187dda8694b772e25a3fb7907b9ed7880e83df1a88acb9cc287d08e9ecb57260

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	smss64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	smss64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	smss64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	smss64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	smss64.exe

Modifies Windows Defender notification settings 3 TTPs 4 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	smss64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	smss64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	smss64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	smss64.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/memory/2436-80-0x0000000000E80000-0x0000000000EF9000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/2436-100-0x0000000000E80000-0x0000000000EF9000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/2436-80-0x0000000000E80000-0x0000000000EF9000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000002a746-17.dat	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000002a746-17.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5480	powershell.exe
1096	powershell.exe
5480	powershell.exe
1096	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
2436	smss64.exe
5936	smss64.exe
5768	smss64.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wine	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Loads dropped DLL 3 IoCs

pid	Process
2436	smss64.exe
5936	smss64.exe
5768	smss64.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

File/Path Exclusions

T1564.012

Disable or Modify Tools

pid	Process
5752	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetPerformanceLog = "C:\\ProgramData\\Microsoft\\NetPerformanceLog\\smss64.exe"	smss64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

Ignore Process Interrupts

T1564.011

pid	Process
5924	cmd.exe
5752	cmd.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5672	sc.exe
5000	sc.exe
4140	sc.exe
5276	sc.exe
5596	sc.exe
2128	sc.exe
4228	sc.exe
2600	sc.exe
3432	sc.exe
1984	sc.exe
1388	sc.exe
2652	sc.exe
1764	sc.exe
4180	sc.exe
4756	sc.exe
4276	sc.exe
5256	sc.exe
5628	sc.exe
5460	sc.exe
6100	sc.exe
560	sc.exe
5544	sc.exe
1748	sc.exe
1124	sc.exe
4852	sc.exe
5064	sc.exe
4004	sc.exe
4532	sc.exe
2448	sc.exe
4576	sc.exe
3976	sc.exe
5900	sc.exe
4480	sc.exe
4684	sc.exe
6108	sc.exe
1272	sc.exe
1720	sc.exe
4776	sc.exe
3096	sc.exe
4700	sc.exe
1872	sc.exe
2140	sc.exe
4004	sc.exe
1780	sc.exe
5512	sc.exe
2152	sc.exe
4032	sc.exe
1512	sc.exe
3140	sc.exe
5232	sc.exe
2120	sc.exe
4444	sc.exe
4404	sc.exe
4524	sc.exe
5972	sc.exe
4732	sc.exe
468	sc.exe
3212	sc.exe
4048	sc.exe
5164	sc.exe
4836	sc.exe
1720	sc.exe
6052	sc.exe
3756	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2156	netstat.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2156	netstat.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}	smss64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}\InprocServer32\ = "C:\\ProgramData\\Microsoft\\NetPerformanceLog\\dnssd.dll"	smss64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}\InprocServer32\ThreadingModel = "Both"	smss64.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792}\InprocServer32	smss64.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID	smss64.exe

Modifies registry key 1 TTPs 51 IoCs

Modify Registry

pid	Process
4840	reg.exe
4616	reg.exe
2852	reg.exe
4500	reg.exe
6100	reg.exe
2176	reg.exe
1060	reg.exe
5752	reg.exe
6136	reg.exe
4688	reg.exe
2588	reg.exe
2672	reg.exe
4828	reg.exe
5936	reg.exe
4912	reg.exe
2120	reg.exe
3848	reg.exe
960	reg.exe
5964	reg.exe
4384	reg.exe
5640	reg.exe
3692	reg.exe
3828	reg.exe
4000	reg.exe
3688	reg.exe
5468	reg.exe
3432	reg.exe
4936	reg.exe
2316	reg.exe
5376	reg.exe
4044	reg.exe
724	reg.exe
4700	reg.exe
4036	reg.exe
1516	reg.exe
4964	reg.exe
5748	reg.exe
1984	reg.exe
4444	reg.exe
5968	reg.exe
4980	reg.exe
1120	reg.exe
6032	reg.exe
1432	reg.exe
3228	reg.exe
5380	reg.exe
5480	reg.exe
3240	reg.exe
3288	reg.exe
1488	reg.exe
3128	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
2436	smss64.exe
2436	smss64.exe
5480	powershell.exe
5480	powershell.exe
1096	powershell.exe
1096	powershell.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe
2436	smss64.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
680	Process not Found

