c20ef8a7b6882fd47ab65169d41659c4881583118a08be9836827b31573d829d

Analysis

user interaction
yes
max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Risxn's Process Lowering Pack V4.rar
Size 508KB
Sample260715-cb3dkab14x
SHA256 c20ef8a7b6882fd47ab65169d41659c4881583118a08be9836827b31573d829d
MD5 ce70aa1f6fa1cc0a14e079fc56b65970
SHA1 b58671b63bb764f285896a824f5020c314e651fa
SHA512 0034f6177a6af1305903d554a4611c8c7a0e77bb511ceb0b9cb3c767a2febc113ce372ac9643637ca4181cb124f7e99c02ddee6c472b9069b35f6869431263bf
SSDEEP 12288:MfYoh0Bs57nrMWRQKnjBF1Z04MZAbD/0aBrn6zwiGVd:MtKBQ7rdRQKnVF1Zffco
TLSH
T122B423D6673A1E183CEA36FB0CA3D66FA2519CC2DC5335770633917F2C0A4A5B06CA91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence ransomware

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3172	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
420	sc.exe
388	sc.exe
4060	sc.exe
4360	sc.exe
4916	sc.exe
4948	sc.exe
4552	sc.exe
204	sc.exe
4152	sc.exe
4200	sc.exe
3084	sc.exe
2028	sc.exe
4600	sc.exe
880	sc.exe
2624	sc.exe
3480	sc.exe
2236	sc.exe
2944	sc.exe
4396	sc.exe
2640	sc.exe
1192	sc.exe
1528	sc.exe
5112	sc.exe
3728	sc.exe
3484	sc.exe
3960	sc.exe
3172	sc.exe
4324	sc.exe
2840	sc.exe
3788	sc.exe
892	sc.exe
4272	sc.exe
4340	sc.exe
2396	sc.exe
3776	sc.exe
4100	sc.exe
2144	sc.exe
4480	sc.exe
4016	sc.exe
2308	sc.exe
4672	sc.exe
3448	sc.exe
1196	sc.exe
3032	sc.exe
1452	sc.exe
4284	sc.exe
3044	sc.exe
4492	sc.exe
3732	sc.exe
5108	sc.exe
4484	sc.exe
3840	sc.exe
4348	sc.exe
4424	sc.exe
4156	sc.exe
2196	sc.exe
4308	sc.exe
3616	sc.exe
3848	sc.exe
3296	sc.exe
5000	sc.exe
4364	sc.exe
1668	sc.exe
3084	sc.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3172	powershell.exe
3172	powershell.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3764	7zFM.exe
756	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeRestorePrivilege	3764	7zFM.exe
Token: 35	3764	7zFM.exe
Token: SeSecurityPrivilege	3764	7zFM.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeBackupPrivilege	4884	vssvc.exe
Token: SeRestorePrivilege	4884	vssvc.exe
Token: SeAuditPrivilege	4884	vssvc.exe
Token: SeDebugPrivilege	756	taskmgr.exe
Token: SeSystemProfilePrivilege	756	taskmgr.exe
Token: SeCreateGlobalPrivilege	756	taskmgr.exe
Token: SeBackupPrivilege	1852	srtasks.exe
Token: SeRestorePrivilege	1852	srtasks.exe
Token: SeSecurityPrivilege	1852	srtasks.exe
Token: SeTakeOwnershipPrivilege	1852	srtasks.exe
Token: SeBackupPrivilege	1852	srtasks.exe
Token: SeRestorePrivilege	1852	srtasks.exe
Token: SeSecurityPrivilege	1852	srtasks.exe
Token: SeTakeOwnershipPrivilege	1852	srtasks.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3764	7zFM.exe
3764	7zFM.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe
756	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 4020	3764	7zFM.exe	87
PID 4020 wrote to memory of 3172	4020	cmd.exe	90
PID 4020 wrote to memory of 4028	4020	cmd.exe	102
PID 4020 wrote to memory of 3420	4020	cmd.exe	103
PID 4020 wrote to memory of 2388	4020	cmd.exe	107
PID 4020 wrote to memory of 3992	4020	cmd.exe	108
PID 4020 wrote to memory of 1608	4020	cmd.exe	109
PID 4020 wrote to memory of 4156	4020	cmd.exe	110
PID 4020 wrote to memory of 4260	4020	cmd.exe	111
PID 4020 wrote to memory of 1628	4020	cmd.exe	112
PID 4020 wrote to memory of 2308	4020	cmd.exe	113
PID 4020 wrote to memory of 2568	4020	cmd.exe	114
PID 4020 wrote to memory of 5032	4020	cmd.exe	115
PID 4020 wrote to memory of 4064	4020	cmd.exe	116
PID 4020 wrote to memory of 4524	4020	cmd.exe	117
PID 4020 wrote to memory of 4452	4020	cmd.exe	118
PID 4020 wrote to memory of 2640	4020	cmd.exe	119
PID 4020 wrote to memory of 3448	4020	cmd.exe	120
PID 4020 wrote to memory of 3084	4020	cmd.exe	121
PID 4020 wrote to memory of 4360	4020	cmd.exe	122
PID 4020 wrote to memory of 3172	4020	cmd.exe	123
PID 4020 wrote to memory of 4324	4020	cmd.exe	124
PID 4020 wrote to memory of 3732	4020	cmd.exe	125
PID 4020 wrote to memory of 1196	4020	cmd.exe	126
PID 4020 wrote to memory of 5108	4020	cmd.exe	127
PID 4020 wrote to memory of 892	4020	cmd.exe	128
PID 4020 wrote to memory of 4484	4020	cmd.exe	129
PID 4020 wrote to memory of 1528	4020	cmd.exe	130
PID 4020 wrote to memory of 2072	4020	cmd.exe	131
PID 4020 wrote to memory of 4340	4020	cmd.exe	132
PID 4020 wrote to memory of 4600	4020	cmd.exe	133
PID 4020 wrote to memory of 5112	4020	cmd.exe	134
PID 4020 wrote to memory of 3840	4020	cmd.exe	135
PID 4020 wrote to memory of 3032	4020	cmd.exe	136
PID 4020 wrote to memory of 4916	4020	cmd.exe	137
PID 4020 wrote to memory of 880	4020	cmd.exe	138
PID 4020 wrote to memory of 2840	4020	cmd.exe	139
PID 4020 wrote to memory of 3788	4020	cmd.exe	140
PID 4020 wrote to memory of 4308	4020	cmd.exe	141
PID 4020 wrote to memory of 1452	4020	cmd.exe	142
PID 4020 wrote to memory of 2624	4020	cmd.exe	143
PID 4020 wrote to memory of 3616	4020	cmd.exe	144
PID 4020 wrote to memory of 4348	4020	cmd.exe	145
PID 4020 wrote to memory of 420	4020	cmd.exe	146
PID 4020 wrote to memory of 3848	4020	cmd.exe	147
PID 4020 wrote to memory of 2396	4020	cmd.exe	148
PID 4020 wrote to memory of 3296	4020	cmd.exe	149
PID 4020 wrote to memory of 1800	4020	cmd.exe	150
PID 4020 wrote to memory of 1580	4020	cmd.exe	151
PID 4020 wrote to memory of 1468	4020	cmd.exe	152
PID 4020 wrote to memory of 1028	4020	cmd.exe	153
PID 4020 wrote to memory of 1192	4020	cmd.exe	154
PID 4020 wrote to memory of 3480	4020	cmd.exe	155
PID 4020 wrote to memory of 4100	4020	cmd.exe	156
PID 4020 wrote to memory of 4016	4020	cmd.exe	157
PID 4020 wrote to memory of 3508	4020	cmd.exe	158
PID 4020 wrote to memory of 4944	4020	cmd.exe	159
PID 4020 wrote to memory of 4284	4020	cmd.exe	160
PID 4020 wrote to memory of 3044	4020	cmd.exe	161
PID 4020 wrote to memory of 2236	4020	cmd.exe	162
PID 4020 wrote to memory of 3776	4020	cmd.exe	163
PID 4020 wrote to memory of 2028	4020	cmd.exe	164
PID 4020 wrote to memory of 4948	4020	cmd.exe	165
PID 4020 wrote to memory of 2872	4020	cmd.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Risxn's Process Lowering Pack V4.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO4BE5EF68\Risxn's Process Panel V4.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Checkpoint-Computer -Description 'Risxn Process Lowering V4' -RestorePointType 'MODIFY_SETTINGS'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\system32\mode.com
    mode 120,30
    3⤵
    PID:4028
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3420
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:2388
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\BcastDVRUserService" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:3992
- - C:\Windows\system32\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\xbgm" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:1608
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AppCaptureEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:4156
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "AudioCaptureEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:4260
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "CursorCaptureEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:1628
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\GameDVR" /v "MicrophoneCaptureEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:2308
- - C:\Windows\system32\reg.exe
    reg add "HKCU\System\GameConfigStore" /v "GameDVR_FSEBehavior" /t REG_DWORD /d "2" /f
    3⤵
    PID:2568
- - C:\Windows\system32\reg.exe
    reg add "HKCU\System\GameConfigStore" /v "GameDVR_HonorUserFSEBehaviorMode" /t REG_DWORD /d "2" /f
    3⤵
    PID:5032
- - C:\Windows\system32\reg.exe
    reg add "HKCU\System\GameConfigStore" /v "GameDVR_Enabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:4064
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\GameDVR" /v "AllowgameDVR" /t REG_DWORD /d "0" /f
    3⤵
    PID:4524
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\GameBar" /v "AutoGameModeEnabled" /t REG_DWORD /d "0" /f
    3⤵
    PID:4452
- - C:\Windows\system32\sc.exe
    sc config wlidsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2640
- - C:\Windows\system32\sc.exe
    sc config DiagTrack start= disabled
    3⤵
    - Launches sc.exe
    PID:3448
- - C:\Windows\system32\sc.exe
    sc config DusmSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3084
- - C:\Windows\system32\sc.exe
    sc config RetailDemo start= disabled
    3⤵
    - Launches sc.exe
    PID:4360
- - C:\Windows\system32\sc.exe
    sc config Fax start= disabled
    3⤵
    - Launches sc.exe
    PID:3172
- - C:\Windows\system32\sc.exe
    sc config lfsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4324
- - C:\Windows\system32\sc.exe
    sc config WpcMonSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3732
- - C:\Windows\system32\sc.exe
    sc config SessionEnv start= disabled
    3⤵
    - Launches sc.exe
    PID:1196
- - C:\Windows\system32\sc.exe
    sc config MicrosoftEdgeElevationService start= disabled
    3⤵
    - Launches sc.exe
    PID:5108
- - C:\Windows\system32\sc.exe
    sc config edgeupdate start= disabled
    3⤵
    - Launches sc.exe
    PID:892
- - C:\Windows\system32\sc.exe
    sc config edgeupdatem start= disabled
    3⤵
    - Launches sc.exe
    PID:4484
- - C:\Windows\system32\sc.exe
    sc config autotimesvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1528
- - C:\Windows\system32\sc.exe
    sc config CscService start= disabled
    3⤵
    PID:2072
- - C:\Windows\system32\sc.exe
    sc config TermService start= disabled
    3⤵
    - Launches sc.exe
    PID:4340
- - C:\Windows\system32\sc.exe
    sc config SensrSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4600
- - C:\Windows\system32\sc.exe
    sc config shpamsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:5112
- - C:\Windows\system32\sc.exe
    sc config diagnosticshub.standardcollector.service start= disabled
    3⤵
    - Launches sc.exe
    PID:3840
- - C:\Windows\system32\sc.exe
    sc config PhoneSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3032
- - C:\Windows\system32\sc.exe
    sc config TapiSrv start= disabled
    3⤵
    - Launches sc.exe
    PID:4916
- - C:\Windows\system32\sc.exe
    sc config UevAgentService start= disabled
    3⤵
    - Launches sc.exe
    PID:880
- - C:\Windows\system32\sc.exe
    sc config WalletService start= disabled
    3⤵
    - Launches sc.exe
    PID:2840
- - C:\Windows\system32\sc.exe
    sc config TokenBroker start= disabled
    3⤵
    - Launches sc.exe
    PID:3788
- - C:\Windows\system32\sc.exe
    sc config WebClient start= disabled
    3⤵
    - Launches sc.exe
    PID:4308
- - C:\Windows\system32\sc.exe
    sc config MixedRealityOpenXRSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1452
- - C:\Windows\system32\sc.exe
    sc config stisvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2624
- - C:\Windows\system32\sc.exe
    sc config WbioSrvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3616
- - C:\Windows\system32\sc.exe
    sc config Wecsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4348
- - C:\Windows\system32\sc.exe
    sc config XboxGipSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:420
- - C:\Windows\system32\sc.exe
    sc config XblAuthManager start= disabled
    3⤵
    - Launches sc.exe
    PID:3848
- - C:\Windows\system32\sc.exe
    sc config XboxNetApiSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2396
- - C:\Windows\system32\sc.exe
    sc config XblGameSave start= disabled
    3⤵
    - Launches sc.exe
    PID:3296
- - C:\Windows\system32\sc.exe
    sc config SEMgrSvc start= disabled
    3⤵
    PID:1800
- - C:\Windows\system32\sc.exe
    sc config Backupper Service start= disabled
    3⤵
    PID:1580
- - C:\Windows\system32\sc.exe
    sc config BthAvctpSvc start= disabled
    3⤵
    PID:1468
- - C:\Windows\system32\sc.exe
    sc config BDESVC start= disabled
    3⤵
    PID:1028
- - C:\Windows\system32\sc.exe
    sc config cbdhsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1192
- - C:\Windows\system32\sc.exe
    sc config CDPSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3480
- - C:\Windows\system32\sc.exe
    sc config DevQueryBroker start= disabled
    3⤵
    - Launches sc.exe
    PID:4100
- - C:\Windows\system32\sc.exe
    sc config dmwappushservice start= disabled
    3⤵
    - Launches sc.exe
    PID:4016
- - C:\Windows\system32\sc.exe
    sc config TrkWks start= disabled
    3⤵
    PID:3508
- - C:\Windows\system32\sc.exe
    sc config dLauncherLoopback start= disabled
    3⤵
    PID:4944
- - C:\Windows\system32\sc.exe
    sc config EFS start= disabled
    3⤵
    - Launches sc.exe
    PID:4284
- - C:\Windows\system32\sc.exe
    sc config fdPHost start= disabled
    3⤵
    - Launches sc.exe
    PID:3044
- - C:\Windows\system32\sc.exe
    sc config FDResPub start= disabled
    3⤵
    - Launches sc.exe
    PID:2236
- - C:\Windows\system32\sc.exe
    sc config IKEEXT start= disabled
    3⤵
    - Launches sc.exe
    PID:3776
- - C:\Windows\system32\sc.exe
    sc config WPDBusEnum start= disabled
    3⤵
    - Launches sc.exe
    PID:2028
- - C:\Windows\system32\sc.exe
    sc config PcaSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4948
- - C:\Windows\system32\sc.exe
    sc config RasMan start= disabled
    3⤵
    PID:2872
- - C:\Windows\system32\sc.exe
    sc config RetailDemo start=disabled
    3⤵
    - Launches sc.exe
    PID:5000
- - C:\Windows\system32\sc.exe
    sc config SstpSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:2144
- - C:\Windows\system32\sc.exe
    sc config SSDPSRV start= disabled
    3⤵
    - Launches sc.exe
    PID:388
- - C:\Windows\system32\sc.exe
    sc config SysMain start= disabled
    3⤵
    - Launches sc.exe
    PID:4672
- - C:\Windows\system32\sc.exe
    sc config OneSyncSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4552
- - C:\Windows\system32\sc.exe
    sc config FontCache start= disabled
    3⤵
    - Launches sc.exe
    PID:4364
- - C:\Windows\system32\sc.exe
    sc config W32Time start= disabled
    3⤵
    PID:3688
- - C:\Windows\system32\sc.exe
    sc config tzautoupdate start= disabled
    3⤵
    - Launches sc.exe
    PID:3960
- - C:\Windows\system32\sc.exe
    sc config DsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:204
- - C:\Windows\system32\sc.exe
    sc config diagsvc start= disabled
    3⤵
    PID:4860
- - C:\Windows\system32\sc.exe
    sc config DialogBlockingService start= disabled
    3⤵
    - Launches sc.exe
    PID:4424
- - C:\Windows\system32\sc.exe
    sc config PimIndexMaintenanceSvc_5f1ad start= disabled
    3⤵
    - Launches sc.exe
    PID:4152
- - C:\Windows\system32\sc.exe
    sc config MessagingService_5f1ad start= disabled
    3⤵
    - Launches sc.exe
    PID:4200
- - C:\Windows\system32\sc.exe
    sc config AppVClient start= disabled
    3⤵
    - Launches sc.exe
    PID:4156
- - C:\Windows\system32\sc.exe
    sc config MsKeyboardFilter start= disabled
    3⤵
    - Launches sc.exe
    PID:4492
- - C:\Windows\system32\sc.exe
    sc config ssh-agent start= disabled
    3⤵
    - Launches sc.exe
    PID:2196
- - C:\Windows\system32\sc.exe
    sc config SstpSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3728
- - C:\Windows\system32\sc.exe
    sc config OneSyncSvc_5f1ad start= disabled
    3⤵
    - Launches sc.exe
    PID:2308
- - C:\Windows\system32\sc.exe
    sc config wercplsupport start= disabled
    3⤵
    - Launches sc.exe
    PID:3484
- - C:\Windows\system32\sc.exe
    sc config WerSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4272
- - C:\Windows\system32\sc.exe
    sc config WpnUserService_5f1ad start= disabled
    3⤵
    - Launches sc.exe
    PID:2944
- - C:\Windows\system32\sc.exe
    sc config DsmSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4060
- - C:\Windows\system32\schtasks.exe
    schtasks /DELETE /TN "AMDInstallLauncher" /f
    3⤵
    PID:4524
- - C:\Windows\system32\schtasks.exe
    schtasks /DELETE /TN "AMDLinkUpdate" /f
    3⤵
    PID:4452
- - C:\Windows\system32\schtasks.exe
    schtasks /DELETE /TN "AMDRyzenMasterSDKTask" /f
    3⤵
    PID:3812
- - C:\Windows\system32\schtasks.exe
    schtasks /DELETE /TN "Driver Easy Scheduled Scan" /f
    3⤵
    PID:4736
- - C:\Windows\system32\schtasks.exe
    schtasks /DELETE /TN "ModifyLinkUpdate" /f
    3⤵
    PID:1740
- - C:\Windows\system32\schtasks.exe
    schtasks /DELETE /TN "SoftMakerUpdater" /f
    3⤵
    PID:3172
- - C:\Windows\system32\schtasks.exe
    schtasks /DELETE /TN "StartCN" /f
    3⤵
    PID:4324
- - C:\Windows\system32\schtasks.exe
    schtasks /DELETE /TN "StartDVR" /f
    3⤵
    PID:3432
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /Disable
    3⤵
    PID:5108
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Application Experience\PcaPatchDbTask" /Disable
    3⤵
    PID:892
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Application Experience\ProgramDataUpdater" /Disable
    3⤵
    PID:4484
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Application Experience\StartupAppTask" /Disable
    3⤵
    PID:1528
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Autochk\Proxy" /Disable
    3⤵
    PID:4896
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /Disable
    3⤵
    PID:648
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /Disable
    3⤵
    PID:4916
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Defrag\ScheduledDefrag" /Disable
    3⤵
    PID:880
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Device Information\Device User" /Disable
    3⤵
    PID:3352
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner" /Disable
    3⤵
    PID:3796
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Diagnosis\Scheduled" /Disable
    3⤵
    PID:1436
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\DiskCleanup\SilentCleanup" /Disable
    3⤵
    PID:2224
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /Disable
    3⤵
    PID:5072
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\DiskFootprint\Diagnostics" /Disable
    3⤵
    PID:5028
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\DiskFootprint\StorageSense" /Disable
    3⤵
    PID:4864
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\DUSM\dusmtask" /Disable
    3⤵
    PID:3868
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\EnterpriseMgmt\MDMMaintenenceTask" /Disable
    3⤵
    PID:2396
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClient" /Disable
    3⤵
    PID:1772
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /Disable
    3⤵
    PID:3028
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\FileHistory\File History (maintenance mode)" /Disable
    3⤵
    PID:1276
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures" /Disable
    3⤵
    PID:1524
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\UsageDataFlushing" /Disable
    3⤵
    PID:4588
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Flighting\FeatureConfig\UsageDataReporting" /Disable
    3⤵
    PID:5020
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Flighting\OneSettings\RefreshCache" /Disable
    3⤵
    PID:2852
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Input\LocalUserSyncDataAvailable" /Disable
    3⤵
    PID:4344
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Input\MouseSyncDataAvailable" /Disable
    3⤵
    PID:2832
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Input\PenSyncDataAvailable" /Disable
    3⤵
    PID:4392
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Input\TouchpadSyncDataAvailable" /Disable
    3⤵
    PID:3724
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\International\Synchronize Language Settings" /Disable
    3⤵
    PID:3844
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\Installation" /Disable
    3⤵
    PID:3776
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\ReconcileLanguageResources" /Disable
    3⤵
    PID:456
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\LanguageComponentsInstaller\Uninstallation" /Disable
    3⤵
    PID:3896
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\License Manager\TempSignedLicenseExchange" /Disable
    3⤵
    PID:2532
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\License Manager\TempSignedLicenseExchange" /Disable
    3⤵
    PID:2144
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Management\Provisioning\Cellular" /Disable
    3⤵
    PID:4416
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Management\Provisioning\Logon" /Disable
    3⤵
    PID:4128
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Maintenance\WinSAT" /Disable
    3⤵
    PID:4364
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Maps\MapsToastTask" /Disable
    3⤵
    PID:2932
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Maps\MapsUpdateTask" /Disable
    3⤵
    PID:544
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser" /Disable
    3⤵
    PID:1668
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\MUI\LPRemove" /Disable
    3⤵
    PID:1628
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\NetTrace\GatherNetworkInfo" /Disable
    3⤵
    PID:4876
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\PI\Sqm-Tasks" /Disable
    3⤵
    PID:4964
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /Disable
    3⤵
    PID:744
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\PushToInstall\Registration" /Disable
    3⤵
    PID:4396
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Ras\MobilityManager" /Disable
    3⤵
    PID:3448
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\RecoveryEnvironment\VerifyWinRE" /Disable
    3⤵
    PID:1520
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask" /Disable
    3⤵
    PID:1788
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\RetailDemo\CleanupOfflineContent" /Disable
    3⤵
    PID:4324
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Servicing\StartComponentCleanup" /Disable
    3⤵
    PID:3432
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\SettingSync\NetworkStateChangeTask" /Disable
    3⤵
    PID:660
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Setup\SetupCleanupTask" /Disable
    3⤵
    PID:2364
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Setup\SnapshotCleanupTask" /Disable
    3⤵
    PID:4340
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\SpacePort\SpaceAgentTask" /Disable
    3⤵
    PID:1528
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\SpacePort\SpaceManagerTask" /Disable
    3⤵
    PID:4896
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Speech\SpeechModelDownloadTask" /Disable
    3⤵
    PID:648
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Storage Tiers Management\Storage Tiers Management Initialization" /Disable
    3⤵
    PID:4916
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Sysmain\ResPriStaticDbSync" /Disable
    3⤵
    PID:880
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Sysmain\WsSwapAssessmentTask" /Disable
    3⤵
    PID:3352
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Task Manager\Interactive" /Disable
    3⤵
    PID:3796
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Time Synchronization\ForceSynchronizeTime" /Disable
    3⤵
    PID:1436
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Time Synchronization\SynchronizeTime" /Disable
    3⤵
    PID:2624
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Time Zone\SynchronizeTimeZone" /Disable
    3⤵
    PID:3616
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\TPM\Tpm-HASCertRetr" /Disable
    3⤵
    PID:4320
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\TPM\Tpm-Maintenance" /Disable
    3⤵
    PID:5028
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\UPnP\UPnPHostConfig" /Disable
    3⤵
    PID:2220
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\User Profile Service\HiveUploadTask" /Disable
    3⤵
    PID:5100
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\WDI\ResolutionHost" /Disable
    3⤵
    PID:4080
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange" /Disable
    3⤵
    PID:2968
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\WOF\WIM-Hash-Management" /Disable
    3⤵
    PID:2416
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\WOF\WIM-Hash-Validation" /Disable
    3⤵
    PID:5096
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Work Folders\Work Folders Logon Synchronization" /Disable
    3⤵
    PID:1556
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Work Folders\Work Folders Maintenance Work" /Disable
    3⤵
    PID:2988
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Workplace Join\Automatic-Device-Join" /Disable
    3⤵
    PID:4980
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\WwanSvc\NotificationTask" /Disable
    3⤵
    PID:3480
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\WwanSvc\OobeDiscovery" /Disable
    3⤵
    PID:1508
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /Disable
    3⤵
    PID:4412
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4416
- - C:\Windows\system32\sc.exe
    sc config PrintNotify start= disabled
    3⤵
    - Launches sc.exe
    PID:4480
- - C:\Windows\system32\sc.exe
    sc config Spooler start= disabled
    3⤵
    - Launches sc.exe
    PID:1668
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Printing\EduPrintProv" /Disable
    3⤵
    PID:1628
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Printing\PrinterCleanupTask" /Disable
    3⤵
    PID:4876
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1796
- - C:\Windows\system32\sc.exe
    sc config BTAGService start= disabled
    3⤵
    - Launches sc.exe
    PID:4396
- - C:\Windows\system32\sc.exe
    sc config bthserv start= disabled
    3⤵
    - Launches sc.exe
    PID:3084
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Risxn's Process Panel V4.bat

Path C:\Users\Admin\AppData\Local\Temp\7zO4BE5EF68\Risxn's Process Panel V4.bat
Size 40KB
SHA256 200a9e24e7e9c39c873eff0b7bd15c60490bb02c5ea0860236973c652eb768e3
MD5 7899db7c201419854349144b176c91f4
SHA1 75c22479d8d5c622b63384f04e5fd5d3597ee17f
SHA512 cf085796f78f18362dbe0aa13d6a2d372654b8b823a09f94e72ad0d8c110aaa3aae18379fb45fe8a1dddba7820dc52723183643524f721cb4edc1efb7a10c5ae
SSDEEP 384:IakElQKac+iDMlsB4VzTPc2P7fLz0DW13r7/4QfvLzdbndDDtF7z97zDDnLD91n4:zkElQKac+iDMmTDhL5bGgdQag9y
TLSH
T100039E267466FC178960F9D15CAF6A517F1403C3A900BBE171CD247CA66B38BE22F89D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_nc05lq1x.p1y.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nc05lq1x.p1y.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/756-29-0x000001E8F1FC0000-0x000001E8F1FC1000-memory.dmp

Download

memory/756-28-0x000001E8F1FC0000-0x000001E8F1FC1000-memory.dmp

Download

memory/756-25-0x000001E8F1FC0000-0x000001E8F1FC1000-memory.dmp

Download

memory/756-26-0x000001E8F1FC0000-0x000001E8F1FC1000-memory.dmp

Download

memory/756-27-0x000001E8F1FC0000-0x000001E8F1FC1000-memory.dmp

Download

memory/756-19-0x000001E8F1FC0000-0x000001E8F1FC1000-memory.dmp

Download

memory/756-20-0x000001E8F1FC0000-0x000001E8F1FC1000-memory.dmp

Download

memory/756-21-0x000001E8F1FC0000-0x000001E8F1FC1000-memory.dmp

Download

memory/756-31-0x000001E8F1FC0000-0x000001E8F1FC1000-memory.dmp

Download

memory/756-30-0x000001E8F1FC0000-0x000001E8F1FC1000-memory.dmp

Download

memory/3172-16-0x000001E6E4640000-0x000001E6E4650000-memory.dmp

Download

memory/3172-5-0x000001E6E4640000-0x000001E6E4650000-memory.dmp

Download

memory/3172-6-0x000001E6E4640000-0x000001E6E4650000-memory.dmp

Download

memory/3172-15-0x000001E6E4640000-0x000001E6E4650000-memory.dmp

Download

memory/3172-14-0x000001E6E4610000-0x000001E6E4632000-memory.dmp

Download