ce2c38d647e147de887087c16d20ae19ce6356aa9e188fbb4a20db394ab77bee

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\winlogon.exe,"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Windows\\System32\\winlogon.exe"	reg.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Process not Found

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Process not Found

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Process not Found

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

pid	Process
1332	Process not Found
11588	Process not Found

Adds policy Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_61 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_82 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_68 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_45 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_27 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Process not Found
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_65 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_26 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_53 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_55 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_56 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_37 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_67 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_41 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_0 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_10 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_38 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_43 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_28 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_32 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_74 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_46 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_92 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_51 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_66 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_36 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_33 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_31 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_83 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_95 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_54 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_7 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_76 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_63 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinSysHelper11_49 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Process not Found

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
6092	Process not Found

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Process not Found

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts_sys.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts_sys.exe	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts_sys.exe	attrib.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
10536	Process not Found

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
11760	Process not Found
11204	Process not Found
12172	Process not Found
7296	Process not Found
4700	Process not Found
12684	Process not Found

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Zeta11	Process not Found
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Zeta11\ = "C:\\Windows\\System32\\winlogon.exe"	Process not Found

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
11204	Process not Found
12172	Process not Found
7296	Process not Found
4700	Process not Found
12684	Process not Found
11760	Process not Found

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_44 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_99 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_57 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_33 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_64 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_67 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_72 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_62 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_16 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_46 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_14 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_32 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_4 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_78 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_19 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_14 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_31 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_1 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_27 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_87 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_50 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_90 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_28 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_24 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_46 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_74 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_72 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_96 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_66 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_39 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_83 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_8 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_43 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_38 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_29 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_47 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_68 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_27 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_22 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_22 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_54 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_97 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_69 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_26 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_37 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_41 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_96 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_15 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_46 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_17 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_59 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_82 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_76 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_71 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_95 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_21 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_37 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_39 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_86 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_87 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WinSysHelper11_84 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_96 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\WinSysHelper11_50 = "C:\\Windows\\System32\\winlogon.exe"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSysHelper11_40 = "C:\\Windows\\System32\\winlogon.exe"	reg.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File created	C:\Windows\System32\wbem\wmiprvse32.exe	cmd.exe
File opened for modification	C:\Windows\System32\csrss32.exe	attrib.exe
File created	C:\Windows\System32\svchost_sys.exe	cmd.exe
File opened for modification	C:\Windows\System32\lsass_sys.exe	cmd.exe
File created	C:\Windows\SysWOW64\winlogon32.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\csrss32.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\csrss32.exe	attrib.exe
File created	C:\Windows\System32\Speech\SpeechUX\SpeechUX32.exe	cmd.exe
File created	C:\Windows\System32\winlogon.exe	cmd.exe
File opened for modification	C:\Windows\System32\winlogon.exe	attrib.exe
File opened for modification	C:\Windows\System32\svchost_sys.exe	attrib.exe
File created	C:\Windows\System32\spoolsv32.exe	cmd.exe
File opened for modification	C:\Windows\System32\lsass_sys.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\winlogon32.exe	attrib.exe
File opened for modification	C:\Windows\System32\wbem\wmiprvse32.exe	attrib.exe
File opened for modification	C:\Windows\System32\winlogon.exe	cmd.exe
File created	C:\Windows\System32\csrss32.exe	cmd.exe
File created	C:\Windows\System32\lsass_sys.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\winlogon32.exe	cmd.exe
File opened for modification	C:\Windows\System32\wbem\wmiprvse32.exe	cmd.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\powershell32.exe	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\powershell32.exe	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\powershell32.exe	attrib.exe
File opened for modification	C:\Windows\System32\csrss32.exe	cmd.exe
File opened for modification	C:\Windows\System32\svchost_sys.exe	cmd.exe
File opened for modification	C:\Windows\System32\spoolsv32.exe	cmd.exe
File opened for modification	C:\Windows\System32\spoolsv32.exe	attrib.exe
File created	C:\Windows\SysWOW64\csrss32.exe	cmd.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 24 IoCs

Hidden Files and Directories

pid	Process
480	cmd.exe
5656	cmd.exe
2820	cmd.exe
1892	cmd.exe
280	cmd.exe
2192	cmd.exe
1584	cmd.exe
4708	cmd.exe
2056	cmd.exe
2864	cmd.exe
3664	cmd.exe
3196	cmd.exe
2964	cmd.exe
5580	cmd.exe
5168	cmd.exe
6136	cmd.exe
4688	cmd.exe
3872	cmd.exe
5392	cmd.exe
5084	cmd.exe
1360	cmd.exe
5548	cmd.exe
4548	cmd.exe
5928	cmd.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp32.exe	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw64.exe	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw64.exe	attrib.exe
File created	C:\Windows\ImmersiveControlPanel\SystemSettings32.exe	cmd.exe
File created	C:\Windows\Fonts\fontcache32.exe	cmd.exe
File opened for modification	C:\Windows\Fonts\StaticCache32.exe	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp32.exe	cmd.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw32.exe	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw32.exe	cmd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw32.exe	attrib.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw64.exe	cmd.exe
File created	C:\Windows\Boot\EFI\bootmgfw32.exe	cmd.exe
File opened for modification	C:\Windows\Fonts\fontcache32.exe	cmd.exe
File created	C:\Windows\Fonts\StaticCache32.exe	cmd.exe
File opened for modification	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellHost32.exe	cmd.exe
File opened for modification	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellHost32.exe	attrib.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings32.exe	cmd.exe
File opened for modification	C:\Windows\Fonts\StaticCache32.exe	attrib.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp32.exe	attrib.exe
File created	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellHost32.exe	cmd.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings32.exe	attrib.exe
File opened for modification	C:\Windows\Fonts\fontcache32.exe	attrib.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
13176	Process not Found
9980	Process not Found
11088	Process not Found
14444	Process not Found
10396	Process not Found
9536	Process not Found
14488	Process not Found
12024	Process not Found
12484	Process not Found
13684	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5980	cmd.exe
1452	cmd.exe
8780	cmd.exe
8524	cmd.exe
7684	cmd.exe
7380	cmd.exe
6584	cmd.exe
12280	Process not Found
6796	cmd.exe
8728	cmd.exe
7932	cmd.exe
10816	Process not Found
6456	cmd.exe
2508	cmd.exe
1144	cmd.exe
2880	cmd.exe
4536	cmd.exe
8044	cmd.exe
6256	cmd.exe
1124	cmd.exe
1212	cmd.exe
9048	cmd.exe
8992	cmd.exe
8488	cmd.exe
8240	cmd.exe
3852	cmd.exe
11420	Process not Found
13804	Process not Found
4552	cmd.exe
11612	Process not Found
5032	cmd.exe
4772	cmd.exe
3252	cmd.exe
2648	cmd.exe
8760	cmd.exe
7528	cmd.exe
7268	cmd.exe
6384	cmd.exe
11456	Process not Found
1244	cmd.exe
9108	cmd.exe
7340	cmd.exe
6152	cmd.exe
3244	cmd.exe
10080	Process not Found
7284	cmd.exe
6656	cmd.exe
5856	cmd.exe
1088	cmd.exe
2808	cmd.exe
4796	cmd.exe
3404	cmd.exe
704	cmd.exe
5048	cmd.exe
7412	cmd.exe
7396	cmd.exe
4304	cmd.exe
6000	cmd.exe
1692	cmd.exe
5912	cmd.exe
6852	cmd.exe
9000	cmd.exe
7972	cmd.exe
260	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
13192	Process not Found

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
7836	Process not Found

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
Token: SeIncBasePriorityPrivilege	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	11760	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found
Token: SeTakeOwnershipPrivilege	7296	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 3404	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	89
PID 4636 wrote to memory of 5656	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	91
PID 5656 wrote to memory of 3632	5656	cmd.exe	93
PID 4636 wrote to memory of 704	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	94
PID 4636 wrote to memory of 2056	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	96
PID 2056 wrote to memory of 3608	2056	cmd.exe	98
PID 4636 wrote to memory of 2676	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	99
PID 4636 wrote to memory of 2820	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	101
PID 2820 wrote to memory of 1648	2820	cmd.exe	103
PID 4636 wrote to memory of 4864	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	104
PID 4636 wrote to memory of 2864	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	106
PID 2864 wrote to memory of 5912	2864	cmd.exe	108
PID 4636 wrote to memory of 1452	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	109
PID 4636 wrote to memory of 1892	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	111
PID 1892 wrote to memory of 4384	1892	cmd.exe	113
PID 4636 wrote to memory of 5520	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	114
PID 4636 wrote to memory of 5084	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	116
PID 5084 wrote to memory of 1520	5084	cmd.exe	118
PID 4636 wrote to memory of 2168	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	119
PID 4636 wrote to memory of 280	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	121
PID 280 wrote to memory of 3604	280	cmd.exe	123
PID 4636 wrote to memory of 3836	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	124
PID 4636 wrote to memory of 5168	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	126
PID 5168 wrote to memory of 5416	5168	cmd.exe	128
PID 4636 wrote to memory of 5292	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	129
PID 4636 wrote to memory of 1360	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	131
PID 1360 wrote to memory of 1244	1360	cmd.exe	133
PID 4636 wrote to memory of 5492	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	134
PID 4636 wrote to memory of 6136	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	136
PID 6136 wrote to memory of 6000	6136	cmd.exe	138
PID 4636 wrote to memory of 3464	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	139
PID 4636 wrote to memory of 4688	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	141
PID 4688 wrote to memory of 6032	4688	cmd.exe	143
PID 4636 wrote to memory of 4316	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	144
PID 4636 wrote to memory of 2192	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	146
PID 2192 wrote to memory of 3420	2192	cmd.exe	148
PID 4636 wrote to memory of 2064	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	149
PID 4636 wrote to memory of 5548	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	151
PID 5548 wrote to memory of 3796	5548	cmd.exe	153
PID 4636 wrote to memory of 5980	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	154
PID 4636 wrote to memory of 480	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	156
PID 480 wrote to memory of 4644	480	cmd.exe	158
PID 4636 wrote to memory of 5096	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	159
PID 4636 wrote to memory of 3872	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	161
PID 3872 wrote to memory of 5172	3872	cmd.exe	163
PID 4636 wrote to memory of 1704	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	164
PID 4636 wrote to memory of 1584	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	166
PID 1584 wrote to memory of 4072	1584	cmd.exe	1148
PID 4636 wrote to memory of 6080	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	169
PID 4636 wrote to memory of 4548	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	171
PID 4548 wrote to memory of 1496	4548	cmd.exe	173
PID 4636 wrote to memory of 5220	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	390
PID 4636 wrote to memory of 4708	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	176
PID 4708 wrote to memory of 5860	4708	cmd.exe	178
PID 4636 wrote to memory of 4568	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	402
PID 4636 wrote to memory of 3664	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	181
PID 3664 wrote to memory of 5736	3664	cmd.exe	183
PID 4636 wrote to memory of 1272	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	430
PID 4636 wrote to memory of 3196	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	186
PID 3196 wrote to memory of 1524	3196	cmd.exe	1533
PID 4636 wrote to memory of 4828	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	1706
PID 4636 wrote to memory of 5392	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	191
PID 5392 wrote to memory of 4560	5392	cmd.exe	193
PID 4636 wrote to memory of 5920	4636	2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe	440

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 24 IoCs

Hidden Files and Directories

pid	Process
1524	attrib.exe
3608	attrib.exe
1244	attrib.exe
3796	attrib.exe
5736	attrib.exe
4560	attrib.exe
4292	attrib.exe
5016	attrib.exe
3356	attrib.exe
4384	attrib.exe
5416	attrib.exe
3420	attrib.exe
3632	attrib.exe
6032	attrib.exe
4644	attrib.exe
5172	attrib.exe
5860	attrib.exe
1648	attrib.exe
5912	attrib.exe
1520	attrib.exe
3604	attrib.exe
6000	attrib.exe
4072	attrib.exe
1496	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\System32\winlogon.exe"
  2⤵
  - Drops file in System32 directory
  - Executes a command shell one-liner
  PID:3404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\System32\winlogon.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\System32\winlogon.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:3632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\System32\csrss32.exe"
  2⤵
  - Drops file in System32 directory
  - Executes a command shell one-liner
  PID:704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\System32\csrss32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\System32\csrss32.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:3608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\System32\svchost_sys.exe"
  2⤵
  - Drops file in System32 directory
  PID:2676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\System32\svchost_sys.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\System32\svchost_sys.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\System32\spoolsv32.exe"
  2⤵
  - Drops file in System32 directory
  PID:4864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\System32\spoolsv32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\System32\spoolsv32.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:5912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\System32\lsass_sys.exe"
  2⤵
  - Drops file in System32 directory
  PID:1452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\System32\lsass_sys.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\System32\lsass_sys.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:4384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\SysWOW64\winlogon32.exe"
  2⤵
  - Drops file in System32 directory
  PID:5520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\SysWOW64\winlogon32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\SysWOW64\winlogon32.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\SysWOW64\csrss32.exe"
  2⤵
  - Drops file in System32 directory
  PID:2168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\SysWOW64\csrss32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:280
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\SysWOW64\csrss32.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:3604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\Temp\lsass_sys.exe"
  2⤵
  PID:3836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\Temp\lsass_sys.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\Temp\lsass_sys.exe"
    3⤵
    - Views/modifies file attributes
    PID:5416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\Temp\svchost32.exe"
  2⤵
  PID:5292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\Temp\svchost32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\Temp\svchost32.exe"
    3⤵
    - Views/modifies file attributes
    PID:1244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\Temp\wininit32.exe"
  2⤵
  PID:5492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\Temp\wininit32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\Temp\wininit32.exe"
    3⤵
    - Views/modifies file attributes
    PID:6000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\ProgramData\Microsoft\Windows\syshost.exe"
  2⤵
  PID:3464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\ProgramData\Microsoft\Windows\syshost.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\ProgramData\Microsoft\Windows\syshost.exe"
    3⤵
    - Views/modifies file attributes
    PID:6032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Users\Public\wininit32.exe"
  2⤵
  PID:4316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Users\Public\wininit32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Users\Public\wininit32.exe"
    3⤵
    - Views/modifies file attributes
    PID:3420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\Fonts\fontcache32.exe"
  2⤵
  - Drops file in Windows directory
  PID:2064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\Fonts\fontcache32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\Fonts\fontcache32.exe"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:3796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\Fonts\StaticCache32.exe"
  2⤵
  - Drops file in Windows directory
  - Executes a command shell one-liner
  PID:5980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\Fonts\StaticCache32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\Fonts\StaticCache32.exe"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:4644
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp32.exe"
  2⤵
  - Drops file in Windows directory
  PID:5096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp32.exe"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:5172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellHost32.exe"
  2⤵
  - Drops file in Windows directory
  PID:1704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellHost32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellHost32.exe"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw32.exe"
  2⤵
  - Drops file in Windows directory
  PID:6080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw32.exe"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:1496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw64.exe"
  2⤵
  - Drops file in Windows directory
  PID:5220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw64.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw64.exe"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:5860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\Boot\EFI\bootmgfw32.exe"
  2⤵
  - Drops file in Windows directory
  PID:4568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\Boot\EFI\bootmgfw32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\Boot\EFI\bootmgfw32.exe"
    3⤵
    - Views/modifies file attributes
    PID:5736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\System32\drivers\etc\hosts_sys.exe"
  2⤵
  - Drops file in Drivers directory
  PID:1272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\System32\drivers\etc\hosts_sys.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\System32\drivers\etc\hosts_sys.exe"
    3⤵
    - Drops file in Drivers directory
    - Views/modifies file attributes
    PID:1524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\System32\wbem\wmiprvse32.exe"
  2⤵
  - Drops file in System32 directory
  PID:4828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\System32\wbem\wmiprvse32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\System32\wbem\wmiprvse32.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:4560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell32.exe"
  2⤵
  - Drops file in System32 directory
  PID:5920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\System32\WindowsPowerShell\v1.0\powershell32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:5928
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\System32\WindowsPowerShell\v1.0\powershell32.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:4292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\System32\Speech\SpeechUX\SpeechUX32.exe"
  2⤵
  - Drops file in System32 directory
  PID:4428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\System32\Speech\SpeechUX\SpeechUX32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2964
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\System32\Speech\SpeechUX\SpeechUX32.exe"
    3⤵
    - Views/modifies file attributes
    PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\Windows\ImmersiveControlPanel\SystemSettings32.exe"
  2⤵
  - Drops file in Windows directory
  PID:3688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c attrib +h +s +r "C:\Windows\ImmersiveControlPanel\SystemSettings32.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:5580
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r "C:\Windows\ImmersiveControlPanel\SystemSettings32.exe"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:3356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_0 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:5048
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_0 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_0 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4836
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_0 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_0 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3324
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_0 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_0 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4220
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_0 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:6316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_0 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4752
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_0 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:11344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_1 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2232
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_1 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1500
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_1 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3340
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_1 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:5348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_1 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:704
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_1 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_1 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:3244
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_1 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_1 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4616
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_1 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:3576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_2 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:1692
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_2 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13428
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_2 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3608
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_2 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:2556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_2 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2448
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_2 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_2 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5932
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_2 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_2 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1048
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3692
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_2 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:9732
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_3 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5152
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_3 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_3 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:3252
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_3 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_3 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4404
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_3 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_3 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4172
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_3 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_3 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5852
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_3 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_4 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5880
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_4 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13040
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_4 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3328
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_4 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_4 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4236
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_4 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_4 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2480
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_4 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:5524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_4 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3396
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5820
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_4 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:13364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_5 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1840
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4736
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_5 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:6468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_5 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2800
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_5 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_5 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2344
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_5 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_5 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4380
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_5 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13396
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_5 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1236
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_5 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_6 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:5912
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_6 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_6 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4112
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_6 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_6 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2400
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3312
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_6 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_6 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1300
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_6 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_6 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5776
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_6 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_7 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2108
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_7 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_7 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:1452
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_7 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_7 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2552
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_7 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_7 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3116
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1380
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_7 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_7 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4352
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_7 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_8 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2080
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3472
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_8 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:7660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_8 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4356
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4572
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_8 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_8 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4588
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_8 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:2064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_8 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1720
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5544
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_8 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:12588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_8 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3348
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1700
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_8 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:8612
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_9 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1204
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3576
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_9 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_9 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5688
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_9 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_9 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5960
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:468
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_9 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_9 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1604
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1556
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_9 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_9 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1272
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_9 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_10 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4756
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4292
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_10 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_10 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3280
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_10 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:7552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_10 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4704
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_10 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_10 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2844
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_10 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:15288
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_10 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1220
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5752
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_10 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_11 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_11 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_11 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5516
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_11 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_11 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5364
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_11 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_11 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5344
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_11 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_11 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:576
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_11 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_12 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:572
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_12 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:7836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_12 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:248
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_12 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_12 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5336
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_12 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_12 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2932
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_12 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_12 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2236
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_12 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_13 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:260
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_13 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_13 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:264
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_13 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_13 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:108
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_13 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_13 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3176
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_13 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_13 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4980
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_13 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:9976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_14 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3836
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_14 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_14 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1960
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_14 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_14 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3168
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_14 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_14 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2860
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_14 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_14 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2404
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_14 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_15 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5416
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_15 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_15 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:928
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_15 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:8336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_15 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:4796
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_15 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:14072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_15 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4972
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_15 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_15 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1760
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_15 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_16 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5288
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_16 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_16 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5292
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_16 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_16 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5272
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_16 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_16 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3600
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_16 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_16 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1180
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_16 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_17 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:4536
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_17 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:5788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_17 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:1244
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6704
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_17 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_17 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:1212
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6672
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_17 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_17 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4280
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_17 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:7852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_17 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:988
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_17 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_18 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5428
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_18 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_18 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2180
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_18 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_18 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5492
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_18 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_18 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1516
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_18 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_18 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4184
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_18 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:13496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_19 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4440
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_19 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_19 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2360
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_19 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_19 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5616
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6956
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_19 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:13348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_19 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:6000
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_19 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_19 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5192
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_19 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9944
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_20 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6112
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_20 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_20 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:2880
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_20 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_20 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2248
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_20 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_20 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2872
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_20 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_20 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:4304
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_20 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_21 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5664
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_21 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_21 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2980
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_21 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_21 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1296
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_21 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_21 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2904
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_21 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_21 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5780
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_21 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:8884
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_22 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3240
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_22 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_22 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5264
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_22 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_22 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3028
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_22 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:11072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_22 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4960
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_22 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_22 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3736
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_22 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:14068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_23 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5808
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_23 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_23 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:4552
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_23 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11012
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_23 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4464
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_23 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:6196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_23 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1208
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7552
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_23 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:7296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_23 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2848
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7596
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_23 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_24 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2024
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_24 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:5524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_24 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2100
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_24 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_24 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4456
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_24 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:2380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_24 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3564
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_24 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:5520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_24 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1712
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_24 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:12716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_25 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3888
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_25 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_25 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5980
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_25 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_25 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:4772
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_25 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_25 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1872
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_25 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_25 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2832
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_25 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:4864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_26 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3616
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_26 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:6044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_26 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3716
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_26 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:6704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_26 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4084
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_26 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:11036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_26 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2228
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_26 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_26 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3884
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_26 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10360
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_27 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:936
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_27 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:5344
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_27 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2464
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_27 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:13332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_27 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3540
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_27 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_27 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1852
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_27 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_27 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4908
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_27 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:13868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_28 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5172
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_28 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_28 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:1124
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_28 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_28 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3548
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_28 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_28 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1724
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_28 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:7680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_28 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5868
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_28 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_29 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4256
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_29 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_29 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:3852
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_29 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_29 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5968
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_29 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_29 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1112
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_29 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_29 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1352
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_29 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:7840
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_30 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2208
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_30 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_30 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6108
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_30 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_30 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:1144
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_30 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_30 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1068
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_30 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_30 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5496
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_30 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_31 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:2808
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_31 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_31 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2696
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_31 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_31 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:1088
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_31 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_31 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3188
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_31 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_31 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5220
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_31 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:5364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_32 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5976
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_32 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_32 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2840
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_32 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:6124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_32 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:5032
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_32 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_32 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5124
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_32 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_32 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4496
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_32 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_33 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2188
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_33 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:5844
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_33 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5324
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_33 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9632
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_33 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4348
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_33 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_33 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5596
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_33 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:6672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_33 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4568
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_33 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:5544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_34 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4860
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_34 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_34 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4420
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_34 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:6956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_34 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2432
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_34 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_34 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:2508
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_34 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10532
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_34 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4584
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_34 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_35 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:2648
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_35 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_35 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5620
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_35 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_35 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4696
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_35 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_35 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3596
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_35 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_35 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5956
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_35 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_36 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4340
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_36 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_36 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2984
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_36 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:14072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_36 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:5856
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_36 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_36 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3532
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_36 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_36 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5432
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_36 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10008
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_37 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5916
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_37 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:5484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_37 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4200
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_37 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_37 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2540
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_37 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:5504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_37 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2868
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_37 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_37 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3424
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_37 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_38 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6128
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_38 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_38 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2804
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_38 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_38 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4472
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_38 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:7620
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_38 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4800
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_38 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_38 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:568
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_38 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_39 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:1932
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_39 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:7740
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_39 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5920
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_39 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_39 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3500
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_39 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_39 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3056
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_39 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_39 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3724
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_39 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_40 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5016
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_40 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_40 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2492
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_40 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:7556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_40 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2444
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_40 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_40 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4360
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_40 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_40 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5576
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_40 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_41 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:5676
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_41 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_41 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4976
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_41 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:6672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_41 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3216
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_41 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_41 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3356
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_41 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_41 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:4428
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_41 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:11204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_42 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:6152
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_42 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_42 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6160
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_42 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_42 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6168
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_42 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_42 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6176
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_42 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_42 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6184
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_42 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_43 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6200
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_43 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:4572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_43 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6208
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_43 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_43 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6224
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_43 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_43 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6232
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_43 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_43 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6248
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_43 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:14068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_44 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:6256
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_44 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_44 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6272
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_44 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_44 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6280
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_44 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_44 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6296
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_44 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_44 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6304
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_44 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_45 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6320
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_45 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_45 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6336
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_45 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_45 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6344
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_45 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:5820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_45 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6360
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_45 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11100
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_45 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6368
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_45 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_46 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:6384
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_46 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_46 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6392
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_46 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:11016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_46 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6408
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_46 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_46 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6416
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_46 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:11240
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_46 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6432
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_46 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:1976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_47 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6440
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:12584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_47 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:6456
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_47 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:8900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_47 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6472
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_47 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:7708
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_47 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6480
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_47 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_47 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6488
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_47 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:12292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_48 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6504
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_48 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_48 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_48 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6520
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_48 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_48 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6528
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_48 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_48 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_49 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_49 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6560
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_49 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_49 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_49 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6576
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_49 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_49 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:6584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_50 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_50 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6600
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_50 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:8368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_50 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6616
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_50 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_50 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_50 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6632
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:9520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_51 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_51 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:6656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_51 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6664
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_51 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:6764
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_51 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_51 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6688
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_51 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:11132
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_52 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_52 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_52 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6724
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_52 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_52 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_52 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6744
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_52 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:6104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_53 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_53 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6772
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_53 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_53 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6780
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:12856
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_53 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_53 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:6796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_53 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6804
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_53 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:9840
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_54 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6812
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_54 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_54 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6828
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_54 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:12332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_54 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_54 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:6852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_54 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6868
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_54 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:9796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_55 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6876
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7680
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_55 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:14052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_55 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6892
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_55 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_55 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_55 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6908
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_55 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_55 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_56 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6932
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_56 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_56 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6940
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_56 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:8444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_56 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6948
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_56 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:14228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_56 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_56 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_57 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_57 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:6996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_57 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7004
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_57 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:8440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_57 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7012
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_57 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7020
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_57 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_58 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7028
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_58 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7044
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_58 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_58 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7052
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_58 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_58 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7068
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_58 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_58 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7076
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_58 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_59 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7084
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_59 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7092
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_59 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_59 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7108
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_59 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_59 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7116
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_59 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11024
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_59 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7128
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_59 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_60 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7136
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_60 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7144
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_60 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:15244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_60 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_60 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_60 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:3404
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_60 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_61 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:2976
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_61 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_61 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7176
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_61 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:2948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_61 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7188
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_61 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:15236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_61 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7196
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_61 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_61 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7204
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_61 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:12640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_62 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7220
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_62 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:7768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_62 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_62 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7236
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_62 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10980
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_62 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_62 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7252
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_62 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_63 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:7268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_63 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_63 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:7284
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_63 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7300
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_63 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:15228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_63 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7316
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_64 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7332
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_64 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_64 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:7340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_64 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7352
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_64 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_64 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7360
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_64 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:12992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_64 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_65 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:7380
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_65 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_65 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:7396
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_65 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:7412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_65 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7420
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_65 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_65 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7436
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_66 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_66 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7456
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_66 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_66 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_66 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7484
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_66 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_66 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_67 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7504
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_67 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:15056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_67 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_67 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:7528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_67 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_67 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7544
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_67 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:10912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_68 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_68 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_68 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7580
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_68 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:2124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_68 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7588
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5788
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_68 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7604
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_68 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:11576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_69 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7612
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_69 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_69 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7624
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_69 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_69 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_69 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7648
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_69 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7664
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_69 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_70 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7672
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_70 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11160
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_70 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:7684
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_70 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_70 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7692
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_70 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_70 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_70 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7720
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_70 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_71 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7728
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_71 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11028
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_71 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7744
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_71 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_71 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7752
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_71 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7760
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_71 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:9388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_71 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7772
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:9828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_72 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7780
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_72 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_72 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_72 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7804
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_72 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:468
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_72 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7812
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_72 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2268
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_72 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7828
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_72 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:7736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_73 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7844
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_73 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:14088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_73 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7856
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_73 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:7852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_73 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7864
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_73 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_73 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7880
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_73 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_73 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7888
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_73 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10328
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_74 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7896
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_74 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_74 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_74 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7916
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_74 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_74 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:7932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_74 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7940
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_74 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:6104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_75 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7948
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_75 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:8720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_75 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7956
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:11560
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_75 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:2168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_75 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:7972
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_75 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11580
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_75 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7988
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_75 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_75 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:7996
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_75 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_76 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8004
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_76 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:15072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_76 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8012
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_76 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8028
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_76 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:9756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_76 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:8044
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_76 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_76 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8052
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_76 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:11448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_77 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_77 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8076
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_77 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:5508
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_77 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8084
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_77 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9600
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_77 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8092
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_77 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:14576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_77 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8100
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_77 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:2544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_78 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8116
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_78 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:15312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_78 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8124
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_78 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13280
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_78 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8132
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_78 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:12888
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_78 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8140
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_78 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_78 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_79 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8164
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_79 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_79 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_79 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_79 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8208
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_79 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_80 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8224
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_80 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_80 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8232
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_80 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:15152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_80 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:8240
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_80 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:7072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_80 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8256
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_80 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_80 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_81 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8280
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_81 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:8560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_81 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8288
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_81 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:6292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_81 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8304
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_81 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_81 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8312
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_81 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_81 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8324
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_81 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13012
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_82 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8340
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_82 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_82 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8348
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_82 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_82 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8356
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_82 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12816
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_82 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8372
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_82 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_82 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8380
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_82 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:11060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_83 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8388
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_83 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:15088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_83 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8404
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_83 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:10996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_83 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8412
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_83 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:5356
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_83 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8420
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_83 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12596
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_83 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8432
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_83 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:13072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_84 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8448
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_84 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11228
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_84 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8456
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_84 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8464
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_84 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:12116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_84 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8480
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_84 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_84 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:8488
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_84 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_85 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8504
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_85 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_85 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8516
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_85 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_85 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:8524
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_85 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_85 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8540
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_85 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_85 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_86 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8564
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_86 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:15052
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_86 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8572
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:10292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_86 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8580
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_86 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:12044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_86 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8588
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_86 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9652
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_86 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8604
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_86 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_87 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8616
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_87 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:12144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_87 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8624
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_87 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8640
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_87 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:9616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_87 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8648
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_87 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_87 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_88 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8680
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_88 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8688
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_88 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11576
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_88 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_88 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8704
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_88 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_88 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:8728
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_88 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_89 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8736
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_89 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8752
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_89 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:8560
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_89 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:8760
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_89 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10696
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_89 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8772
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_89 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:8780
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_89 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1412
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_90 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8788
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_90 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1556
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_90 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8804
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_90 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_90 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8812
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_90 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_90 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8828
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_90 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_91 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8848
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3000
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_91 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:8036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_91 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8856
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_91 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_91 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8872
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_91 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8888
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_91 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_92 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8904
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_92 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:15272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_92 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_92 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_92 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8944
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_92 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13172
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_92 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8952
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_92 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:8252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_93 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8960
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_93 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_93 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8972
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_93 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_93 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:8980
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_93 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:5484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_93 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:8992
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_93 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:9960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_93 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:9000
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_93 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:5224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_94 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9016
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_94 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_94 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:9048
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_94 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:5836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_94 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_94 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9072
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_94 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:12824
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_95 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9088
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_95 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:5520
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_95 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_95 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  - Executes a command shell one-liner
  PID:9108
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_95 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10740
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_95 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9120
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_95 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:13720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_95 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9128
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_95 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds policy Run key to start application
    PID:11720
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_96 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9144
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_96 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_96 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9152
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_96 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2368
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_96 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9168
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_96 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_96 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9176
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_96 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9188
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_96 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:2000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_97 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9196
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_97 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:4224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_97 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9208
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_97 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_97 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9236
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_97 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_97 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9244
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_97 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:6464
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_98 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9260
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_98 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_98 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9268
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:8612
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_98 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:8152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_98 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9276
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_98 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:7124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_98 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9284
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_98 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11156
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_98 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_99 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9304
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_99 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Adds Run key to start application
    PID:12096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_99 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9320
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WinSysHelper11_99 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:1380
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_99 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9328
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v WinSysHelper11_99 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:11908
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_99 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9340
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx" /v WinSysHelper11_99 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:3804
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_99 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9348
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /v WinSysHelper11_99 /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    PID:10868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
  2⤵
  PID:9356
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:12588
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Windows\System32\winlogon.exe" /f
    3⤵
    - Modifies WinLogon for persistence
    PID:2768
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\System32\winlogon.exe," /f
  2⤵
  PID:9364
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\System32\winlogon.exe," /f
    3⤵
    - Modifies WinLogon for persistence
    PID:12892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c copy /Y "C:\Users\Admin\AppData\Local\Temp\2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\WinSysHelper.exe"
  2⤵
  PID:9380

C:\Windows\System32\winlogon.exe
C:\Windows\System32\winlogon.exe
1⤵
PID:10140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery