35cae57de3439b686a1f977259afe76132b06a776452c6af516ff1d4436d3c45

Analysis

max time kernel
143s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2023, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

parrot.live.exe
Size

137KB
MD5

47e9343b371bdd7dd9754db05941c4e1
SHA1

cbdd85fc12ee404191223986e828e54849c9da9f
SHA256

35cae57de3439b686a1f977259afe76132b06a776452c6af516ff1d4436d3c45
SHA512

0bc0febabb81e407d1669c7afb841e420fce0d212c800bd8622b35fc387fa5002ba0047c32c15fa8d3c4933fd13ebf8c8b9b6a508d9c45311bb7794c0567513c
SSDEEP

1536:GO2z7oYufXkFoIEEgmxUdUj10cL+yvVK2oiz7h9CdvrqLp:GO22aoIvjxUdUSM0Vi/h9CxUp

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	parrot.live.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7880	4856	WerFault.exe	86

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 376	3212	parrot.live.exe	87
PID 3212 wrote to memory of 376	3212	parrot.live.exe	87
PID 376 wrote to memory of 4420	376	cmd.exe	90
PID 376 wrote to memory of 4420	376	cmd.exe	90
PID 376 wrote to memory of 4004	376	cmd.exe	91
PID 376 wrote to memory of 4004	376	cmd.exe	91
PID 376 wrote to memory of 3808	376	cmd.exe	93
PID 376 wrote to memory of 3808	376	cmd.exe	93
PID 376 wrote to memory of 2216	376	cmd.exe	94
PID 376 wrote to memory of 2216	376	cmd.exe	94
PID 376 wrote to memory of 4812	376	cmd.exe	96
PID 376 wrote to memory of 4812	376	cmd.exe	96
PID 376 wrote to memory of 3804	376	cmd.exe	97
PID 376 wrote to memory of 3804	376	cmd.exe	97
PID 376 wrote to memory of 2676	376	cmd.exe	98
PID 376 wrote to memory of 2676	376	cmd.exe	98
PID 376 wrote to memory of 3036	376	cmd.exe	100
PID 376 wrote to memory of 3036	376	cmd.exe	100
PID 376 wrote to memory of 1808	376	cmd.exe	102
PID 376 wrote to memory of 1808	376	cmd.exe	102
PID 376 wrote to memory of 3296	376	cmd.exe	103
PID 376 wrote to memory of 3296	376	cmd.exe	103
PID 376 wrote to memory of 2076	376	cmd.exe	104
PID 376 wrote to memory of 2076	376	cmd.exe	104
PID 376 wrote to memory of 2388	376	cmd.exe	106
PID 376 wrote to memory of 2388	376	cmd.exe	106
PID 376 wrote to memory of 1348	376	cmd.exe	108
PID 376 wrote to memory of 1348	376	cmd.exe	108
PID 376 wrote to memory of 3480	376	cmd.exe	109
PID 376 wrote to memory of 3480	376	cmd.exe	109
PID 376 wrote to memory of 2328	376	cmd.exe	111
PID 376 wrote to memory of 2328	376	cmd.exe	111
PID 376 wrote to memory of 2852	376	cmd.exe	113
PID 376 wrote to memory of 2852	376	cmd.exe	113
PID 376 wrote to memory of 688	376	cmd.exe	112
PID 376 wrote to memory of 688	376	cmd.exe	112
PID 376 wrote to memory of 3380	376	cmd.exe	116
PID 376 wrote to memory of 3380	376	cmd.exe	116
PID 376 wrote to memory of 1052	376	cmd.exe	115
PID 376 wrote to memory of 1052	376	cmd.exe	115
PID 376 wrote to memory of 1284	376	cmd.exe	118
PID 376 wrote to memory of 1284	376	cmd.exe	118
PID 376 wrote to memory of 4964	376	cmd.exe	119
PID 376 wrote to memory of 4964	376	cmd.exe	119
PID 376 wrote to memory of 4636	376	cmd.exe	121
PID 376 wrote to memory of 4636	376	cmd.exe	121
PID 376 wrote to memory of 3976	376	cmd.exe	123
PID 376 wrote to memory of 3976	376	cmd.exe	123
PID 376 wrote to memory of 3724	376	cmd.exe	124
PID 376 wrote to memory of 3724	376	cmd.exe	124
PID 376 wrote to memory of 4616	376	cmd.exe	125
PID 376 wrote to memory of 4616	376	cmd.exe	125
PID 376 wrote to memory of 2228	376	cmd.exe	127
PID 376 wrote to memory of 2228	376	cmd.exe	127
PID 376 wrote to memory of 3572	376	cmd.exe	128
PID 376 wrote to memory of 3572	376	cmd.exe	128
PID 376 wrote to memory of 4316	376	cmd.exe	130
PID 376 wrote to memory of 4316	376	cmd.exe	130
PID 376 wrote to memory of 2592	376	cmd.exe	132
PID 376 wrote to memory of 2592	376	cmd.exe	132
PID 376 wrote to memory of 5088	376	cmd.exe	135
PID 376 wrote to memory of 5088	376	cmd.exe	135
PID 376 wrote to memory of 1976	376	cmd.exe	133
PID 376 wrote to memory of 1976	376	cmd.exe	133

C:\Users\Admin\AppData\Local\Temp\parrot.live.exe
"C:\Users\Admin\AppData\Local\Temp\parrot.live.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\766D.tmp\parrot.live.bat" "C:\Users\Admin\AppData\Local\Temp\parrot.live.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4420
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4004
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:3808
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2216
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4812
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3804
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:2676
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3036
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:1808
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3296
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:2076
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2388
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:1348
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3480
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:2328
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:688
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2852
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:1052
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3380
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1284
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4964
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4636
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:3976
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3724
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4616
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2228
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:3572
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4316
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:2592
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:1976
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5088
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:1692
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5060
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4236
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4284
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1216
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:848
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4420
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4560
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4120
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:2316
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2676
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4392
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2740
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4300
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:688
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1424
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3976
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:1392
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3636
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:1756
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:2864
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3572
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4336
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:2844
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:3972
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:848
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:224
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:2316
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2360
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:2776
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1392
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:3020
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4172
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3752
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2316
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5108
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2844
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4172
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5152
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5168
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5212
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5228
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5272
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5288
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5332
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5348
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5392
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5408
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5444
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5460
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5512
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5528
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5572
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5588
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5632
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5648
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5692
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5708
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5768
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5752
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5812
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5820
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5872
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5880
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5932
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5948
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5988
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6008
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6060
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6076
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6128
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5128
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5312
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5232
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5412
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5408
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5484
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5588
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5584
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5772
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5768
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5848
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5952
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5948
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6004
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6076
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6116
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5608
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5532
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6032
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6004
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5352
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5712
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6152
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6208
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6192
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6260
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6252
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6312
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6328
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6372
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6388
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6448
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6432
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6504
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6496
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6556
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6572
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6616
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6632
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6668
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6660
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6756
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6740
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6800
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6816
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6860
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6880
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6924
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6940
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6988
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7004
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7052
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7068
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7116
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7136
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6168
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:2416
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6264
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6272
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6444
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6448
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6628
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6632
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6812
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6816
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7000
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7004
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:1528
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3064
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6504
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:6652
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6324
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:1528
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7188
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7204
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7248
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7264
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7308
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7316
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7368
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7392
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7428
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7444
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7488
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7504
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7548
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7564
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7608
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7624
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7676
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7668
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7728
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7744
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7828
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7844
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7888
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7904
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7948
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7964
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8008
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8024
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8068
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8084
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8132
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8148
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6328
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6632
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7200
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7440
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7380
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7676
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7768
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8020
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8108
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7260
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7392
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8108
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7440
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8248
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8240
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8308
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8300
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8364
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8380
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8424
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8416
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8484
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8500
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8544
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8560
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8604
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8620
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8672
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8664
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8732
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8724
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8776
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8768
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8844
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8860
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8904
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8928
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8964
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8980
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9024
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9048
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9084
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9100
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9136
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9208
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8264
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8276
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8428
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8436
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8616
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8684
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8796
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8776
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9000
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9052
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4216
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7500
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8744
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8672
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8928
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:8496
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9232
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9248
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9292
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9308
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9352
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9368
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9412
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9428
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9472
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9488
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9532
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9548
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9592
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9608
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9644
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9664
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9724
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9716
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9780
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9796
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9856
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9840
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9908
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9900
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9968
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9960
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10020
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10036
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10080
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10096
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10204
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9368
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9484
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9488
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9696
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9688
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9816
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:9856
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9852
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10056
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10060
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9368
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9548
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2000
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9664
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4740
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9820
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10288
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10272
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10340
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10356
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10400
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10416
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10460
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10476
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10520
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10536
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10572
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10580
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10644
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10660
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10704
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10720
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10764
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10780
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10840
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10824
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10884
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10900
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10944
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10960
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11004
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11024
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11072
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11088
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11132
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11124
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11196
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11212
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9544
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:9548
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10436
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10356
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10596
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10720
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10780
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10860
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10960
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11048
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1668
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11208
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2456
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10476
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10784
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:10840
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7820
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:7796
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11256
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4576
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11048
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10840
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11280
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11296
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11340
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11356
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11416
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11400
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11460
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11476
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11520
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11536
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11604
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11588
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11672
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11692
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11748
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11764
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11812
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11828
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11880
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11896
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11944
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11960
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12008
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12024
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12068
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12076
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12128
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12144
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12188
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12204
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12248
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11048
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11316
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11360
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11532
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11556
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11604
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11708
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11852
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11832
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4780
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11916
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12104
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12140
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11420
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11048
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:408
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:4792
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1948
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:11896
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12208
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1056
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:11832
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:5064
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2188
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12328
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12344
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12388
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12396
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12464
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12448
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12508
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12524
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12576
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12568
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12628
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12644
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12688
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12704
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12748
- - C:\Windows\system32\msg.exe
    msg * parrot.live are fucking u!
    3⤵
    PID:12764

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5228

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6260

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:7504

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:8424

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 476 -p 4856 -ip 4856
1⤵
PID:7604

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4856 -s 1608
1⤵
- Program crash
PID:7880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\766D.tmp\parrot.live.bat

Filesize
112B

MD5
7cd8de347109a837a5a09864bd512338

SHA1
028a757be5066e26ed00372059af3225dc688556

SHA256
615d1dce479cc8ebc41642b7f119ebc4997f1717427f255805735366ca270360

SHA512
96c1dede9fc966cf8cb22466be76e5dc7b0767410df07eb2b1364a47acf7d6597fbcd077f4b4e522ebecbc9e177cccc2ce2f776110ce74c83f6cf72f51406bbd

Download Submit