  2⤵
  PID:2308
- C:\Windows\system32\sc.exe
  sc config RpcLocator start=demand
  2⤵
  PID:1328
- C:\Windows\system32\sc.exe
  sc config RpcSs start=auto
  2⤵
  PID:2872
- C:\Windows\system32\sc.exe
  sc config SCPolicySvc start=demand
  2⤵
  PID:3100
- C:\Windows\system32\sc.exe
  sc config SCardSvr start=demand
  2⤵
  PID:4112
- C:\Windows\system32\sc.exe
  sc config SDRSVC start=demand
  2⤵
  PID:1948
- C:\Windows\system32\sc.exe
  sc config SEMgrSvc start=demand
  2⤵
  PID:2608
- C:\Windows\system32\sc.exe
  sc config SENS start=auto
  2⤵
  PID:3440
- C:\Windows\system32\sc.exe
  sc config SNMPTRAP start=demand
  2⤵
  - Launches sc.exe
  PID:3044
- C:\Windows\system32\sc.exe
  sc config SNMPTrap start=demand
  2⤵
  PID:4948
- C:\Windows\system32\sc.exe
  sc config SSDPSRV start=demand
  2⤵
  - Launches sc.exe
  PID:3912
- C:\Windows\system32\sc.exe
  sc config SamSs start=auto
  2⤵
  PID:4324
- C:\Windows\system32\sc.exe
  sc config ScDeviceEnum start=demand
  2⤵
  PID:2304
- C:\Windows\system32\sc.exe
  sc config Schedule start=auto
  2⤵
  PID:2248
- C:\Windows\system32\sc.exe
  sc config SecurityHealthService start=demand
  2⤵
  PID:376
- C:\Windows\system32\sc.exe
  sc config Sense start=demand
  2⤵
  PID:5056
- C:\Windows\system32\sc.exe
  sc config SensorDataService start=demand
  2⤵
  PID:2320
- C:\Windows\system32\sc.exe
  sc config SensorService start=demand
  2⤵
  PID:3632
- C:\Windows\system32\sc.exe
  sc config SensrSvc start=demand
  2⤵
  PID:4548
- C:\Windows\system32\sc.exe
  sc config SessionEnv start=demand
  2⤵
  PID:4672
- C:\Windows\system32\sc.exe
  sc config SgrmBroker start=auto
  2⤵
  PID:2680
- C:\Windows\system32\sc.exe
  sc config SharedAccess start=demand
  2⤵
  - Launches sc.exe
  PID:4516
- C:\Windows\system32\sc.exe
  sc config SharedRealitySvc start=demand
  2⤵
  PID:2024
- C:\Windows\system32\sc.exe
  sc config ShellHWDetection start=auto
  2⤵
  PID:4032
- C:\Windows\system32\sc.exe
  sc config SmsRouter start=demand
  2⤵
  PID:4240
- C:\Windows\system32\sc.exe
  sc config Spooler start=auto
  2⤵
  PID:2140
- C:\Windows\system32\sc.exe
  sc config SstpSvc start=demand
  2⤵
  PID:860
- C:\Windows\system32\sc.exe
  sc config StateRepository start=demand
  2⤵
  PID:1752
- C:\Windows\system32\sc.exe
  sc config StiSvc start=demand
  2⤵
  PID:5008
- C:\Windows\system32\sc.exe
  sc config StorSvc start=demand
  2⤵
  PID:4544
- C:\Windows\system32\sc.exe
  sc config SysMain start=auto
  2⤵
  PID:2460
- C:\Windows\system32\sc.exe
  sc config SystemEventsBroker start=auto
  2⤵
  PID:4036
- C:\Windows\system32\sc.exe
  sc config TabletInputService start=demand
  2⤵
  PID:212
- C:\Windows\system32\sc.exe
  sc config TapiSrv start=demand
  2⤵
  PID:2880
- C:\Windows\system32\sc.exe
  sc config TermService start=auto
  2⤵
  PID:4720
- C:\Windows\system32\sc.exe
  sc config TextInputManagementService start=demand
  2⤵
  PID:1092
- C:\Windows\system32\sc.exe
  sc config Themes start=auto
  2⤵
  PID:920
- C:\Windows\system32\sc.exe
  sc config TieringEngineService start=demand
  2⤵
  PID:5076
- C:\Windows\system32\sc.exe
  sc config TimeBroker start=demand
  2⤵
  - Launches sc.exe
  PID:5052
- C:\Windows\system32\sc.exe
  sc config TimeBrokerSvc start=demand
  2⤵
  PID:3932
- C:\Windows\system32\sc.exe
  sc config TokenBroker start=demand
  2⤵
  - Launches sc.exe
  PID:1936
- C:\Windows\system32\sc.exe
  sc config TrkWks start=auto
  2⤵
  PID:168
- C:\Windows\system32\sc.exe
  sc config TroubleshootingSvc start=demand
  2⤵
  - Launches sc.exe
  PID:512
- C:\Windows\system32\sc.exe
  sc config TrustedInstaller start=demand
  2⤵
  PID:292
- C:\Windows\system32\sc.exe
  sc config UI0Detect start=demand
  2⤵
  PID:3292
- C:\Windows\system32\sc.exe
  sc config UdkUserSvc_dc2a4 start=demand
  2⤵
  PID:4692
- C:\Windows\system32\sc.exe
  sc config UevAgentService start=disabled
  2⤵
  PID:4988
- C:\Windows\system32\sc.exe
  sc config UmRdpService start=demand
  2⤵
  PID:4424
- C:\Windows\system32\sc.exe
  sc config UnistoreSvc_dc2a4 start=demand
  2⤵
  PID:192
- C:\Windows\system32\sc.exe
  sc config UserDataSvc_dc2a4 start=demand
  2⤵
  PID:216
- C:\Windows\system32\sc.exe
  sc config UserManager start=auto
  2⤵
  PID:2164
- C:\Windows\system32\sc.exe
  sc config UsoSvc start=demand
  2⤵
  PID:1624
- C:\Windows\system32\sc.exe
  sc config VGAuthService start=auto
  2⤵
  PID:4348
- C:\Windows\system32\sc.exe
  sc config VMTools start=auto
  2⤵
  PID:3964
- C:\Windows\system32\sc.exe
  sc config VSS start=demand
  2⤵
  - Launches sc.exe
  PID:3972
- C:\Windows\system32\sc.exe
  sc config VacSvc start=demand
  2⤵
  PID:200
- C:\Windows\system32\sc.exe
  sc config VaultSvc start=auto
  2⤵
  PID:4416
- C:\Windows\system32\sc.exe
  sc config W32Time start=demand
  2⤵
  PID:4712
- C:\Windows\system32\sc.exe
  sc config WEPHOSTSVC start=demand
  2⤵
  PID:3620
- C:\Windows\system32\sc.exe
  sc config WFDSConMgrSvc start=demand
  2⤵
  PID:2144
- C:\Windows\system32\sc.exe
  sc config WMPNetworkSvc start=demand
  2⤵
  PID:3572
- C:\Windows\system32\sc.exe
  sc config WManSvc start=demand
  2⤵
  PID:4108
- C:\Windows\system32\sc.exe
  sc config WPDBusEnum start=demand
  2⤵
  PID:1468
- C:\Windows\system32\sc.exe
  sc config WSService start=demand
  2⤵
  PID:3328
- C:\Windows\system32\sc.exe
  sc config WSearch start=delayed-auto
  2⤵
  PID:880
- C:\Windows\system32\sc.exe
  sc config WaaSMedicSvc start=demand
  2⤵
  PID:4332
- C:\Windows\system32\sc.exe
  sc config WalletService start=demand
  2⤵
  PID:3756
- C:\Windows\system32\sc.exe
  sc config WarpJITSvc start=demand
  2⤵
  PID:5040
- C:\Windows\system32\sc.exe
  sc config WbioSrvc start=demand
  2⤵
  PID:1672
- C:\Windows\system32\sc.exe
  sc config Wcmsvc start=auto
  2⤵
  PID:1908
- C:\Windows\system32\sc.exe
  sc config WcsPlugInService start=demand
  2⤵
  PID:3068
- C:\Windows\system32\sc.exe
  sc config WdNisSvc start=demand
  2⤵
  PID:5088
- C:\Windows\system32\sc.exe
  sc config WdiServiceHost start=demand
  2⤵
  PID:3008
- C:\Windows\system32\sc.exe
  sc config WdiSystemHost start=demand
  2⤵
  PID:4760
- C:\Windows\system32\sc.exe
  sc config WebClient start=demand
  2⤵
  PID:4448
- C:\Windows\system32\sc.exe
  sc config Wecsvc start=demand
  2⤵
  PID:4880
- C:\Windows\system32\sc.exe
  sc config WerSvc start=demand
  2⤵
  - Launches sc.exe
  PID:2780
- C:\Windows\system32\sc.exe
  sc config WiaRpc start=demand
  2⤵
  PID:404
- C:\Windows\system32\sc.exe
  sc config WinDefend start=auto
  2⤵
  PID:1992
- C:\Windows\system32\sc.exe
  sc config WinHttpAutoProxySvc start=demand
  2⤵
  PID:3260
- C:\Windows\system32\sc.exe
  sc config WinRM start=demand
  2⤵
  - Launches sc.exe
  PID:4196
- C:\Windows\system32\sc.exe
  sc config Winmgmt start=auto
  2⤵
  PID:3036
- C:\Windows\system32\sc.exe
  sc config WlanSvc start=auto
  2⤵
  - Launches sc.exe
  PID:3728
- C:\Windows\system32\sc.exe
  sc config WpcMonSvc start=demand
  2⤵
  PID:648
- C:\Windows\system32\sc.exe
  sc config WpnService start=demand
  2⤵
  PID:4912
- C:\Windows\system32\sc.exe
  sc config WpnUserService_dc2a4 start=auto
  2⤵
  - Launches sc.exe
  PID:368
- C:\Windows\system32\sc.exe
  sc config WwanSvc start=demand
  2⤵
  PID:4612
- C:\Windows\system32\sc.exe
  sc config XblAuthManager start=demand
  2⤵
  PID:5000
- C:\Windows\system32\sc.exe
  sc config XblGameSave start=demand
  2⤵
  PID:4380
- C:\Windows\system32\sc.exe
  sc config XboxGipSvc start=demand
  2⤵
  - Launches sc.exe
  PID:5004
- C:\Windows\system32\sc.exe
  sc config XboxNetApiSvc start=demand
  2⤵
  PID:4608
- C:\Windows\system32\sc.exe
  sc config autotimesvc start=demand
  2⤵
  PID:4220
- C:\Windows\system32\sc.exe
  sc config bthserv start=demand
  2⤵
  PID:2540
- C:\Windows\system32\sc.exe
  sc config camsvc start=demand
  2⤵
  PID:2496
- C:\Windows\system32\sc.exe
  sc config cbdhsvc_dc2a4 start=demand
  2⤵
  PID:1948
- C:\Windows\system32\sc.exe
  sc config cloudidsvc start=demand
  2⤵
  PID:2608
- C:\Windows\system32\sc.exe
  sc config dcsvc start=demand
  2⤵
  PID:3440
- C:\Windows\system32\sc.exe
  sc config defragsvc start=demand
  2⤵
  PID:4224
- C:\Windows\system32\sc.exe
  sc config diagnosticshub.standardcollector.service start=demand
  2⤵
  PID:4948
- C:\Windows\system32\sc.exe
  sc config diagsvc start=demand
  2⤵
  PID:3912
- C:\Windows\system32\sc.exe
  sc config dmwappushservice start=demand
  2⤵
  PID:3052
- C:\Windows\system32\sc.exe
  sc config dot3svc start=demand
  2⤵
  - Launches sc.exe
  PID:2224
- C:\Windows\system32\sc.exe
  sc config edgeupdate start=demand
  2⤵
  PID:2800
- C:\Windows\system32\sc.exe
  sc config edgeupdatem start=demand
  2⤵
  PID:5056
- C:\Windows\system32\sc.exe
  sc config embeddedmode start=demand
  2⤵
  - Launches sc.exe
  PID:5048
- C:\Windows\system32\sc.exe
  sc config fdPHost start=demand
  2⤵
  PID:3000
- C:\Windows\system32\sc.exe
  sc config fhsvc start=demand
  2⤵
  PID:4548
- C:\Windows\system32\sc.exe
  sc config gpsvc start=auto
  2⤵
  PID:4672
- C:\Windows\system32\sc.exe
  sc config hidserv start=demand
  2⤵
  PID:2680
- C:\Windows\system32\sc.exe
  sc config icssvc start=demand
  2⤵
  PID:4516
- C:\Windows\system32\sc.exe
  sc config iphlpsvc start=auto
  2⤵
  - Launches sc.exe
  PID:2024
- C:\Windows\system32\sc.exe
  sc config lfsvc start=demand
  2⤵
  PID:4032
- C:\Windows\system32\sc.exe
  sc config lltdsvc start=demand
  2⤵
  PID:4240
- C:\Windows\system32\sc.exe
  sc config lmhosts start=demand
  2⤵
  PID:2140
- C:\Windows\system32\sc.exe
  sc config mpssvc start=auto
  2⤵
  PID:860
- C:\Windows\system32\sc.exe
  sc config msiserver start=demand
  2⤵
  PID:1376
- C:\Windows\system32\sc.exe
  sc config netprofm start=demand
  2⤵
  PID:4040
- C:\Windows\system32\sc.exe
  sc config nsi start=auto
  2⤵
  PID:8
- C:\Windows\system32\sc.exe
  sc config p2pimsvc start=demand
  2⤵
  PID:4228
- C:\Windows\system32\sc.exe
  sc config p2psvc start=demand
  2⤵
  PID:2672
- C:\Windows\system32\sc.exe
  sc config perceptionsimulation start=demand
  2⤵
  PID:212
- C:\Windows\system32\sc.exe
  sc config pla start=demand
  2⤵
  PID:2236
- C:\Windows\system32\sc.exe
  sc config seclogon start=demand
  2⤵
  PID:4720
- C:\Windows\system32\sc.exe
  sc config shpamsvc start=disabled
  2⤵
  PID:1092
- C:\Windows\system32\sc.exe
  sc config smphost start=demand
  2⤵
  PID:920
- C:\Windows\system32\sc.exe
  sc config spectrum start=demand
  2⤵
  PID:5076
- C:\Windows\system32\sc.exe
  sc config sppsvc start=delayed-auto
  2⤵
  PID:5052
- C:\Windows\system32\sc.exe
  sc config ssh-agent start=disabled
  2⤵
  PID:4972
- C:\Windows\system32\sc.exe
  sc config svsvc start=demand
  2⤵
  - Launches sc.exe
  PID:3768
- C:\Windows\system32\sc.exe
  sc config swprv start=demand
  2⤵
  PID:2244
- C:\Windows\system32\sc.exe
  sc config tiledatamodelsvc start=auto
  2⤵
  - Launches sc.exe
  PID:1444
- C:\Windows\system32\sc.exe
  sc config tzautoupdate start=disabled
  2⤵
  PID:292
- C:\Windows\system32\sc.exe
  sc config uhssvc start=disabled
  2⤵
  PID:3292
- C:\Windows\system32\sc.exe
  sc config upnphost start=demand
  2⤵
  PID:4940
- C:\Windows\system32\sc.exe
  sc config vds start=demand
  2⤵
  PID:4988
- C:\Windows\system32\sc.exe
  sc config vm3dservice start=demand
  2⤵
  PID:4424
- C:\Windows\system32\sc.exe
  sc config vmicguestinterface start=demand
  2⤵
  PID:192
- C:\Windows\system32\sc.exe
  sc config vmicheartbeat start=demand
  2⤵
  PID:1552
- C:\Windows\system32\sc.exe
  sc config vmickvpexchange start=demand
  2⤵
  PID:2820
- C:\Windows\system32\sc.exe
  sc config vmicrdv start=demand
  2⤵
  PID:2192
- C:\Windows\system32\sc.exe
  sc config vmicshutdown start=demand
  2⤵
  PID:4460
- C:\Windows\system32\sc.exe
  sc config vmictimesync start=demand
  2⤵
  PID:2520
- C:\Windows\system32\sc.exe
  sc config vmicvmsession start=demand
  2⤵
  PID:5036
- C:\Windows\system32\sc.exe
  sc config vmicvss start=demand
  2⤵
  PID:4960
- C:\Windows\system32\sc.exe
  sc config vmvss start=demand
  2⤵
  PID:200
- C:\Windows\system32\sc.exe
  sc config wbengine start=demand
  2⤵
  PID:4416
- C:\Windows\system32\sc.exe
  sc config wcncsvc start=demand
  2⤵
  PID:4712
- C:\Windows\system32\sc.exe
  sc config webthreatdefsvc start=demand
  2⤵
  PID:4392
- C:\Windows\system32\sc.exe
  sc config webthreatdefusersvc_dc2a4 start=auto
  2⤵
  PID:708
- C:\Windows\system32\sc.exe
  sc config wercplsupport start=demand
  2⤵
  PID:4528
- C:\Windows\system32\sc.exe
  sc config wisvc start=demand
  2⤵
  PID:3436
- C:\Windows\system32\sc.exe
  sc config wlidsvc start=demand
  2⤵
  PID:2984
- C:\Windows\system32\sc.exe
  sc config wlpasvc start=demand
  2⤵
  PID:5100
- C:\Windows\system32\sc.exe
  sc config wmiApSrv start=demand
  2⤵
  - Launches sc.exe
  PID:2748
- C:\Windows\system32\sc.exe
  sc config workfolderssvc start=demand
  2⤵
  PID:1148
- C:\Windows\system32\sc.exe
  sc config wscsvc start=delayed-auto
  2⤵
  PID:2044
- C:\Windows\system32\sc.exe
  sc config wuauserv start=demand
  2⤵
  PID:4796
- C:\Windows\system32\sc.exe
  sc config wudfsvc start=demand
  2⤵
  - Launches sc.exe
  PID:4444
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:1912
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:716
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable
  2⤵
  PID:2316
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable
  2⤵
  PID:4932
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Autochk\Proxy" /Disable
  2⤵
  PID:4760
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable
  2⤵
  PID:2652
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable
  2⤵
  PID:3060
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable
  2⤵
  PID:404
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClient" /Disable
  2⤵
  PID:2188
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /Disable
  2⤵
  PID:3820
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Windows Error Reporting\QueueReporting" /Disable
  2⤵
  PID:4216
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Application Experience\MareBackup" /Disable
  2⤵
  PID:3728
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /Disable
  2⤵
  PID:3460
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Application Experience\PcaPatchDbTask" /Disable
  2⤵
  PID:1476
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Maps\MapsUpdateTask" /Disable
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
  2⤵
  PID:4540
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v ContentDeliveryAllowed /t REG_DWORD /d 0 /f
  2⤵
  PID:2872
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v OemPreInstalledAppsEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:4220
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v PreInstalledAppsEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2004
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v PreInstalledAppsEverEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:3740
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SilentInstalledAppsEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:3444
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338387Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:3440
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338388Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:4224
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-338389Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SubscribedContent-353698Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2304
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SystemPaneSuggestionsEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:4936
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableWindowsConsumerFeatures /t REG_DWORD /d 1 /f
  2⤵
  PID:4688
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Siuf\Rules" /v NumberOfSIUFInPeriod /t REG_DWORD /d 0 /f
  2⤵
  PID:2320
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v DoNotShowFeedbackNotifications /t REG_DWORD /d 1 /f
  2⤵
  PID:3632
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\CloudContent" /v DisableTailoredExperiencesWithDiagnosticData /t REG_DWORD /d 1 /f
  2⤵
  PID:1388
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" /v DisabledByGroupPolicy /t REG_DWORD /d 1 /f
  2⤵
  PID:4548
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
  2⤵
  PID:3996
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config" /v DODownloadMode /t REG_DWORD /d 1 /f
  2⤵
  PID:2564
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v fAllowToGetHelp /t REG_DWORD /d 0 /f
  2⤵
  PID:2024
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\OperationStatusManager" /v EnthusiastMode /t REG_DWORD /d 1 /f
  2⤵
  PID:1512
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowTaskViewButton /t REG_DWORD /d 0 /f
  2⤵
  PID:764
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People" /v PeopleBand /t REG_DWORD /d 0 /f
  2⤵
  PID:1000
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v LaunchTo /t REG_DWORD /d 1 /f
  2⤵
  PID:1376
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v LongPathsEnabled /t REG_DWORD /d 1 /f
  2⤵
  PID:4040
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching" /v SearchOrderConfig /t REG_DWORD /d 1 /f
  2⤵
  PID:396
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v SystemResponsiveness /t REG_DWORD /d 0 /f
  2⤵
  PID:4568
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" /v NetworkThrottlingIndex /t REG_DWORD /d 4294967295 /f
  2⤵
  PID:1872
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v MenuShowDelay /t REG_DWORD /d 1 /f
  2⤵
  PID:2236
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Desktop" /v AutoEndTasks /t REG_DWORD /d 1 /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v ClearPageFileAtShutdown /t REG_DWORD /d 0 /f
  2⤵
  PID:2512
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\ControlSet001\Services\Ndu" /v Start /t REG_DWORD /d 2 /f
  2⤵
  PID:4732
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Mouse" /v MouseHoverTime /t REG_SZ /d 400 /f
  2⤵
  PID:5052
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v IRPStackSize /t REG_DWORD /d 30 /f
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Windows Feeds" /v EnableFeeds /t REG_DWORD /d 0 /f
  2⤵
  PID:4464
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Feeds" /v ShellFeedsTaskbarViewMode /t REG_DWORD /d 2 /f
  2⤵
  PID:652
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v HideSCAMeetNow /t REG_DWORD /d 1 /f
  2⤵
  PID:292
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "GPU Priority" /t REG_DWORD /d 8 /f
  2⤵
  PID:4888
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v Priority /t REG_DWORD /d 6 /f
  2⤵
  PID:1568
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile\Tasks\Games" /v "Scheduling Category" /t REG_SZ /d High /f
  2⤵
  PID:5060
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement" /v "ScoobeSystemSettingEnabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:192
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:4428
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootmenupolicy Legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild 2>nul | findstr /r /c:"CurrentBuild"
  2⤵
  PID:4564
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
    3⤵
    PID:2196
- - C:\Windows\system32\findstr.exe
    findstr /r /c:"CurrentBuild"
    3⤵
    PID:220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Start-Process taskmgr.exe -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- - C:\Windows\system32\Taskmgr.exe
    "C:\Windows\system32\Taskmgr.exe"
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5032
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  PID:4356
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences
  2⤵
  PID:3044
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:660
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\TaskManager" /v Preferences /t REG_BINARY /d 0000000000000000000000000000000000000000000000000000000000000000 /f
  2⤵
  PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Remove-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\{0DB7E03F-FC29-4DC6-9020-FF41B59E513A}' -Recurse -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "(Get-CimInstance -ClassName Win32_PhysicalMemory | Measure-Object -Property Capacity -Sum).Sum / 1kb"
  2⤵
  PID:5008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_PhysicalMemory | Measure-Object -Property Capacity -Sum).Sum / 1kb"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control' -Name 'SvcHostSplitThresholdInKB' -Type DWord -Value 4194304 -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Windows\system32\icacls.exe
  icacls "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger" /deny SYSTEM:(OI)(CI)F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:1604
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3100
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:4420
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:4884
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4356
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:816
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4236
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:1648
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:1492
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3824
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\WinHttpAutoProxySvc" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:4632
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\BcastDVRUserService" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:3912
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\xbgm" /v "Start" /t REG_DWORD /d "4" /f
  2⤵
  PID:660
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AppCaptureEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:4992
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AudioCaptureEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "CursorCaptureEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:5084
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "MicrophoneCaptureEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:3632
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v "GameDVR_FSEBehavior" /t REG_DWORD /d "2" /f
  2⤵
  PID:4312
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v "GameDVR_HonorUserFSEBehaviorMode" /t REG_DWORD /d "2" /f
  2⤵
  PID:5048
- C:\Windows\system32\reg.exe
  reg add "HKCU\System\GameConfigStore" /v "GameDVR_Enabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2136
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\GameDVR" /v "AllowgameDVR" /t REG_DWORD /d "0" /f
  2⤵
  PID:1812
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\GameBar" /v "AutoGameModeEnabled" /t REG_DWORD /d "0" /f
  2⤵
  PID:2456
- C:\Windows\system32\sc.exe
  sc config wlidsvc start= disabled
  2⤵
  PID:3996
- C:\Windows\system32\sc.exe
  sc config DisplayEnhancementService start= disabled
  2⤵
  - Launches sc.exe
  PID:5044
- C:\Windows\system32\sc.exe
  sc config DiagTrack start= disabled
  2⤵
  PID:4240
- C:\Windows\system32\sc.exe
  sc config DusmSvc start= disabled
  2⤵
  PID:8
- C:\Windows\system32\sc.exe
  sc config TabletInputService start= disabled
  2⤵
  PID:1376
- C:\Windows\system32\sc.exe
  sc config RetailDemo start= disabled
  2⤵
  PID:4040
- C:\Windows\system32\sc.exe
  sc config Fax start= disabled
  2⤵
  PID:2880
- C:\Windows\system32\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  PID:4568
- C:\Windows\system32\sc.exe
  sc config lfsvc start= disabled
  2⤵
  PID:3600
- C:\Windows\system32\sc.exe
  sc config WpcMonSvc start= disabled
  2⤵
  PID:2224
- C:\Windows\system32\sc.exe
  sc config SessionEnv start= disabled
  2⤵
  PID:3064
- C:\Windows\system32\sc.exe
  sc config MicrosoftEdgeElevationService start= disabled
  2⤵
  PID:2032
- C:\Windows\system32\sc.exe
  sc config edgeupdate start= disabled
  2⤵
  PID:3624
- C:\Windows\system32\sc.exe
  sc config edgeupdatem start= disabled
  2⤵
  PID:4464
- C:\Windows\system32\sc.exe
  sc config autotimesvc start= disabled
  2⤵
  PID:3196
- C:\Windows\system32\sc.exe
  sc config CscService start= disabled
  2⤵
  PID:4692
- C:\Windows\system32\sc.exe
  sc config TermService start= disabled
  2⤵
  PID:4988
- C:\Windows\system32\sc.exe
  sc config SensorDataService start= disabled
  2⤵
  PID:2924
- C:\Windows\system32\sc.exe
  sc config SensorService start= disabled
  2⤵
  PID:5076
- C:\Windows\system32\sc.exe
  sc config SensrSvc start= disabled
  2⤵
  PID:1880
- C:\Windows\system32\sc.exe
  sc config shpamsvc start= disabled
  2⤵
  PID:1872
- C:\Windows\system32\sc.exe
  sc config diagnosticshub.standardcollector.service start= disabled
  2⤵
  PID:3932
- C:\Windows\system32\sc.exe
  sc config PhoneSvc start= disabled
  2⤵
  PID:4732
- C:\Windows\system32\sc.exe
  sc config TapiSrv start= disabled
  2⤵
  PID:4940
- C:\Windows\system32\sc.exe
  sc config UevAgentService start= disabled
  2⤵
  PID:4180
- C:\Windows\system32\sc.exe
  sc config WalletService start= disabled
  2⤵
  PID:192
- C:\Windows\system32\sc.exe
  sc config TokenBroker start= disabled
  2⤵
  PID:4348
- C:\Windows\system32\sc.exe
  sc config WebClient start= disabled
  2⤵
  PID:2020
- C:\Windows\system32\sc.exe
  sc config MixedRealityOpenXRSvc start= disabled
  2⤵
  PID:3328
- C:\Windows\system32\sc.exe
  sc config stisvc start= disabled
  2⤵
  PID:5100
- C:\Windows\system32\sc.exe
  sc config WbioSrvc start= disabled
  2⤵
  PID:2768
- C:\Windows\system32\sc.exe
  sc config icssvc start= disabled
  2⤵
  PID:1148
- C:\Windows\system32\sc.exe
  sc config Wecsvc start= disabled
  2⤵
  PID:4528
- C:\Windows\system32\sc.exe
  sc config XboxGipSvc start= disabled
  2⤵
  PID:3508
- C:\Windows\system32\sc.exe
  sc config XblAuthManager start= disabled
  2⤵
  PID:4392
- C:\Windows\system32\sc.exe
  sc config XboxNetApiSvc start= disabled
  2⤵
  PID:3020
- C:\Windows\system32\sc.exe
  sc config XblGameSave start= disabled
  2⤵
  PID:4796
- C:\Windows\system32\sc.exe
  sc config SEMgrSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3436
- C:\Windows\system32\sc.exe
  sc config iphlpsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3464
- C:\Windows\system32\sc.exe
  sc config Backupper Service start= disabled
  2⤵
  PID:3960
- C:\Windows\system32\sc.exe
  sc config BthAvctpSvc start= disabled
  2⤵
  PID:4916
- C:\Windows\system32\sc.exe
  sc config BDESVC start= disabled
  2⤵
  PID:4564
- C:\Windows\system32\sc.exe
  sc config cbdhsvc start= disabled
  2⤵
  PID:4712
- C:\Windows\system32\sc.exe
  sc config CDPSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5036
- C:\Windows\system32\sc.exe
  sc config CDPUserSvc start= disabled
  2⤵
  PID:3972
- C:\Windows\system32\sc.exe
  sc config DevQueryBroker start= disabled
  2⤵
  - Launches sc.exe
  PID:2820
- C:\Windows\system32\sc.exe
  sc config DevicesFlowUserSvc start= disabled
  2⤵
  PID:1604
- C:\Windows\system32\sc.exe
  sc config dmwappushservice start= disabled
  2⤵
  - Launches sc.exe
  PID:2872
- C:\Windows\system32\sc.exe
  sc config DispBrokerDesktopSvc start= disabled
  2⤵
  PID:3740
- C:\Windows\system32\sc.exe
  sc config TrkWks start= disabled
  2⤵
  PID:828
- C:\Windows\system32\sc.exe
  sc config dLauncherLoopback start= disabled
  2⤵
  - Launches sc.exe
  PID:3440
- C:\Windows\system32\sc.exe
  sc config EFS start= disabled
  2⤵
  PID:2268
- C:\Windows\system32\sc.exe
  sc config fdPHost start= disabled
  2⤵
  PID:4880
- C:\Windows\system32\sc.exe
  sc config FDResPub start= disabled
  2⤵
  PID:3032
- C:\Windows\system32\sc.exe
  sc config IKEEXT start= disabled
  2⤵
  PID:5088
- C:\Windows\system32\sc.exe
  sc config NPSMSvc start= disabled
  2⤵
  PID:1648
- C:\Windows\system32\sc.exe
  sc config WPDBusEnum start= disabled
  2⤵
  PID:1492
- C:\Windows\system32\sc.exe
  sc config PcaSvc start= disabled
  2⤵
  PID:3824
- C:\Windows\system32\sc.exe
  sc config RasMan start= disabled
  2⤵
  PID:2780
- C:\Windows\system32\sc.exe
  sc config RetailDemo start=disabled
  2⤵
  PID:2112
- C:\Windows\system32\sc.exe
  sc config SstpSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:436
- C:\Windows\system32\sc.exe
  sc config ShellHWDetection start= disabled
  2⤵
  - Launches sc.exe
  PID:2800
- C:\Windows\system32\sc.exe
  sc config SSDPSRV start= disabled
  2⤵
  PID:4548
- C:\Windows\system32\sc.exe
  sc config SysMain start= disabled
  2⤵
  - Launches sc.exe
  PID:2148
- C:\Windows\system32\sc.exe
  sc config OneSyncSvc start= disabled
  2⤵
  PID:2596
- C:\Windows\system32\sc.exe
  sc config lmhosts start= disabled
  2⤵
  PID:3632
- C:\Windows\system32\sc.exe
  sc config UserDataSvc start= disabled
  2⤵
  PID:3732
- C:\Windows\system32\sc.exe
  sc config UnistoreSvc start= disabled
  2⤵
  PID:2320
- C:\Windows\system32\sc.exe
  sc config Wcmsvc start= disabled
  2⤵
  PID:5048
- C:\Windows\system32\sc.exe
  sc config FontCache start= disabled
  2⤵
  PID:1512
- C:\Windows\system32\sc.exe
  sc config W32Time start= disabled
  2⤵
  PID:4600
- C:\Windows\system32\sc.exe
  sc config tzautoupdate start= disabled
  2⤵
  PID:2564
- C:\Windows\system32\sc.exe
  sc config DsSvc start= disabled
  2⤵
  PID:2680
- C:\Windows\system32\sc.exe
  sc config DevicesFlowUserSvc_5f1ad start= disabled
  2⤵
  PID:4032
- C:\Windows\system32\sc.exe
  sc config diagsvc start= disabled
  2⤵
  PID:2668
- C:\Windows\system32\sc.exe
  sc config DialogBlockingService start= disabled
  2⤵
  - Launches sc.exe
  PID:1888
- C:\Windows\system32\sc.exe
  sc config PimIndexMaintenanceSvc_5f1ad start= disabled
  2⤵
  PID:8
- C:\Windows\system32\sc.exe
  sc config MessagingService_5f1ad start= disabled
  2⤵
  PID:4544
- C:\Windows\system32\sc.exe
  sc config AppVClient start= disabled
  2⤵
  PID:760
- C:\Windows\system32\sc.exe
  sc config MsKeyboardFilter start= disabled
  2⤵
  PID:4728
- C:\Windows\system32\sc.exe
  sc config NetTcpPortSharing start= disabled
  2⤵
  PID:4036
- C:\Windows\system32\sc.exe
  sc config ssh-agent start= disabled
  2⤵
  PID:396
- C:\Windows\system32\sc.exe
  sc config SstpSvc start= disabled
  2⤵
  PID:680
- C:\Windows\system32\sc.exe
  sc config OneSyncSvc_5f1ad start= disabled
  2⤵
  PID:3064
- C:\Windows\system32\sc.exe
  sc config wercplsupport start= disabled
  2⤵
  PID:5080
- C:\Windows\system32\sc.exe
  sc config WMPNetworkSvc start= disabled
  2⤵
  PID:512
- C:\Windows\system32\sc.exe
  sc config WerSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1936
- C:\Windows\system32\sc.exe
  sc config WpnUserService_5f1ad start= disabled
  2⤵
  PID:3292
- C:\Windows\system32\sc.exe
  sc config WinHttpAutoProxySvc start= disabled
  2⤵
  PID:4888
- C:\Windows\system32\schtasks.exe
  schtasks /DELETE /TN "AMDInstallLauncher" /f
  2⤵
  PID:4424
- C:\Windows\system32\schtasks.exe
  schtasks /DELETE /TN "AMDLinkUpdate" /f
  2⤵
  PID:2924
- C:\Windows\system32\schtasks.exe
  schtasks /DELETE /TN "AMDRyzenMasterSDKTask" /f
  2⤵
  PID:4644
- C:\Windows\system32\schtasks.exe
  schtasks /DELETE /TN "Driver Easy Scheduled Scan" /f
  2⤵
  PID:920
- C:\Windows\system32\schtasks.exe
  schtasks /DELETE /TN "ModifyLinkUpdate" /f
  2⤵
  PID:3932
- C:\Windows\system32\schtasks.exe
  schtasks /DELETE /TN "SoftMakerUpdater" /f
  2⤵
  PID:1568
- C:\Windows\system32\schtasks.exe
  schtasks /DELETE /TN "StartCN" /f
  2⤵
  PID:1552
- C:\Windows\system32\schtasks.exe
  schtasks /DELETE /TN "StartDVR" /f
  2⤵
  PID:192
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable
  2⤵
  PID:4416
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Application Experience\PcaPatchDbTask" /Disable
  2⤵
  PID:2120
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable
  2⤵
  PID:2748
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /Disable
  2⤵
  PID:4924
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Autochk\Proxy" /Disable
  2⤵
  PID:2984
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable
  2⤵
  PID:4528
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable
  2⤵
  PID:2220
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Defrag\ScheduledDefrag" /Disable
  2⤵
  PID:4684
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Device Information\Device" /Disable
  2⤵
  PID:4444
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Device Information\Device User" /Disable
  2⤵
  PID:1740
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner" /Disable
  2⤵
  PID:3964
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Diagnosis\Scheduled" /Disable
  2⤵
  PID:3960
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\DiskCleanup\SilentCleanup" /Disable
  2⤵
  PID:4460
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable
  2⤵
  PID:4332
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\DiskFootprint\Diagnostics" /Disable
  2⤵
  PID:5036
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\DiskFootprint\StorageSense" /Disable
  2⤵
  PID:1500
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\DUSM\dusmtask" /Disable
  2⤵
  PID:2600
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\EnterpriseMgmt\MDMMaintenenceTask" /Disable
  2⤵
  PID:3100
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClient" /Disable
  2⤵
  PID:4420
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /Disable
  2⤵
  PID:4884
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\FileHistory\File History (maintenance mode)" /Disable
  2⤵
  PID:3440
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures" /Disable
  2⤵
  PID:4868
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\UsageDataFlushing" /Disable
  2⤵
  PID:1908
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\UsageDataReporting" /Disable
  2⤵
  PID:352
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Flighting\OneSettings\RefreshCache" /Disable
  2⤵
  PID:4932
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Input\LocalUserSyncDataAvailable" /Disable
  2⤵
  PID:504
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Input\MouseSyncDataAvailable" /Disable
  2⤵
  PID:3824
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Input\PenSyncDataAvailable" /Disable
  2⤵
  PID:2780
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Input\TouchpadSyncDataAvailable" /Disable
  2⤵
  PID:2112
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\International\Synchronize Language Settings" /Disable
  2⤵
  PID:436
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\Installation" /Disable
  2⤵
  PID:1972
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\ReconcileLanguageResources" /Disable
  2⤵
  PID:5084
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\Uninstallation" /Disable
  2⤵
  PID:2596
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\License Manager\TempSignedLicenseExchange" /Disable
  2⤵
  PID:4312
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\License Manager\TempSignedLicenseExchange" /Disable
  2⤵
  PID:764
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Management\Provisioning\Cellular" /Disable
  2⤵
  PID:5048
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Management\Provisioning\Logon" /Disable
  2⤵
  PID:2024
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Maintenance\WinSAT" /Disable
  2⤵
  PID:4516
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Maps\MapsToastTask" /Disable
  2⤵
  PID:3736
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Maps\MapsUpdateTask" /Disable
  2⤵
  PID:4032
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser" /Disable
  2⤵
  PID:2668
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\MUI\LPRemove" /Disable
  2⤵
  PID:1376
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\NetTrace\GatherNetworkInfo" /Disable
  2⤵
  PID:212
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\PI\Sqm-Tasks" /Disable
  2⤵
  PID:32
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /Disable
  2⤵
  PID:4568
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\PushToInstall\Registration" /Disable
  2⤵
  PID:3600
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Ras\MobilityManager" /Disable
  2⤵
  PID:396
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /Disable
  2⤵
  PID:4720
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask" /Disable
  2⤵
  PID:4752
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\RetailDemo\CleanupOfflineContent" /Disable
  2⤵
  PID:512
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Servicing\StartComponentCleanup" /Disable
  2⤵
  PID:2572
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\SettingSync\NetworkStateChangeTask" /Disable
  2⤵
  PID:4692
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Setup\SetupCleanupTask" /Disable
  2⤵
  PID:4988
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Setup\SnapshotCleanupTask" /Disable
  2⤵
  PID:2512
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\SpacePort\SpaceAgentTask" /Disable
  2⤵
  PID:1880
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\SpacePort\SpaceManagerTask" /Disable
  2⤵
  PID:1872
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Speech\SpeechModelDownloadTask" /Disable
  2⤵
  PID:3932
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Storage Tiers Management\Storage Tiers Management Initialization" /Disable
  2⤵
  PID:1568
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Sysmain\ResPriStaticDbSync" /Disable
  2⤵
  PID:1552
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Sysmain\WsSwapAssessmentTask" /Disable
  2⤵
  PID:192
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Task Manager\Interactive" /Disable
  2⤵
  PID:4416
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Time Synchronization\ForceSynchronizeTime" /Disable
  2⤵
  PID:2120
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Time Synchronization\SynchronizeTime" /Disable
  2⤵
  PID:2748
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Time Zone\SynchronizeTimeZone" /Disable
  2⤵
  PID:4924
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\TPM\Tpm-HASCertRetr" /Disable
  2⤵
  PID:2984
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\TPM\Tpm-Maintenance" /Disable
  2⤵
  PID:4528
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\UPnP\UPnPHostConfig" /Disable
  2⤵
  PID:2220
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\User Profile Service\HiveUploadTask" /Disable
  2⤵
  PID:4684
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\WDI\ResolutionHost" /Disable
  2⤵
  PID:4444
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange" /Disable
  2⤵
  PID:1740
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\WOF\WIM-Hash-Management" /Disable
  2⤵
  PID:3964
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\WOF\WIM-Hash-Validation" /Disable
  2⤵
  PID:3960
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Work Folders\Work Folders Logon Synchronization" /Disable
  2⤵
  PID:4460
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Work Folders\Work Folders Maintenance Work" /Disable
  2⤵
  PID:4332
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Workplace Join\Automatic-Device-Join" /Disable
  2⤵
  PID:5036
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\WwanSvc\NotificationTask" /Disable
  2⤵
  PID:1500
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\WwanSvc\OobeDiscovery" /Disable
  2⤵
  PID:2600
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /Disable
  2⤵
  PID:3100
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:4420
- C:\Windows\system32\sc.exe
  sc stop uhssvc
  2⤵
  - Launches sc.exe
  PID:4884
- C:\Windows\system32\sc.exe
  sc stop upfc
  2⤵
  - Launches sc.exe
  PID:3440
- C:\Windows\system32\sc.exe
  sc stop PushToInstall
  2⤵
  PID:4880
- C:\Windows\system32\sc.exe
  sc stop BITS
  2⤵
  PID:1912
- C:\Windows\system32\sc.exe
  sc stop InstallService
  2⤵
  PID:3008
- C:\Windows\system32\sc.exe
  sc stop uhssvc
  2⤵
  PID:508
- C:\Windows\system32\sc.exe
  sc stop UsoSvc
  2⤵
  PID:4932
- C:\Windows\system32\sc.exe
  sc stop wuauserv
  2⤵
  PID:504
- C:\Windows\system32\sc.exe
  sc stop LanmanServer
  2⤵
  PID:4632
- C:\Windows\system32\sc.exe
  sc config BITS start= disabled
  2⤵
  PID:3012
- C:\Windows\system32\sc.exe
  sc config InstallService start= disabled
  2⤵
  PID:3052
- C:\Windows\system32\sc.exe
  sc config uhssvc start= disabled
  2⤵
  PID:2112
- C:\Windows\system32\sc.exe
  sc config UsoSvc start= disabled
  2⤵
  PID:1388
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  PID:2676
- C:\Windows\system32\sc.exe
  sc config LanmanServer start= disabled
  2⤵
  PID:1712
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DoSvc" /v Start /t reg_dword /d 4 /f
  2⤵
  PID:5084
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InstallService" /v Start /t reg_dword /d 4 /f
  2⤵
  PID:2596
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsoSvc" /v Start /t reg_dword /d 4 /f
  2⤵
  PID:4312
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v Start /t reg_dword /d 4 /f
  2⤵
  - Modifies security service
  PID:764
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t reg_dword /d 4 /f
  2⤵
  PID:5048
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v Start /t reg_dword /d 4 /f
  2⤵
  PID:2024
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upfc" /v Start /t reg_dword /d 4 /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\uhssvc" /v Start /t reg_dword /d 4 /f
  2⤵
  PID:3736
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ossrs" /v Start /t reg_dword /d 4 /f
  2⤵
  PID:4032
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferUpdatePeriod" /t REG_DWORD /d "1" /f
  2⤵
  PID:2668
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferUpgrade" /t REG_DWORD /d "1" /f
  2⤵
  PID:1376
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DeferUpgradePeriod" /t REG_DWORD /d "1" /f
  2⤵
  PID:212
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DisableWindowsUpdateAccess" /t REG_DWORD /d "1" /f
  2⤵
  PID:32
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\InstallService\ScanForUpdates" /Disable
  2⤵
  PID:4568
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\InstallService\ScanForUpdatesAsUser" /Disable
  2⤵
  PID:3600
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\InstallService\SmartRetry" /Disable
  2⤵
  PID:396
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\InstallService\WakeUpAndContinueUpdates" /Disable
  2⤵
  PID:4720
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\InstallService\WakeUpAndScanForUpdates" /Disable
  2⤵
  PID:4752
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\UpdateOrchestrator\Report policies" /Disable
  2⤵
  PID:512
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable
  2⤵
  PID:2572
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable
  2⤵
  PID:4692
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\UpdateOrchestrator\UpdateModelTask" /Disable
  2⤵
  PID:4988
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable
  2⤵
  PID:2512
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable
  2⤵
  PID:1880
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable
  2⤵
  PID:3724
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:920
- C:\Windows\system32\sc.exe
  sc config RemoteRegistry start= disabled
  2⤵
  PID:4808
- C:\Windows\system32\sc.exe
  sc config RemoteAccess start= disabled
  2⤵
  PID:5072
- C:\Windows\system32\sc.exe
  sc config WinRM start= disabled
  2⤵
  PID:4908
- C:\Windows\system32\sc.exe
  sc config RmSvc start= disabled
  2⤵
  PID:2236
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:1332
- C:\Windows\system32\sc.exe
  sc config PrintNotify start= disabled
  2⤵
  PID:1624
- C:\Windows\system32\sc.exe
  sc config Spooler start= disabled
  2⤵
  PID:1468
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Printing\EduPrintProv" /Disable
  2⤵
  PID:3328
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Printing\PrinterCleanupTask" /Disable
  2⤵
  PID:5100
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:3108
- C:\Windows\system32\sc.exe
  sc config PrintNotify start= disabled
  2⤵
  PID:4620
- C:\Windows\system32\sc.exe
  sc config Spooler start= disabled
  2⤵
  PID:4924
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:708
- C:\Windows\system32\sc.exe
  sc config NlaSvc start= disabled
  2⤵
  PID:4528
- C:\Windows\system32\sc.exe
  sc config LanmanWorkstation start= disabled
  2⤵
  PID:3020
- C:\Windows\system32\sc.exe
  sc config BFE start= demand
  2⤵
  PID:2044
- C:\Windows\system32\sc.exe
  sc config Dnscache start= demand
  2⤵
  PID:2196
- C:\Windows\system32\sc.exe
  sc config WinHttpAutoProxySvc start= demand
  2⤵
  - Launches sc.exe
  PID:3212
- C:\Windows\system32\sc.exe
  sc config Dhcp start= auto
  2⤵
  PID:1740
- C:\Windows\system32\sc.exe
  sc config DPS start= auto
  2⤵
  PID:3964
- C:\Windows\system32\sc.exe
  sc config lmhosts start= disabled
  2⤵
  PID:3960
- C:\Windows\system32\sc.exe
  sc config nsi start= auto
  2⤵
  PID:4712
- C:\Windows\system32\sc.exe
  sc config Wcmsvc start= disabled
  2⤵
  PID:3972
- C:\Windows\system32\sc.exe
  sc config Winmgmt start= auto
  2⤵
  PID:2820
- C:\Windows\system32\sc.exe
  sc config WlanSvc start= demand
  2⤵
  - Launches sc.exe
  PID:1604
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator" /v "NoActiveProbe" /t REG_DWORD /d "1" /f
  2⤵
  PID:1500
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\NlaSvc\Parameters\Internet" /v "EnableActiveProbing" /t REG_DWORD /d "0" /f
  2⤵
  PID:2600
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\WlanSvc\CDSSync" /Disable
  2⤵
  PID:3100
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\WCM\WiFiTask" /Disable
  2⤵
  PID:4420
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\NlaSvc\WiFiTask" /Disable
  2⤵
  PID:4884
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\DUSM\dusmtask" /Disable
  2⤵
  PID:4868
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:3032
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3008
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:2828
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4524
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:3824
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:660
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:4992
- C:\Windows\system32\sc.exe
  sc config ALG start=disabled
  2⤵
  PID:1388
- C:\Windows\system32\sc.exe
  sc config AJRouter start=disabled
  2⤵
  PID:3800
- C:\Windows\system32\sc.exe
  sc config XblAuthManager start=disabled
  2⤵
  - Launches sc.exe
  PID:376
- C:\Windows\system32\sc.exe
  sc config XblGameSave start=disabled
  2⤵
  PID:1752
- C:\Windows\system32\sc.exe
  sc config XboxNetApiSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:2320
- C:\Windows\system32\sc.exe
  sc config WSearch start=disabled
  2⤵
  PID:1512
- C:\Windows\system32\sc.exe
  sc config lfsvc start=disabled
  2⤵
  - Launches sc.exe
  PID:2456
- C:\Windows\system32\sc.exe
  sc config RemoteRegistry start=disabled
  2⤵
  - Launches sc.exe
  PID:5048
- C:\Windows\system32\sc.exe
  sc config WpcMonSvc start=disabled
  2⤵
  PID:2024
- C:\Windows\system32\sc.exe
  sc config SEMgrSvc start=disabled
  2⤵
  PID:2680
- C:\Windows\system32\sc.exe
  sc config SCardSvr start=disabled
  2⤵
  PID:2248
- C:\Windows\system32\sc.exe
  sc config Netlogon start=disabled
  2⤵
  PID:1888
- C:\Windows\system32\sc.exe
  sc config CscService start=disabled
  2⤵
  PID:8
- C:\Windows\system32\sc.exe
  sc config icssvc start=disabled
  2⤵
  PID:2668
- C:\Windows\system32\sc.exe
  sc config wisvc start=disabled
  2⤵
  PID:4544
- C:\Windows\system32\sc.exe
  sc config RetailDemo start=disabled
  2⤵
  PID:2880
- C:\Windows\system32\sc.exe
  sc config WalletService start=disabled
  2⤵
  PID:712
- C:\Windows\system32\sc.exe
  sc config Fax start=disabled
  2⤵
  - Launches sc.exe
  PID:4036
- C:\Windows\system32\sc.exe
  sc config WbioSrvc start=disabled
  2⤵
  - Launches sc.exe
  PID:1516
- C:\Windows\system32\sc.exe
  sc config iphlpsvc start=disabled
  2⤵
  PID:3064
- C:\Windows\system32\sc.exe
  sc config wcncsvc start=disabled
  2⤵
  PID:396
- C:\Windows\system32\sc.exe
  sc config fhsvc start=disabled
  2⤵
  PID:4720
- C:\Windows\system32\sc.exe
  sc config PhoneSvc start=disabled
  2⤵
  PID:4752
- C:\Windows\system32\sc.exe
  sc config seclogon start=disabled
  2⤵
  PID:3292
- C:\Windows\system32\sc.exe
  sc config FrameServer start=disabled
  2⤵
  PID:1092
- C:\Windows\system32\sc.exe
  sc config WbioSrvc start=disabled
  2⤵
  PID:2080
- C:\Windows\system32\sc.exe
  sc config StiSvc start=disabled
  2⤵
  - Launches sc.exe
  PID:216
- C:\Windows\system32\sc.exe
  sc config PcaSvc start=disabled
  2⤵
  PID:4988
- C:\Windows\system32\sc.exe
  sc config DPS start=disabled
  2⤵
  PID:3444
- C:\Windows\system32\sc.exe
  sc config MapsBroker start=disabled
  2⤵
  PID:2724
- C:\Windows\system32\sc.exe
  sc config bthserv start=disabled
  2⤵
  PID:4732
- C:\Windows\system32\sc.exe
  sc config BDESVC start=disabled
  2⤵
  PID:3416
- C:\Windows\system32\sc.exe
  sc config BthAvctpSvc start=disabled
  2⤵
  PID:920
- C:\Windows\system32\sc.exe
  sc config WpcMonSvc start=disabled
  2⤵
  PID:5116
- C:\Windows\system32\sc.exe
  sc config DiagTrack start=disabled
  2⤵
  - Launches sc.exe
  PID:4104
- C:\Windows\system32\sc.exe
  sc config CertPropSvc start=disabled
  2⤵
  PID:4940
- C:\Windows\system32\sc.exe
  sc config WdiServiceHost start=disabled
  2⤵
  PID:3932
- C:\Windows\system32\sc.exe
  sc config lmhosts start=disabled
  2⤵
  PID:4348
- C:\Windows\system32\sc.exe
  sc config WdiSystemHost start=disabled
  2⤵
  PID:1332
- C:\Windows\system32\sc.exe
  sc config TrkWks start=disabled
  2⤵
  - Launches sc.exe
  PID:192
- C:\Windows\system32\sc.exe
  sc config WerSvc start=disabled
  2⤵
  PID:4416
- C:\Windows\system32\sc.exe
  sc config TabletInputService start=disabled
  2⤵
  PID:2120
- C:\Windows\system32\sc.exe
  sc config EntAppSvc start=disabled
  2⤵
  PID:2748
- C:\Windows\system32\sc.exe
  sc config Spooler start=disabled
  2⤵
  - Launches sc.exe
  PID:4716
- C:\Windows\system32\sc.exe
  sc config BcastDVRUserService start=disabled
  2⤵
  PID:924
- C:\Windows\system32\sc.exe
  sc config WMPNetworkSvc start=disabled
  2⤵
  PID:2984
- C:\Windows\system32\sc.exe
  sc config diagnosticshub.standardcollector.service start=disabled
  2⤵
  PID:4528
- C:\Windows\system32\sc.exe
  sc config DmEnrollmentSvc start=disabled
  2⤵
  PID:3020
- C:\Windows\system32\sc.exe
  sc config PNRPAutoReg start=disabled
  2⤵
  PID:4684
- C:\Windows\system32\sc.exe
  sc config wlidsvc start=disabled
  2⤵
  PID:4444
- C:\Windows\system32\sc.exe
  sc config AXInstSV start=disabled
  2⤵
  PID:4428
- C:\Windows\system32\sc.exe
  sc config lfsvc start=disabled
  2⤵
  PID:220
- C:\Windows\system32\sc.exe
  sc config NcbService start=disabled
  2⤵
  PID:3620
- C:\Windows\system32\sc.exe
  sc config DeviceAssociationService start=disabled
  2⤵
  PID:3964
- C:\Windows\system32\sc.exe
  sc config StorSvc start=disabled
  2⤵
  PID:2164
- C:\Windows\system32\sc.exe
  sc config TieringEngineService start=disabled
  2⤵
  PID:404
- C:\Windows\system32\sc.exe
  sc config DPS start=disabled
  2⤵
  - Launches sc.exe
  PID:5036
- C:\Windows\system32\sc.exe
  sc config Themes start=disabled
  2⤵
  PID:4576
- C:\Windows\system32\sc.exe
  sc config AppReadiness start=disabled
  2⤵
  PID:2872
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:1500
- C:\Windows\system32\sc.exe
  sc config HvHost start=disabled
  2⤵
  PID:2600
- C:\Windows\system32\sc.exe
  sc config vmickvpexchange start=disabled
  2⤵
  PID:828
- C:\Windows\system32\sc.exe
  sc config vmicguestinterface start=disabled
  2⤵
  PID:2268
- C:\Windows\system32\sc.exe
  sc config vmicshutdown start=disabled
  2⤵
  PID:3440
- C:\Windows\system32\sc.exe
  sc config vmicheartbeat start=disabled
  2⤵
  PID:5088
- C:\Windows\system32\sc.exe
  sc config vmicvmsession start=disabled
  2⤵
  PID:4868
- C:\Windows\system32\sc.exe
  sc config vmicrdv start=disabled
  2⤵
  PID:4448
- C:\Windows\system32\sc.exe
  sc config vmictimesync start=disabled
  2⤵
  PID:3032
- C:\Windows\system32\sc.exe
  sc config vmicvss start=disabled
  2⤵
  PID:3056
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:1492
- C:\Windows\system32\sc.exe
  sc config edgeupdate start=disabled
  2⤵
  PID:2304
- C:\Windows\system32\sc.exe
  sc config edgeupdatem start=disabled
  2⤵
  PID:4396
- C:\Windows\system32\sc.exe
  sc config GoogleChromeElevationService start=disabled
  2⤵
  PID:4896
- C:\Windows\system32\sc.exe
  sc config gupdate start=disabled
  2⤵
  PID:2780
- C:\Windows\system32\sc.exe
  sc config gupdatem start=disabled
  2⤵
  PID:3824
- C:\Windows\system32\sc.exe
  sc config BraveElevationService start=disabled
  2⤵
  PID:660
- C:\Windows\system32\sc.exe
  sc config brave start=disabled
  2⤵
  PID:436
- C:\Windows\system32\sc.exe
  sc config bravem start=disabled
  2⤵
  PID:2676
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:1388
- C:\Windows\system32\sc.exe
  sc config NcbService start=disabled
  2⤵
  PID:5084
- C:\Windows\system32\sc.exe
  sc config jhi_service start=disabled
  2⤵
  PID:376
- C:\Windows\system32\sc.exe
  sc config WMIRegistrationService start=disabled
  2⤵
  PID:3732
- C:\Windows\system32\sc.exe
  sc config "Intel(R) TPM Provisioning Service" start=disabled
  2⤵
  PID:2140
- C:\Windows\system32\sc.exe
  sc config ipfsvc start=disabled
  2⤵
  PID:764
- C:\Windows\system32\sc.exe
  sc config igccservice start=disabled
  2⤵
  - Launches sc.exe
  PID:4600
- C:\Windows\system32\sc.exe
  sc config cplspcon start=disabled
  2⤵
  PID:3996
- C:\Windows\system32\sc.exe
  sc config esifsvc start=disabled
  2⤵
  PID:5044
- C:\Windows\system32\sc.exe
  sc config LMS start=disabled
  2⤵
  PID:4516
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:2248
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "GoogleUpdateTaskMachineCore{9C99738B-B026-4A33-A16D-7CCD7650D527}" /Disable
  2⤵
  PID:1888
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "GoogleUpdateTaskMachineUA{2E0C9FAD-7C87-42A8-8EFF-986A5662B894}" /Disable
  2⤵
  PID:4228
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Opera GX scheduled Autoupdate 1711926802" /Disable
  2⤵
  PID:1376
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "BraveSoftwareUpdateTaskMachineCore{A8A54493-B843-4D11-BA1F-30C26E9F10BE}" /Disable
  2⤵
  PID:1000
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "BraveSoftwareUpdateTaskMachineUA{FF1E0511-D7AF-4DB6-8A41-DC39EA60EC93}" /Disable
  2⤵
  PID:32
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "CCleaner Update" /Disable
  2⤵
  PID:4036
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "CCleanerCrashReporting" /Disable
  2⤵
  PID:1516
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "CCleanerUpdateTaskMachineCore" /Disable
  2⤵
  PID:5080
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "CCleanerUpdateTaskMachineUA" /Disable
  2⤵
  PID:4464
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\capabilityaccessmanager" /Disable
  2⤵
  PID:292
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Setup\SetupCleanupTask" /Disable
  2⤵
  PID:512
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Setup\SnapshotCleanupTask" /Disable
  2⤵
  PID:2572
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Shell\FamilySafetyMonitor" /Disable
  2⤵
  PID:2080
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Shell\FamilySafetyRefreshTask" /Disable
  2⤵
  PID:4644
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Shell\ThemesSyncedImageDownload" /Disable
  2⤵
  PID:2512
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Shell\UpdateUserPictureTask" /Disable
  2⤵
  PID:4232
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319" /Disable
  2⤵
  PID:4732
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64" /Disable
  2⤵
  PID:1160
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical" /Disable
  2⤵
  PID:1188
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical" /Disable
  2⤵
  PID:4104
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Application Experience\SdbinstMergeDbTask" /Disable
  2⤵
  PID:4940
- C:\Windows\system32\schtasks.exe
  schtasks /Change /TN "Microsoft\Windows\Printing\PrintJobCleanupTask" /Disable
  2⤵
  PID:2520
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /TN "GoogleUpdateTaskMachineCore{9C99738B-B026-4A33-A16D-7CCD7650D527}" /F
  2⤵
  PID:1552
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /TN "GoogleUpdateTaskMachineUA{2E0C9FAD-7C87-42A8-8EFF-986A5662B894}" /F
  2⤵
  PID:1468
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /TN "Opera GX scheduled Autoupdate 1711926802" /F
  2⤵
  PID:4556
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /TN "BraveSoftwareUpdateTaskMachineCore{A8A54493-B843-4D11-BA1F-30C26E9F10BE}" /F
  2⤵
  PID:2576
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /TN "BraveSoftwareUpdateTaskMachineUA{FF1E0511-D7AF-4DB6-8A41-DC39EA60EC93}" /F
  2⤵
  PID:4344
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /TN "CCleaner Update" /F
  2⤵
  PID:4620
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /TN "CCleanerCrashReporting" /F
  2⤵
  PID:4392
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /TN "CCleanerUpdateTaskMachineCore" /F
  2⤵
  PID:1312
- C:\Windows\system32\schtasks.exe
  schtasks /Delete /TN "CCleanerUpdateTaskMachineUA" /F
  2⤵
  PID:4528
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:2044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "get-appxpackage Microsoft.GamingServices | remove-AppxPackage -allusers"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:376
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\GameBarPresenceWriter.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4312
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\GameBarPresenceWriter.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2136
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:3828
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe
  2⤵
  - Kills process with taskkill
  PID:3000
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe /fi "IMAGENAME eq msedge.exe"
  2⤵
  - Kills process with taskkill
  PID:2672
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe /fi "IMAGENAME eq msedge.exe"
  2⤵
  - Kills process with taskkill
  PID:1888
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:4544
- C:\Windows\system32\taskkill.exe
  taskkill.exe /F /IM "OneDrive.exe"
  2⤵
  - Kills process with taskkill
  PID:2880
- C:\Windows\system32\taskkill.exe
  taskkill.exe /F /IM "explorer.exe"
  2⤵
  - Kills process with taskkill
  PID:3600
- C:\Windows\system32\reg.exe
  reg add "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry class
  PID:396
- C:\Windows\system32\reg.exe
  reg add "HKCR\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /v "System.IsPinnedToNameSpaceTree" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry class
  PID:1936
- C:\Windows\system32\reg.exe
  reg load "hku\Default" "C:\Users\Default\NTUSER.DAT"
  2⤵
  PID:4888
- C:\Windows\system32\reg.exe
  reg delete "HKEY_USERS\Default\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveSetup" /f
  2⤵
  PID:4968
- C:\Windows\system32\reg.exe
  reg unload "hku\Default"
  2⤵
  PID:5076
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn "OneDrive*" /f
  2⤵
  PID:216
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4784
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:4988
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\UsoClient.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3996
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\UsoClient.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3484
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:3488
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM WidgetService.exe
  2⤵
  - Kills process with taskkill
  PID:1080
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Widgets.exe
  2⤵
  - Kills process with taskkill
  PID:4304
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\NewsAndInterests" /v "AllowNewsAndInterests" /t REG_DWORD /d 0 /f
  2⤵
  PID:3280
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Dsh" /v "AllowNewsAndInterests" /t REG_DWORD /d 0 /f
  2⤵
  PID:4192
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:680
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\smartscreen.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3292
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\smartscreen.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4888
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5076
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:216
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:4156
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3596
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3708
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:3784
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:3804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host '(Recommended)' -ForegroundColor White -BackgroundColor Red"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:3880
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4068
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3976
- C:\Windows\system32\takeown.exe
  takeown /F "C:\Windows\System32\taskhostw.exe"
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4004
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\taskhostw.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4044
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  - Delays execution with timeout.exe
  PID:4304
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:3280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host 'Needed if you''d like to Search things!' -ForegroundColor White -BackgroundColor Red"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3652
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic startup get caption /format:list
  2⤵
  PID:3716
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic startup get caption /format:list
    3⤵
    PID:3784
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveSetup " /t REG_SZ /d "" /f
  2⤵
  - Adds Run key to start application
  PID:4460
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "OneDriveSetup " /t REG_SZ /d "" /f
  2⤵
  - Adds Run key to start application
  PID:3824
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "a4iuzc " /t REG_SZ /d "" /f
  2⤵
  - Adds Run key to start application
  PID:4600
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  PID:2456
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:3916
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:3660
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunNotification" /f
  2⤵
  PID:1624
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:4936
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:3736
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:3920
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunNotification" /f
  2⤵
  PID:4564
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" /f
  2⤵
  - Adds Run key to start application
  PID:4444
- C:\Windows\system32\timeout.exe
  timeout 1
  2⤵
  PID:828
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host 'Reminder, will take a while' -ForegroundColor White -BackgroundColor Red"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *3DBuilder* | Remove-AppxPackage"
  2⤵
  PID:4428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Cortana* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Getstarted* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *WindowsAlarms* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *WindowsCamera* | Remove-AppxPackage"
  2⤵
  PID:3712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *bing* | Remove-AppxPackage"
  2⤵
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *MicrosoftOfficeHub* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *OneNote* | Remove-AppxPackage"
  2⤵
  PID:292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *WindowsPhone* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *photos* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *SkypeApp* | Remove-AppxPackage"
  2⤵
  PID:4756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *solit* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *WindowsSoundRecorder* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *windowscommunicationsapps* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *zune* | Remove-AppxPackage"
  2⤵
  PID:4924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *WindowsCalculator* | Remove-AppxPackage"
  2⤵
  PID:4216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *WindowsMaps* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Sway* | Remove-AppxPackage"
  2⤵
  PID:2456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *CommsPhone* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *ConnectivityStore* | Remove-AppxPackage"
  2⤵
  PID:4796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Messaging* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.WindowsStore* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.BingWeather* | Remove-AppxPackage"
  2⤵
  PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.BingSports* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.BingNews* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.BingFinance* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.HEIFImageExtension* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.VP9VideoExtensions* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.WebMediaExtensions* | Remove-AppxPackage"
  2⤵
  PID:8
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.WebpImageExtension* | Remove-AppxPackage"
  2⤵
  PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Office.OneNote* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Office.Sway* | Remove-AppxPackage"
  2⤵
  PID:4724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.WindowsStore* | Remove-AppxPackage"
  2⤵
  PID:3908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.StorePurchaseApp* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.XboxApp* | Remove-AppxPackage"
  2⤵
  PID:3940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Xbox.TCUI* | Remove-AppxPackage"
  2⤵
  PID:3500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.XboxGamingOverlay* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.XboxGameOverlay* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.XboxIdentityProvider* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.XboxSpeechToTextOverlay* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.WindowsPhone* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.WindowsPhone* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.WindowsPhone* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Windows.Phone* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.CommsPhone* | Remove-AppxPackage"
  2⤵
  PID:5044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.YourPhone* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Appconnector* | Remove-AppxPackage"
  2⤵
  PID:3608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.GetHelp* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Getstarted* | Remove-AppxPackage"
  2⤵
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.MixedReality.Portal* | Remove-AppxPackage"
  2⤵
  PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.WindowsFeedbackHub* | Remove-AppxPackage"
  2⤵
  PID:3916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.MinecraftUWP* | Remove-AppxPackage"
  2⤵
  PID:680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Wallet* | Remove-AppxPackage"
  2⤵
  PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.OneConnect* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.MicrosoftSolitaireCollection* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.MicrosoftStickyNotes* | Remove-AppxPackage"
  2⤵
  PID:3300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *microsoft.windowscommunicationsapps* | Remove-AppxPackage"
  2⤵
  PID:3588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.ZuneMusic* | Remove-AppxPackage"
  2⤵
  PID:1516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.ZuneVideo* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.WindowsCalculator* | Remove-AppxPackage"
  2⤵
  PID:660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.SkypeApp* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.GroupMe10* | Remove-AppxPackage"
  2⤵
  PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.WindowsSoundRecorder* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *king.com.CandyCrushSaga* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *king.com.CandyCrushSodaSaga* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *ShazamEntertainmentLtd.Shazam* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Flipboard.Flipboard* | Remove-AppxPackage"
  2⤵
  PID:3500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *9E2F88E3.Twitter* | Remove-AppxPackage"
  2⤵
  PID:3696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *ClearChannelRadioDigital.iHeartRadio* | Remove-AppxPackage"
  2⤵
  PID:1872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *D5EA27B7.Duolingo-LearnLanguagesforFree* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *AdobeSystemsIncorporated.AdobePhotoshopExpress* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *PandoraMediaInc.29680B314EFC2* | Remove-AppxPackage"
  2⤵
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *46928bounde.EclipseManager* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *ActiproSoftwareLLC.562882FEEB491* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *SpotifyAB.SpotifyMusic* | Remove-AppxPackage"
  2⤵
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Advertising.Xaml* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.RemoteDesktop* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.NetworkSpeedTest* | Remove-AppxPackage"
  2⤵
  PID:3964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Todos* | Remove-AppxPackage"
  2⤵
  PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Windows.Search* | Remove-AppxPackage"
  2⤵
  PID:1132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Print3D* | Remove-AppxPackage"
  2⤵
  PID:880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Microsoft3DViewer* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Windows.Cortana* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *windowsterminal* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.ScreenSketch* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.GetHelp* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.PowerAutomateDesktop* | Remove-AppxPackage"
  2⤵
  PID:1020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.People* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.MSPaint* | Remove-AppxPackage"
  2⤵
  PID:3504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.Office.Outlook* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.WindowsNotepad* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.OneDrive* | Remove-AppxPackage"
  2⤵
  PID:828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -ExecutionPolicy Unrestricted -Command "Get-AppxPackage *Microsoft.ParentalControls* | Remove-AppxPackage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4908

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1620

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenonetwork -s DPS
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2652

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s WdiServiceHost
1⤵
PID:4196

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...