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5200	WMIC.exe
Token: SeSecurityPrivilege	5200	WMIC.exe
Token: SeTakeOwnershipPrivilege	5200	WMIC.exe
Token: SeLoadDriverPrivilege	5200	WMIC.exe
Token: SeSystemProfilePrivilege	5200	WMIC.exe
Token: SeSystemtimePrivilege	5200	WMIC.exe
Token: SeProfSingleProcessPrivilege	5200	WMIC.exe
Token: SeIncBasePriorityPrivilege	5200	WMIC.exe
Token: SeCreatePagefilePrivilege	5200	WMIC.exe
Token: SeBackupPrivilege	5200	WMIC.exe
Token: SeRestorePrivilege	5200	WMIC.exe
Token: SeShutdownPrivilege	5200	WMIC.exe
Token: SeDebugPrivilege	5200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5200	WMIC.exe
Token: SeRemoteShutdownPrivilege	5200	WMIC.exe
Token: SeUndockPrivilege	5200	WMIC.exe
Token: SeManageVolumePrivilege	5200	WMIC.exe
Token: 33	5200	WMIC.exe
Token: 34	5200	WMIC.exe
Token: 35	5200	WMIC.exe
Token: 36	5200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5200	WMIC.exe
Token: SeSecurityPrivilege	5200	WMIC.exe
Token: SeTakeOwnershipPrivilege	5200	WMIC.exe
Token: SeLoadDriverPrivilege	5200	WMIC.exe
Token: SeSystemProfilePrivilege	5200	WMIC.exe
Token: SeSystemtimePrivilege	5200	WMIC.exe
Token: SeProfSingleProcessPrivilege	5200	WMIC.exe
Token: SeIncBasePriorityPrivilege	5200	WMIC.exe
Token: SeCreatePagefilePrivilege	5200	WMIC.exe
Token: SeBackupPrivilege	5200	WMIC.exe
Token: SeRestorePrivilege	5200	WMIC.exe
Token: SeShutdownPrivilege	5200	WMIC.exe
Token: SeDebugPrivilege	5200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5200	WMIC.exe
Token: SeRemoteShutdownPrivilege	5200	WMIC.exe
Token: SeUndockPrivilege	5200	WMIC.exe
Token: SeManageVolumePrivilege	5200	WMIC.exe
Token: 33	5200	WMIC.exe
Token: 34	5200	WMIC.exe
Token: 35	5200	WMIC.exe
Token: 36	5200	WMIC.exe
Token: SeDebugPrivilege	2156	netstat.exe
Token: SeSecurityPrivilege	2424	mofcomp.exe
Token: SeDebugPrivilege	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Token: SeSecurityPrivilege	2460	mofcomp.exe
Token: SeSecurityPrivilege	3564	mofcomp.exe
Token: SeDebugPrivilege	5480	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3864	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2464	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	79
PID 2464 wrote to memory of 2488	2464	cmd.exe	81
PID 2808 wrote to memory of 3976	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	82
PID 2808 wrote to memory of 5608	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	84
PID 2808 wrote to memory of 3244	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	86
PID 2808 wrote to memory of 3140	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	88
PID 2808 wrote to memory of 2460	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	90
PID 2808 wrote to memory of 5432	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	92
PID 2808 wrote to memory of 2360	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	94
PID 2808 wrote to memory of 2492	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	96
PID 2808 wrote to memory of 2140	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	98
PID 2808 wrote to memory of 6052	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	100
PID 2808 wrote to memory of 2176	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	102
PID 2808 wrote to memory of 3756	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	104
PID 2808 wrote to memory of 5496	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	106
PID 2808 wrote to memory of 3840	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	108
PID 2808 wrote to memory of 5544	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	110
PID 2808 wrote to memory of 796	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	112
PID 2808 wrote to memory of 2248	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	114
PID 2808 wrote to memory of 3820	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	116
PID 2808 wrote to memory of 2108	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	118
PID 2808 wrote to memory of 5536	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	120
PID 2808 wrote to memory of 1272	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	122
PID 2808 wrote to memory of 4152	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	124
PID 2808 wrote to memory of 4868	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	126
PID 2808 wrote to memory of 4732	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	128
PID 2808 wrote to memory of 5000	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	130
PID 2808 wrote to memory of 2740	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	132
PID 2808 wrote to memory of 2852	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	134
PID 2808 wrote to memory of 5020	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	136
PID 2808 wrote to memory of 900	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	138
PID 2808 wrote to memory of 5512	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	140
PID 2808 wrote to memory of 748	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	142
PID 2808 wrote to memory of 4488	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	144
PID 2808 wrote to memory of 1080	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	146
PID 2808 wrote to memory of 5556	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	148
PID 2808 wrote to memory of 5472	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	150
PID 2808 wrote to memory of 3784	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	152
PID 2808 wrote to memory of 4776	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	154
PID 2808 wrote to memory of 4500	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	156
PID 2808 wrote to memory of 5900	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	158
PID 2808 wrote to memory of 1488	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	160
PID 2808 wrote to memory of 1820	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	162
PID 2808 wrote to memory of 1864	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	164
PID 2808 wrote to memory of 4856	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	166
PID 2808 wrote to memory of 4712	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	168
PID 2808 wrote to memory of 5704	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	170
PID 2808 wrote to memory of 6100	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	172
PID 2808 wrote to memory of 1600	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	174
PID 2808 wrote to memory of 4992	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	176
PID 2808 wrote to memory of 3112	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	178
PID 2808 wrote to memory of 3672	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	180
PID 2808 wrote to memory of 4744	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	182
PID 2808 wrote to memory of 2736	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	184
PID 2808 wrote to memory of 1516	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	186
PID 2808 wrote to memory of 4756	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	188
PID 2808 wrote to memory of 3092	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	190
PID 2808 wrote to memory of 4996	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	192
PID 2808 wrote to memory of 1872	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	194
PID 2808 wrote to memory of 3720	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	196
PID 2808 wrote to memory of 4836	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	198
PID 2808 wrote to memory of 4844	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	200
PID 2808 wrote to memory of 2380	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	202
PID 2808 wrote to memory of 4640	2808	2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	204

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_af0749b4e6f245c7e1b9ec49e3ecb671_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc query type= service state= all"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\system32\sc.exe
    sc query type= service state= all
    3⤵
    PID:2488
- C:\Windows\system32\sc.exe
  "sc" qc AJRouter
  2⤵
  - Launches sc.exe
  PID:3976
- C:\Windows\system32\sc.exe
  "sc" qc ALG
  2⤵
  PID:5608
- C:\Windows\system32\sc.exe
  "sc" qc AppIDSvc
  2⤵
  PID:3244
- C:\Windows\system32\sc.exe
  "sc" qc Appinfo
  2⤵
  - Launches sc.exe
  PID:3140
- C:\Windows\system32\sc.exe
  "sc" qc AppMgmt
  2⤵
  PID:2460
- C:\Windows\system32\sc.exe
  "sc" qc AppReadiness
  2⤵
  PID:5432
- C:\Windows\system32\sc.exe
  "sc" qc AppVClient
  2⤵
  PID:2360
- C:\Windows\system32\sc.exe
  "sc" qc AppXSvc
  2⤵
  PID:2492
- C:\Windows\system32\sc.exe
  "sc" qc AssignedAccessManagerSvc
  2⤵
  PID:2140
- C:\Windows\system32\sc.exe
  "sc" qc AudioEndpointBuilder
  2⤵
  - Launches sc.exe
  PID:6052
- C:\Windows\system32\sc.exe
  "sc" qc Audiosrv
  2⤵
  PID:2176
- C:\Windows\system32\sc.exe
  "sc" qc autotimesvc
  2⤵
  - Launches sc.exe
  PID:3756
- C:\Windows\system32\sc.exe
  "sc" qc AxInstSV
  2⤵
  PID:5496
- C:\Windows\system32\sc.exe
  "sc" qc BDESVC
  2⤵
  PID:3840
- C:\Windows\system32\sc.exe
  "sc" qc BFE
  2⤵
  - Launches sc.exe
  PID:5544
- C:\Windows\system32\sc.exe
  "sc" qc BITS
  2⤵
  PID:796
- C:\Windows\system32\sc.exe
  "sc" qc BrokerInfrastructure
  2⤵
  PID:2248
- C:\Windows\system32\sc.exe
  "sc" qc BTAGService
  2⤵
  PID:3820
- C:\Windows\system32\sc.exe
  "sc" qc BthAvctpSvc
  2⤵
  PID:2108
- C:\Windows\system32\sc.exe
  "sc" qc bthserv
  2⤵
  PID:5536
- C:\Windows\system32\sc.exe
  "sc" qc camsvc
  2⤵
  - Launches sc.exe
  PID:1272
- C:\Windows\system32\sc.exe
  "sc" qc CDPSvc
  2⤵
  PID:4152
- C:\Windows\system32\sc.exe
  "sc" qc CertPropSvc
  2⤵
  PID:4868
- C:\Windows\system32\sc.exe
  "sc" qc ClickToRunSvc
  2⤵
  - Launches sc.exe
  PID:4732
- C:\Windows\system32\sc.exe
  "sc" qc ClipSVC
  2⤵
  PID:5000
- C:\Windows\system32\sc.exe
  "sc" qc cloudidsvc
  2⤵
  PID:2740
- C:\Windows\system32\sc.exe
  "sc" qc COMSysApp
  2⤵
  PID:2852
- C:\Windows\system32\sc.exe
  "sc" qc CoreMessagingRegistrar
  2⤵
  PID:5020
- C:\Windows\system32\sc.exe
  "sc" qc CryptSvc
  2⤵
  PID:900
- C:\Windows\system32\sc.exe
  "sc" qc CscService
  2⤵
  - Launches sc.exe
  PID:5512
- C:\Windows\system32\sc.exe
  "sc" qc DcomLaunch
  2⤵
  PID:748
- C:\Windows\system32\sc.exe
  "sc" qc defragsvc
  2⤵
  PID:4488
- C:\Windows\system32\sc.exe
  "sc" qc DeviceAssociationService
  2⤵
  PID:1080
- C:\Windows\system32\sc.exe
  "sc" qc DeviceInstall
  2⤵
  PID:5556
- C:\Windows\system32\sc.exe
  "sc" qc DevQueryBroker
  2⤵
  PID:5472
- C:\Windows\system32\sc.exe
  "sc" qc Dhcp
  2⤵
  PID:3784
- C:\Windows\system32\sc.exe
  "sc" qc diagnosticshub.standardcollector.service
  2⤵
  PID:4776
- C:\Windows\system32\sc.exe
  "sc" qc diagsvc
  2⤵
  PID:4500
- C:\Windows\system32\sc.exe
  "sc" qc DiagTrack
  2⤵
  - Launches sc.exe
  PID:5900
- C:\Windows\system32\sc.exe
  "sc" qc DialogBlockingService
  2⤵
  PID:1488
- C:\Windows\system32\sc.exe
  "sc" qc DispBrokerDesktopSvc
  2⤵
  PID:1820
- C:\Windows\system32\sc.exe
  "sc" qc DisplayEnhancementService
  2⤵
  PID:1864
- C:\Windows\system32\sc.exe
  "sc" qc DmEnrollmentSvc
  2⤵
  PID:4856
- C:\Windows\system32\sc.exe
  "sc" qc dmwappushservice
  2⤵
  PID:4712
- C:\Windows\system32\sc.exe
  "sc" qc Dnscache
  2⤵
  PID:5704
- C:\Windows\system32\sc.exe
  "sc" qc DoSvc
  2⤵
  - Launches sc.exe
  PID:6100
- C:\Windows\system32\sc.exe
  "sc" qc dot3svc
  2⤵
  PID:1600
- C:\Windows\system32\sc.exe
  "sc" qc DPS
  2⤵
  PID:4992
- C:\Windows\system32\sc.exe
  "sc" qc DsmSvc
  2⤵
  PID:3112
- C:\Windows\system32\sc.exe
  "sc" qc DsSvc
  2⤵
  PID:3672
- C:\Windows\system32\sc.exe
  "sc" qc DusmSvc
  2⤵
  PID:4744
- C:\Windows\system32\sc.exe
  "sc" qc EapHost
  2⤵
  PID:2736
- C:\Windows\system32\sc.exe
  "sc" qc edgeupdate
  2⤵
  PID:1516
- C:\Windows\system32\sc.exe
  "sc" qc edgeupdatem
  2⤵
  - Launches sc.exe
  PID:4756
- C:\Windows\system32\sc.exe
  "sc" qc EFS
  2⤵
  PID:3092
- C:\Windows\system32\sc.exe
  "sc" qc embeddedmode
  2⤵
  PID:4996
- C:\Windows\system32\sc.exe
  "sc" qc EntAppSvc
  2⤵
  - Launches sc.exe
  PID:1872
- C:\Windows\system32\sc.exe
  "sc" qc EventLog
  2⤵
  PID:3720
- C:\Windows\system32\sc.exe
  "sc" qc EventSystem
  2⤵
  - Launches sc.exe
  PID:4836
- C:\Windows\system32\sc.exe
  "sc" qc Fax
  2⤵
  PID:4844
- C:\Windows\system32\sc.exe
  "sc" qc fdPHost
  2⤵
  PID:2380
- C:\Windows\system32\sc.exe
  "sc" qc FDResPub
  2⤵
  PID:4640
- C:\Windows\system32\sc.exe
  "sc" qc fhsvc
  2⤵
  PID:2504
- C:\Windows\system32\sc.exe
  "sc" qc FontCache
  2⤵
  PID:5620
- C:\Windows\system32\sc.exe
  "sc" qc FontCache3.0.0.0
  2⤵
  PID:5352
- C:\Windows\system32\sc.exe
  "sc" qc FrameServer
  2⤵
  PID:3616
- C:\Windows\system32\sc.exe
  "sc" qc FrameServerMonitor
  2⤵
  PID:5092
- C:\Windows\system32\sc.exe
  "sc" qc GoogleChromeElevationService
  2⤵
  PID:5504
- C:\Windows\system32\sc.exe
  "sc" qc GoogleUpdaterInternalService141.0.7340.0
  2⤵
  - Launches sc.exe
  PID:468
- C:\Windows\system32\sc.exe
  "sc" qc GoogleUpdaterService141.0.7340.0
  2⤵
  - Launches sc.exe
  PID:1748
- C:\Windows\system32\sc.exe
  "sc" qc gpsvc
  2⤵
  PID:2472
- C:\Windows\system32\sc.exe
  "sc" qc GraphicsPerfSvc
  2⤵
  PID:3728
- C:\Windows\system32\sc.exe
  "sc" qc hidserv
  2⤵
  - Launches sc.exe
  PID:2140
- C:\Windows\system32\sc.exe
  "sc" qc HvHost
  2⤵
  PID:5936
- C:\Windows\system32\sc.exe
  "sc" qc icssvc
  2⤵
  PID:3980
- C:\Windows\system32\sc.exe
  "sc" qc IKEEXT
  2⤵
  - Launches sc.exe
  PID:5276
- C:\Windows\system32\sc.exe
  "sc" qc InstallService
  2⤵
  - Launches sc.exe
  PID:1124
- C:\Windows\system32\sc.exe
  "sc" qc iphlpsvc
  2⤵
  PID:668
- C:\Windows\system32\sc.exe
  "sc" qc IpxlatCfgSvc
  2⤵
  PID:4512
- C:\Windows\system32\sc.exe
  "sc" qc KeyIso
  2⤵
  PID:1456
- C:\Windows\system32\sc.exe
  "sc" qc KtmRm
  2⤵
  - Launches sc.exe
  PID:5232
- C:\Windows\system32\sc.exe
  "sc" qc LanmanServer
  2⤵
  PID:1108
- C:\Windows\system32\sc.exe
  "sc" qc LanmanWorkstation
  2⤵
  PID:5444
- C:\Windows\system32\sc.exe
  "sc" qc lfsvc
  2⤵
  - Launches sc.exe
  PID:5672
- C:\Windows\system32\sc.exe
  "sc" qc LicenseManager
  2⤵
  PID:2572
- C:\Windows\system32\sc.exe
  "sc" qc lltdsvc
  2⤵
  - Launches sc.exe
  PID:4852
- C:\Windows\system32\sc.exe
  "sc" qc lmhosts
  2⤵
  - Launches sc.exe
  PID:3212
- C:\Windows\system32\sc.exe
  "sc" qc LSM
  2⤵
  - Launches sc.exe
  PID:4480
- C:\Windows\system32\sc.exe
  "sc" qc LxpSvc
  2⤵
  PID:2420
- C:\Windows\system32\sc.exe
  "sc" qc MapsBroker
  2⤵
  PID:4140
- C:\Windows\system32\sc.exe
  "sc" qc McpManagementService
  2⤵
  - Launches sc.exe
  PID:560
- C:\Windows\system32\sc.exe
  "sc" qc MicrosoftEdgeElevationService
  2⤵
  PID:5700
- C:\Windows\system32\sc.exe
  "sc" qc MixedRealityOpenXRSvc
  2⤵
  PID:5492
- C:\Windows\system32\sc.exe
  "sc" qc MozillaMaintenance
  2⤵
  PID:764
- C:\Windows\system32\sc.exe
  "sc" qc mpssvc
  2⤵
  PID:5736
- C:\Windows\system32\sc.exe
  "sc" qc MSDTC
  2⤵
  PID:4444
- C:\Windows\system32\sc.exe
  "sc" qc MSiSCSI
  2⤵
  PID:2596
- C:\Windows\system32\sc.exe
  "sc" qc msiserver
  2⤵
  PID:2880
- C:\Windows\system32\sc.exe
  "sc" qc MsKeyboardFilter
  2⤵
  PID:4924
- C:\Windows\system32\sc.exe
  "sc" qc NaturalAuthentication
  2⤵
  PID:6072
- C:\Windows\system32\sc.exe
  "sc" qc NcaSvc
  2⤵
  - Launches sc.exe
  PID:5596
- C:\Windows\system32\sc.exe
  "sc" qc NcbService
  2⤵
  PID:3256
- C:\Windows\system32\sc.exe
  "sc" qc NcdAutoSetup
  2⤵
  - Launches sc.exe
  PID:4048
- C:\Windows\system32\sc.exe
  "sc" qc Netlogon
  2⤵
  - Launches sc.exe
  PID:4524
- C:\Windows\system32\sc.exe
  "sc" qc Netman
  2⤵
  PID:1820
- C:\Windows\system32\sc.exe
  "sc" qc netprofm
  2⤵
  - Launches sc.exe
  PID:4576
- C:\Windows\system32\sc.exe
  "sc" qc NetSetupSvc
  2⤵
  PID:3004
- C:\Windows\system32\sc.exe
  "sc" qc NetTcpPortSharing
  2⤵
  PID:2848
- C:\Windows\system32\sc.exe
  "sc" qc NgcCtnrSvc
  2⤵
  PID:2932
- C:\Windows\system32\sc.exe
  "sc" qc NgcSvc
  2⤵
  PID:1184
- C:\Windows\system32\sc.exe
  "sc" qc NlaSvc
  2⤵
  - Launches sc.exe
  PID:2120
- C:\Windows\system32\sc.exe
  "sc" qc nsi
  2⤵
  - Launches sc.exe
  PID:2152
- C:\Windows\system32\sc.exe
  "sc" qc ose64
  2⤵
  PID:1140
- C:\Windows\system32\sc.exe
  "sc" qc p2pimsvc
  2⤵
  PID:4236
- C:\Windows\system32\sc.exe
  "sc" qc p2psvc
  2⤵
  PID:4120
- C:\Windows\system32\sc.exe
  "sc" qc PcaSvc
  2⤵
  - Launches sc.exe
  PID:1720
- C:\Windows\system32\sc.exe
  "sc" qc PeerDistSvc
  2⤵
  - Launches sc.exe
  PID:1388
- C:\Windows\system32\sc.exe
  "sc" qc perceptionsimulation
  2⤵
  PID:5144
- C:\Windows\system32\sc.exe
  "sc" qc PerfHost
  2⤵
  PID:5376
- C:\Windows\system32\sc.exe
  "sc" qc PhoneSvc
  2⤵
  PID:4896
- C:\Windows\system32\sc.exe
  "sc" qc pla
  2⤵
  PID:5600
- C:\Windows\system32\sc.exe
  "sc" qc PlugPlay
  2⤵
  - Launches sc.exe
  PID:5064
- C:\Windows\system32\sc.exe
  "sc" qc PNRPAutoReg
  2⤵
  - Launches sc.exe
  PID:4276
- C:\Windows\system32\sc.exe
  "sc" qc PNRPsvc
  2⤵
  - Launches sc.exe
  PID:2128
- C:\Windows\system32\sc.exe
  "sc" qc PolicyAgent
  2⤵
  PID:4112
- C:\Windows\system32\sc.exe
  "sc" qc Power
  2⤵
  PID:2424
- C:\Windows\system32\sc.exe
  "sc" qc PrintNotify
  2⤵
  PID:5408
- C:\Windows\system32\sc.exe
  "sc" qc ProfSvc
  2⤵
  PID:3440
- C:\Windows\system32\sc.exe
  "sc" qc PushToInstall
  2⤵
  PID:4040
- C:\Windows\system32\sc.exe
  "sc" qc QWAVE
  2⤵
  PID:1784
- C:\Windows\system32\sc.exe
  "sc" qc RasAuto
  2⤵
  PID:2460
- C:\Windows\system32\sc.exe
  "sc" qc RasMan
  2⤵
  - Launches sc.exe
  PID:5256
- C:\Windows\system32\sc.exe
  "sc" qc RemoteAccess
  2⤵
  PID:2360
- C:\Windows\system32\sc.exe
  "sc" qc RemoteRegistry
  2⤵
  PID:3564
- C:\Windows\system32\sc.exe
  "sc" qc RetailDemo
  2⤵
  - Launches sc.exe
  PID:4032
- C:\Windows\system32\sc.exe
  "sc" qc RmSvc
  2⤵
  - Launches sc.exe
  PID:4004
- C:\Windows\system32\sc.exe
  "sc" qc RpcEptMapper
  2⤵
  PID:3872
- C:\Windows\system32\sc.exe
  "sc" qc RpcLocator
  2⤵
  - Launches sc.exe
  PID:4228
- C:\Windows\system32\sc.exe
  "sc" qc RpcSs
  2⤵
  PID:5224
- C:\Windows\system32\sc.exe
  "sc" qc SamSs
  2⤵
  PID:3840
- C:\Windows\system32\sc.exe
  "sc" qc SCardSvr
  2⤵
  PID:3404
- C:\Windows\system32\sc.exe
  "sc" qc ScDeviceEnum
  2⤵
  PID:5720
- C:\Windows\system32\sc.exe
  "sc" qc Schedule
  2⤵
  PID:3688
- C:\Windows\system32\sc.exe
  "sc" qc SCPolicySvc
  2⤵
  - Launches sc.exe
  PID:2600
- C:\Windows\system32\sc.exe
  "sc" qc SDRSVC
  2⤵
  PID:1476
- C:\Windows\system32\sc.exe
  "sc" qc seclogon
  2⤵
  PID:5444
- C:\Windows\system32\sc.exe
  "sc" qc SEMgrSvc
  2⤵
  PID:5672
- C:\Windows\system32\sc.exe
  "sc" qc SENS
  2⤵
  PID:2652
- C:\Windows\system32\sc.exe
  "sc" qc SensorDataService
  2⤵
  PID:4492
- C:\Windows\system32\sc.exe
  "sc" qc SensorService
  2⤵
  PID:2384
- C:\Windows\system32\sc.exe
  "sc" qc SensrSvc
  2⤵
  - Launches sc.exe
  PID:5000
- C:\Windows\system32\sc.exe
  "sc" qc SessionEnv
  2⤵
  PID:2420
- C:\Windows\system32\sc.exe
  "sc" qc SgrmBroker
  2⤵
  - Launches sc.exe
  PID:4140
- C:\Windows\system32\sc.exe
  "sc" qc SharedAccess
  2⤵
  PID:560
- C:\Windows\system32\sc.exe
  "sc" qc SharedRealitySvc
  2⤵
  PID:5532
- C:\Windows\system32\sc.exe
  "sc" qc ShellHWDetection
  2⤵
  PID:6136
- C:\Windows\system32\sc.exe
  "sc" qc shpamsvc
  2⤵
  - Launches sc.exe
  PID:5628
- C:\Windows\system32\sc.exe
  "sc" qc smphost
  2⤵
  PID:2228
- C:\Windows\system32\sc.exe
  "sc" qc SmsRouter
  2⤵
  - Launches sc.exe
  PID:4444
- C:\Windows\system32\sc.exe
  "sc" qc SNMPTrap
  2⤵
  PID:4592
- C:\Windows\system32\sc.exe
  "sc" qc spectrum
  2⤵
  PID:5996
- C:\Windows\system32\sc.exe
  "sc" qc Spooler
  2⤵
  PID:5612
- C:\Windows\system32\sc.exe
  "sc" qc sppsvc
  2⤵
  - Launches sc.exe
  PID:4776
- C:\Windows\system32\sc.exe
  "sc" qc SSDPSRV
  2⤵
  PID:4500
- C:\Windows\system32\sc.exe
  "sc" qc ssh-agent
  2⤵
  - Launches sc.exe
  PID:5972
- C:\Windows\system32\sc.exe
  "sc" qc SstpSvc
  2⤵
  PID:4672
- C:\Windows\system32\sc.exe
  "sc" qc StateRepository
  2⤵
  - Launches sc.exe
  PID:3432
- C:\Windows\system32\sc.exe
  "sc" qc StiSvc
  2⤵
  PID:1820
- C:\Windows\system32\sc.exe
  "sc" qc StorSvc
  2⤵
  - Launches sc.exe
  PID:5460
- C:\Windows\system32\sc.exe
  "sc" qc svsvc
  2⤵
  PID:4712
- C:\Windows\system32\sc.exe
  "sc" qc swprv
  2⤵
  PID:5168
- C:\Windows\system32\sc.exe
  "sc" qc SysMain
  2⤵
  PID:2932
- C:\Windows\system32\sc.exe
  "sc" qc SystemEventsBroker
  2⤵
  PID:1184
- C:\Windows\system32\sc.exe
  "sc" qc TabletInputService
  2⤵
  PID:2120
- C:\Windows\system32\sc.exe
  "sc" qc TapiSrv
  2⤵
  PID:6032
- C:\Windows\system32\sc.exe
  "sc" qc TermService
  2⤵
  - Launches sc.exe
  PID:4684
- C:\Windows\system32\sc.exe
  "sc" qc Themes
  2⤵
  PID:4236
- C:\Windows\system32\sc.exe
  "sc" qc TieringEngineService
  2⤵
  PID:4120
- C:\Windows\system32\sc.exe
  "sc" qc TimeBrokerSvc
  2⤵
  PID:3900
- C:\Windows\system32\sc.exe
  "sc" qc TokenBroker
  2⤵
  PID:2948
- C:\Windows\system32\sc.exe
  "sc" qc TrkWks
  2⤵
  PID:3568
- C:\Windows\system32\sc.exe
  "sc" qc TroubleshootingSvc
  2⤵
  PID:5732
- C:\Windows\system32\sc.exe
  "sc" qc TrustedInstaller
  2⤵
  PID:6116
- C:\Windows\system32\sc.exe
  "sc" qc tzautoupdate
  2⤵
  PID:3936
- C:\Windows\system32\sc.exe
  "sc" qc UevAgentService
  2⤵
  PID:1228
- C:\Windows\system32\sc.exe
  "sc" qc UmRdpService
  2⤵
  PID:2608
- C:\Windows\system32\sc.exe
  "sc" qc upnphost
  2⤵
  PID:4540
- C:\Windows\system32\sc.exe
  "sc" qc UserManager
  2⤵
  PID:2440
- C:\Windows\system32\sc.exe
  "sc" qc UsoSvc
  2⤵
  PID:4556
- C:\Windows\system32\sc.exe
  "sc" qc VacSvc
  2⤵
  PID:1624
- C:\Windows\system32\sc.exe
  "sc" qc VaultSvc
  2⤵
  PID:4680
- C:\Windows\system32\sc.exe
  "sc" qc vds
  2⤵
  PID:3328
- C:\Windows\system32\sc.exe
  "sc" qc vmicguestinterface
  2⤵
  PID:3912
- C:\Windows\system32\sc.exe
  "sc" qc vmicheartbeat
  2⤵
  PID:5928
- C:\Windows\system32\sc.exe
  "sc" qc vmickvpexchange
  2⤵
  PID:8
- C:\Windows\system32\sc.exe
  "sc" qc vmicrdv
  2⤵
  - Launches sc.exe
  PID:4532
- C:\Windows\system32\sc.exe
  "sc" qc vmicshutdown
  2⤵
  PID:2360
- C:\Windows\system32\sc.exe
  "sc" qc vmictimesync
  2⤵
  PID:5764
- C:\Windows\system32\sc.exe
  "sc" qc vmicvmsession
  2⤵
  PID:4032
- C:\Windows\system32\sc.exe
  "sc" qc vmicvss
  2⤵
  - Launches sc.exe
  PID:4004
- C:\Windows\system32\sc.exe
  "sc" qc VSS
  2⤵
  PID:3872
- C:\Windows\system32\sc.exe
  "sc" qc WalletService
  2⤵
  PID:4232
- C:\Windows\system32\sc.exe
  "sc" qc WarpJITSvc
  2⤵
  PID:2344
- C:\Windows\system32\sc.exe
  "sc" qc wbengine
  2⤵
  PID:1716
- C:\Windows\system32\sc.exe
  "sc" qc WbioSrvc
  2⤵
  PID:796
- C:\Windows\system32\sc.exe
  "sc" qc Wcmsvc
  2⤵
  PID:3692
- C:\Windows\system32\sc.exe
  "sc" qc wcncsvc
  2⤵
  PID:3524
- C:\Windows\system32\sc.exe
  "sc" qc WdiServiceHost
  2⤵
  - Launches sc.exe
  PID:2448
- C:\Windows\system32\sc.exe
  "sc" qc WdiSystemHost
  2⤵
  PID:5280
- C:\Windows\system32\sc.exe
  "sc" qc WebClient
  2⤵
  PID:656
- C:\Windows\system32\sc.exe
  "sc" qc Wecsvc
  2⤵
  - Launches sc.exe
  PID:1780
- C:\Windows\system32\sc.exe
  "sc" qc WEPHOSTSVC
  2⤵
  PID:5672
- C:\Windows\system32\sc.exe
  "sc" qc wercplsupport
  2⤵
  - Launches sc.exe
  PID:2652
- C:\Windows\system32\sc.exe
  "sc" qc WerSvc
  2⤵
  PID:4740
- C:\Windows\system32\sc.exe
  "sc" qc WFDSConMgrSvc
  2⤵
  PID:4480
- C:\Windows\system32\sc.exe
  "sc" qc WiaRpc
  2⤵
  PID:2468
- C:\Windows\system32\sc.exe
  "sc" qc WinHttpAutoProxySvc
  2⤵
  PID:2740
- C:\Windows\system32\sc.exe
  "sc" qc Winmgmt
  2⤵
  PID:1596
- C:\Windows\system32\sc.exe
  "sc" qc WinRM
  2⤵
  - Launches sc.exe
  PID:1984
- C:\Windows\system32\sc.exe
  "sc" qc wisvc
  2⤵
  PID:5768
- C:\Windows\system32\sc.exe
  "sc" qc WlanSvc
  2⤵
  PID:5492
- C:\Windows\system32\sc.exe
  "sc" qc wlidsvc
  2⤵
  PID:3308
- C:\Windows\system32\sc.exe
  "sc" qc wlpasvc
  2⤵
  - Launches sc.exe
  PID:5164
- C:\Windows\system32\sc.exe
  "sc" qc WManSvc
  2⤵
  PID:5556
- C:\Windows\system32\sc.exe
  "sc" qc wmiApSrv
  2⤵
  PID:5196
- C:\Windows\system32\sc.exe
  "sc" qc WMPNetworkSvc
  2⤵
  PID:2880
- C:\Windows\system32\sc.exe
  "sc" qc workfolderssvc
  2⤵
  - Launches sc.exe
  PID:3096
- C:\Windows\system32\sc.exe
  "sc" qc WpcMonSvc
  2⤵
  PID:4960
- C:\Windows\system32\sc.exe
  "sc" qc WPDBusEnum
  2⤵
  PID:5060
- C:\Windows\system32\sc.exe
  "sc" qc WpnService
  2⤵
  PID:5116
- C:\Windows\system32\sc.exe
  "sc" qc WSearch
  2⤵
  PID:1488
- C:\Windows\system32\sc.exe
  "sc" qc wuauserv
  2⤵
  - Launches sc.exe
  PID:4700
- C:\Windows\system32\sc.exe
  "sc" qc WwanSvc
  2⤵
  PID:3432
- C:\Windows\system32\sc.exe
  "sc" qc XblAuthManager
  2⤵
  PID:4980
- C:\Windows\system32\sc.exe
  "sc" qc XblGameSave
  2⤵
  - Launches sc.exe
  PID:4404
- C:\Windows\system32\sc.exe
  "sc" qc XboxGipSvc
  2⤵
  PID:4892
- C:\Windows\system32\sc.exe
  "sc" qc XboxNetApiSvc
  2⤵
  PID:5308
- C:\Windows\system32\sc.exe
  "sc" qc AarSvc_1eb4b
  2⤵
  - Launches sc.exe
  PID:1764
- C:\Windows\system32\sc.exe
  "sc" qc BcastDVRUserService_1eb4b
  2⤵
  PID:360
- C:\Windows\system32\sc.exe
  "sc" qc BluetoothUserService_1eb4b
  2⤵
  PID:2028
- C:\Windows\system32\sc.exe
  "sc" qc CaptureService_1eb4b
  2⤵
  PID:1508
- C:\Windows\system32\sc.exe
  "sc" qc cbdhsvc_1eb4b
  2⤵
  PID:4744
- C:\Windows\system32\sc.exe
  "sc" qc CDPUserSvc_1eb4b
  2⤵
  PID:2876
- C:\Windows\system32\sc.exe
  "sc" qc ConsentUxUserSvc_1eb4b
  2⤵
  PID:1620
- C:\Windows\system32\sc.exe
  "sc" qc CredentialEnrollmentManagerUserSvc_1eb4b
  2⤵
  - Launches sc.exe
  PID:1720
- C:\Windows\system32\sc.exe
  "sc" qc DeviceAssociationBrokerSvc_1eb4b
  2⤵
  PID:2564
- C:\Windows\system32\sc.exe
  "sc" qc DevicePickerUserSvc_1eb4b
  2⤵
  PID:5208
- C:\Windows\system32\sc.exe
  "sc" qc DevicesFlowUserSvc_1eb4b
  2⤵
  PID:1288
- C:\Windows\system32\sc.exe
  "sc" qc MessagingService_1eb4b
  2⤵
  PID:5740
- C:\Windows\system32\sc.exe
  "sc" qc NPSMSvc_1eb4b
  2⤵
  PID:728
- C:\Windows\system32\sc.exe
  "sc" qc OneSyncSvc_1eb4b
  2⤵
  - Launches sc.exe
  PID:4180
- C:\Windows\system32\sc.exe
  "sc" qc P9RdrService_1eb4b
  2⤵
  PID:5892
- C:\Windows\system32\sc.exe
  "sc" qc PenService_1eb4b
  2⤵
  PID:1028
- C:\Windows\system32\sc.exe
  "sc" qc PimIndexMaintenanceSvc_1eb4b
  2⤵
  PID:2424
- C:\Windows\system32\sc.exe
  "sc" qc PrintWorkflowUserSvc_1eb4b
  2⤵
  - Launches sc.exe
  PID:6108
- C:\Windows\system32\sc.exe
  "sc" qc UdkUserSvc_1eb4b
  2⤵
  - Launches sc.exe
  PID:1512
- C:\Windows\system32\sc.exe
  "sc" qc UnistoreSvc_1eb4b
  2⤵
  PID:6120
- C:\Windows\system32\sc.exe
  "sc" qc UserDataSvc_1eb4b
  2⤵
  PID:3912
- C:\Windows\system32\sc.exe
  "sc" qc WpnUserService_1eb4b
  2⤵
  PID:5004
- C:\Windows\system32\cmd.exe
  "cmd" /c "wmic process where \"ExecutablePath like '%C:\\ProgramData%Microsoft%'\" get ProcessId /format:csv 2>nul"
  2⤵
  PID:5876
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where \"ExecutablePath like '%C:\\ProgramData%Microsoft%'\" get ProcessId /format:csv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5200
- C:\Windows\system32\netstat.exe
  "netstat" -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsTelemetry /f
  2⤵
  - Modifies registry key
  PID:5380
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftTelemetry /f
  2⤵
  - Modifies registry key
  PID:2176
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemTelemetry /f
  2⤵
  - Modifies registry key
  PID:5936
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinTelemetry /f
  2⤵
  - Modifies registry key
  PID:1060
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetTelemetry /f
  2⤵
  - Modifies registry key
  PID:4044
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthCheck /f
  2⤵
  - Modifies registry key
  PID:4616
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftHealthCheck /f
  2⤵
  - Modifies registry key
  PID:5480
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemHealthCheck /f
  2⤵
  - Modifies registry key
  PID:3692
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinHealthCheck /f
  2⤵
  - Modifies registry key
  PID:3688
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetHealthCheck /f
  2⤵
  - Modifies registry key
  PID:3828
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsNetProfile /f
  2⤵
  - Modifies registry key
  PID:5752
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftNetProfile /f
  2⤵
  - Modifies registry key
  PID:5468
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemNetProfile /f
  2⤵
  - Modifies registry key
  PID:5640
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinNetProfile /f
  2⤵
  - Modifies registry key
  PID:4912
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetNetProfile /f
  2⤵
  - Modifies registry key
  PID:3240
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsDiagTrack /f
  2⤵
  - Modifies registry key
  PID:4000
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftDiagTrack /f
  2⤵
  - Modifies registry key
  PID:5748
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemDiagTrack /f
  2⤵
  - Modifies registry key
  PID:2852
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinDiagTrack /f
  2⤵
  - Modifies registry key
  PID:3288
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetDiagTrack /f
  2⤵
  - Modifies registry key
  PID:1984
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsAppVerifier /f
  2⤵
  - Modifies registry key
  PID:3848
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftAppVerifier /f
  2⤵
  - Modifies registry key
  PID:6136
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemAppVerifier /f
  2⤵
  - Modifies registry key
  PID:724
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinAppVerifier /f
  2⤵
  - Modifies registry key
  PID:960
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetAppVerifier /f
  2⤵
  - Modifies registry key
  PID:4444
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsDeviceSetup /f
  2⤵
  - Modifies registry key
  PID:3228
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftDeviceSetup /f
  2⤵
  - Modifies registry key
  PID:5964
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemDeviceSetup /f
  2⤵
  - Modifies registry key
  PID:4384
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinDeviceSetup /f
  2⤵
  - Modifies registry key
  PID:4500
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetDeviceSetup /f
  2⤵
  - Modifies registry key
  PID:5968
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsCompatCache /f
  2⤵
  - Modifies registry key
  PID:1488
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftCompatCache /f
  2⤵
  - Modifies registry key
  PID:4700
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemCompatCache /f
  2⤵
  - Modifies registry key
  PID:3432
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinCompatCache /f
  2⤵
  - Modifies registry key
  PID:4980
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetCompatCache /f
  2⤵
  - Modifies registry key
  PID:1120
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsTokenBroker /f
  2⤵
  - Modifies registry key
  PID:6100
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftTokenBroker /f
  2⤵
  - Modifies registry key
  PID:4936
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemTokenBroker /f
  2⤵
  - Modifies registry key
  PID:4036
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinTokenBroker /f
  2⤵
  - Modifies registry key
  PID:2120
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetTokenBroker /f
  2⤵
  - Modifies registry key
  PID:6032
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsPerformanceLog /f
  2⤵
  - Modifies registry key
  PID:4688
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftPerformanceLog /f
  2⤵
  - Modifies registry key
  PID:3128
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemPerformanceLog /f
  2⤵
  - Modifies registry key
  PID:2316
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinPerformanceLog /f
  2⤵
  - Modifies registry key
  PID:1516
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetPerformanceLog /f
  2⤵
  - Modifies registry key
  PID:1432
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsSecurityHealth /f
  2⤵
  - Modifies registry key
  PID:5376
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MicrosoftSecurityHealth /f
  2⤵
  - Modifies registry key
  PID:2588
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SystemSecurityHealth /f
  2⤵
  - Modifies registry key
  PID:4964
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinSecurityHealth /f
  2⤵
  - Modifies registry key
  PID:2672
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v NetSecurityHealth /f
  2⤵
  - Modifies registry key
  PID:4840
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD7CF5D0792} /f
  2⤵
  - Modifies registry key
  PID:4828
- C:\Windows\system32\reg.exe
  "reg" delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ EnhancedStorageShell" /f
  2⤵
  PID:5952
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /TN \Microsoft\Windows\AppTask\SyncHost-{05A7B-E0190-482BF-A7C1} /F
  2⤵
  PID:1028
- C:\Windows\System32\Wbem\mofcomp.exe
  "mofcomp.exe" C:\Users\Admin\AppData\Local\Temp\_cl.mof
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Users\Admin\AppData\Local\SysCache\smss64.exe
  "C:\Users\Admin\AppData\Local\SysCache\smss64.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Modifies Windows Defender notification settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionProcess 'smss64.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'NetTokenSvc.exe' -ErrorAction SilentlyContinue" >nul 2>&1
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:5924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionProcess 'smss64.exe' -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess 'NetTokenSvc.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5480
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\NetPerformanceLog' -ErrorAction SilentlyContinue" >nul 2>&1
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Ignore Process Interrupts
    PID:5752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ep bypass -w hidden -c "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\NetPerformanceLog' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1096
- C:\Windows\System32\Wbem\mofcomp.exe
  mofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_wd.mof"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2460
- C:\Windows\System32\Wbem\mofcomp.exe
  mofcomp.exe "C:\Users\Admin\AppData\Local\Temp\_ws.mof"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3564
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn \Microsoft\Windows\WindowsUpdate\AutoUpdate /tr C:\Users\Admin\AppData\Local\SysCache\smss64.exe /sc ONLOGON /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5332

C:\Users\Admin\AppData\Local\SysCache\smss64.exe
C:\Users\Admin\AppData\Local\SysCache\smss64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5936

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3864

C:\ProgramData\Microsoft\NetPerformanceLog\smss64.exe
C:\ProgramData\Microsoft\NetPerformanceLog\smss64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

T1082

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion