5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd

Analysis

user interaction
yes
max time kernel
49s
max time network
43s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd.exe
Size 26KB
Sample260709-y239faas5s
SHA256 5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd
MD5 efa0aeb1ee3dac26deb0ee1c4e233a99
SHA1 9eb66d1231c6c7e102ce91d207ada982e3e3f0a5
SHA512 fc5570a458fd1f2fa74e4b8026a8e0f7af59fabe1b32b6292b4abbffa622e4f9569cdc2006ffc21655cf83bf9040e1e06aaf7336bf95b63e9d363e0e286e7902
SSDEEP 384:KUlOyj1hF/q05ul9+K0b6SFDMH4YlTYbGGqTrJHehHQZJHljgCrPBXTl1nHBwLdp:Ka/q0Uvv05LYCbyg6llTlAd
TLSH
T17BC2D604B7FC4A24F2BE4F35197961404B3BBE169C22D75E0AC45D8E18767C88BA2B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 11 IoCs

exploit

pid	Process
27072	takeown.exe
27148	takeown.exe
12400	takeown.exe
12592	takeown.exe
22896	takeown.exe
24744	takeown.exe
20540	icacls.exe
20704	icacls.exe
23000	takeown.exe
24388	takeown.exe
25444	takeown.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
4340	win_guard_0.exe
2576	win_guard_1.exe
3300	win_guard_2.exe
1300	win_guard_0.exe

Modifies file permissions 1 TTPs 11 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
23000	takeown.exe
25444	takeown.exe
27148	takeown.exe
20540	icacls.exe
22896	takeown.exe
24388	takeown.exe
24744	takeown.exe
27072	takeown.exe
12400	takeown.exe
12592	takeown.exe
20704	icacls.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ipinfo.io
1	ipinfo.io
3	ipinfo.io
4	ipinfo.io
5	ipinfo.io

Launches sc.exe 33 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
9996	sc.exe
21828	sc.exe
22912	sc.exe
24916	sc.exe
8548	sc.exe
21448	sc.exe
24380	sc.exe
24356	sc.exe
25216	sc.exe
25548	sc.exe
18628	sc.exe
7692	sc.exe
20716	sc.exe
13768	sc.exe
22904	sc.exe
24320	sc.exe
24404	sc.exe
26392	sc.exe
19244	sc.exe
11272	sc.exe
13760	sc.exe
4136	sc.exe
18848	sc.exe
20740	sc.exe
2992	sc.exe
10320	sc.exe
10336	sc.exe
10328	sc.exe
20804	sc.exe
26560	sc.exe
26908	sc.exe
24204	sc.exe
26604	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
23000	4060	WerFault.exe	84
21932	4340	WerFault.exe	85
26704	1812	WerFault.exe	90
26916	3116	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win_guard_0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win_guard_1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win_guard_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
26844	schtasks.exe
11992	schtasks.exe
11984	schtasks.exe
13972	schtasks.exe
7692	schtasks.exe
16968	schtasks.exe
19264	schtasks.exe
21840	schtasks.exe
25308	schtasks.exe
2248	schtasks.exe
5424	schtasks.exe
18540	schtasks.exe
21932	schtasks.exe
26328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4060	5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd.exe
4340	win_guard_0.exe
2576	win_guard_1.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd.exe
Token: SeDebugPrivilege	4340	win_guard_0.exe
Token: SeDebugPrivilege	2576	win_guard_1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4340	4060	5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd.exe	85
PID 4060 wrote to memory of 2576	4060	5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd.exe	86
PID 4060 wrote to memory of 3300	4060	5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd.exe	87
PID 4340 wrote to memory of 1300	4340	win_guard_0.exe	88

C:\Users\Admin\AppData\Local\Temp\5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd.exe
"C:\Users\Admin\AppData\Local\Temp\5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\Temp\RageCore_4f642669\win_guard_0.exe
  "C:\Windows\Temp\RageCore_4f642669\win_guard_0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Users\Public\RageCore_800d9432\win_guard_0.exe
    "C:\Users\Public\RageCore_800d9432\win_guard_0.exe"
    3⤵
    - Executes dropped EXE
    PID:1300
  - - C:\Users\Public\RageCore_8b60ca97\win_guard_0.exe
      "C:\Users\Public\RageCore_8b60ca97\win_guard_0.exe"
      4⤵
      PID:4952
    - - C:\ProgramData\RageCore_c0ffcf7c\win_guard_0.exe
        
        "C:\ProgramData\RageCore_c0ffcf7c\win_guard_0.exe"
        5⤵
        
        PID:4612
      - C:\ProgramData\RageCore_1dbe0592\win_guard_0.exe
        
        "C:\ProgramData\RageCore_1dbe0592\win_guard_0.exe"
        6⤵
        
        PID:6464
        
        C:\Users\Public\RageCore_417115c8\win_guard_0.exe
        
        "C:\Users\Public\RageCore_417115c8\win_guard_0.exe"
        7⤵
        
        PID:11504
        
        C:\Windows\Temp\RageCore_3c6b598a\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_3c6b598a\win_guard_0.exe"
        8⤵
        
        PID:7388
        
        C:\Users\Public\RageCore_2792a635\win_guard_1.exe
        
        "C:\Users\Public\RageCore_2792a635\win_guard_1.exe"
        7⤵
        
        PID:14960
        
        C:\Users\Public\RageCore_f59e45aa\win_guard_2.exe
        
        "C:\Users\Public\RageCore_f59e45aa\win_guard_2.exe"
        7⤵
        
        PID:20756
        
        C:\ProgramData\RageCore_4f29f7b6\win_guard_3.exe
        
        "C:\ProgramData\RageCore_4f29f7b6\win_guard_3.exe"
        7⤵
        
        PID:28500
      - C:\Windows\Temp\RageCore_f7b38a3c\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_f7b38a3c\win_guard_1.exe"
        6⤵
        
        PID:7728
        
        C:\ProgramData\RageCore_5d0cdbc1\win_guard_0.exe
        
        "C:\ProgramData\RageCore_5d0cdbc1\win_guard_0.exe"
        7⤵
        
        PID:15620
        
        C:\Users\Public\RageCore_f2186753\win_guard_1.exe
        
        "C:\Users\Public\RageCore_f2186753\win_guard_1.exe"
        7⤵
        
        PID:21540
      - C:\Users\Public\RageCore_61b8205e\win_guard_2.exe
        
        "C:\Users\Public\RageCore_61b8205e\win_guard_2.exe"
        6⤵
        
        PID:9520
        
        C:\Users\Public\RageCore_ae6f128b\win_guard_0.exe
        
        "C:\Users\Public\RageCore_ae6f128b\win_guard_0.exe"
        7⤵
        
        PID:20744
      - C:\Users\Public\RageCore_c46ee704\win_guard_3.exe
        
        "C:\Users\Public\RageCore_c46ee704\win_guard_3.exe"
        6⤵
        
        PID:12460
        
        C:\Windows\Temp\RageCore_9c5e0a0f\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_9c5e0a0f\win_guard_0.exe"
        7⤵
        
        PID:27048
      - C:\ProgramData\RageCore_3b9f82af\win_guard_4.exe
        
        "C:\ProgramData\RageCore_3b9f82af\win_guard_4.exe"
        6⤵
        
        PID:16864
      - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_1dbe0592\win_guard_0.exe" start= auto
        6⤵
        Launches sc.exe
        
        PID:24404
    - - C:\Windows\Temp\RageCore_d63e7d10\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_d63e7d10\win_guard_1.exe"
        5⤵
        
        PID:3344
      - C:\Windows\Temp\RageCore_0caf205a\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_0caf205a\win_guard_0.exe"
        6⤵
        
        PID:7972
        
        C:\Users\Public\RageCore_0ffb7681\win_guard_0.exe
        
        "C:\Users\Public\RageCore_0ffb7681\win_guard_0.exe"
        7⤵
        
        PID:17540
        
        C:\Users\Public\RageCore_2fcd3c73\win_guard_1.exe
        
        "C:\Users\Public\RageCore_2fcd3c73\win_guard_1.exe"
        7⤵
        
        PID:24092
      - C:\Users\Public\RageCore_918de759\win_guard_1.exe
        
        "C:\Users\Public\RageCore_918de759\win_guard_1.exe"
        6⤵
        
        PID:6604
        
        C:\Users\Public\RageCore_872231ba\win_guard_0.exe
        
        "C:\Users\Public\RageCore_872231ba\win_guard_0.exe"
        7⤵
        
        PID:21076
      - C:\ProgramData\RageCore_fd08fb76\win_guard_2.exe
        
        "C:\ProgramData\RageCore_fd08fb76\win_guard_2.exe"
        6⤵
        
        PID:12008
        
        C:\Windows\Temp\RageCore_525e516c\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_525e516c\win_guard_0.exe"
        7⤵
        
        PID:27368
      - C:\ProgramData\RageCore_88573d13\win_guard_3.exe
        
        "C:\ProgramData\RageCore_88573d13\win_guard_3.exe"
        6⤵
        
        PID:15780
      - C:\Users\Public\RageCore_ce31cb42\win_guard_4.exe
        
        "C:\Users\Public\RageCore_ce31cb42\win_guard_4.exe"
        6⤵
        
        PID:22400
    - - C:\Windows\Temp\RageCore_9769aaa3\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_9769aaa3\win_guard_2.exe"
        5⤵
        
        PID:2060
      - C:\Users\Public\RageCore_ac8dcb91\win_guard_0.exe
        
        "C:\Users\Public\RageCore_ac8dcb91\win_guard_0.exe"
        6⤵
        
        PID:8636
        
        C:\ProgramData\RageCore_4a10f811\win_guard_0.exe
        
        "C:\ProgramData\RageCore_4a10f811\win_guard_0.exe"
        7⤵
        
        PID:19708
        
        C:\Users\Public\RageCore_ebb3535f\win_guard_1.exe
        
        "C:\Users\Public\RageCore_ebb3535f\win_guard_1.exe"
        7⤵
        
        PID:26516
      - C:\ProgramData\RageCore_326a11dd\win_guard_1.exe
        
        "C:\ProgramData\RageCore_326a11dd\win_guard_1.exe"
        6⤵
        
        PID:10352
        
        C:\Users\Public\RageCore_9e5ddcc5\win_guard_0.exe
        
        "C:\Users\Public\RageCore_9e5ddcc5\win_guard_0.exe"
        7⤵
        
        PID:21684
      - C:\ProgramData\RageCore_9c392c89\win_guard_2.exe
        
        "C:\ProgramData\RageCore_9c392c89\win_guard_2.exe"
        6⤵
        
        PID:12344
        
        C:\Users\Public\RageCore_9a409960\win_guard_0.exe
        
        "C:\Users\Public\RageCore_9a409960\win_guard_0.exe"
        7⤵
        
        PID:26880
      - C:\ProgramData\RageCore_2fcd7fdf\win_guard_3.exe
        
        "C:\ProgramData\RageCore_2fcd7fdf\win_guard_3.exe"
        6⤵
        
        PID:17476
      - C:\Users\Public\RageCore_16aaec32\win_guard_4.exe
        
        "C:\Users\Public\RageCore_16aaec32\win_guard_4.exe"
        6⤵
        
        PID:24144
    - - C:\Users\Public\RageCore_45a02ff2\win_guard_3.exe
        
        "C:\Users\Public\RageCore_45a02ff2\win_guard_3.exe"
        5⤵
        
        PID:1368
      - C:\Users\Public\RageCore_65c4c4ea\win_guard_0.exe
        
        "C:\Users\Public\RageCore_65c4c4ea\win_guard_0.exe"
        6⤵
        
        PID:8984
        
        C:\Windows\Temp\RageCore_4f27ebfe\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_4f27ebfe\win_guard_0.exe"
        7⤵
        
        PID:19752
        
        C:\Windows\Temp\RageCore_42a7eb86\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_42a7eb86\win_guard_1.exe"
        7⤵
        
        PID:26384
      - C:\Windows\Temp\RageCore_dc2c4614\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_dc2c4614\win_guard_1.exe"
        6⤵
        
        PID:10988
        
        C:\Users\Public\RageCore_a00350fe\win_guard_0.exe
        
        "C:\Users\Public\RageCore_a00350fe\win_guard_0.exe"
        7⤵
        
        PID:24508
      - C:\ProgramData\RageCore_d19520ee\win_guard_2.exe
        
        "C:\ProgramData\RageCore_d19520ee\win_guard_2.exe"
        6⤵
        
        PID:14004
      - C:\Windows\Temp\RageCore_d72b3655\win_guard_3.exe
        
        "C:\Windows\Temp\RageCore_d72b3655\win_guard_3.exe"
        6⤵
        
        PID:19400
      - C:\Windows\Temp\RageCore_cd9019de\win_guard_4.exe
        
        "C:\Windows\Temp\RageCore_cd9019de\win_guard_4.exe"
        6⤵
        
        PID:7256
    - - C:\Users\Public\RageCore_b9237619\win_guard_4.exe
        
        "C:\Users\Public\RageCore_b9237619\win_guard_4.exe"
        5⤵
        
        PID:6436
      - C:\Windows\Temp\RageCore_07258cb9\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_07258cb9\win_guard_0.exe"
        6⤵
        
        PID:11832
        
        C:\ProgramData\RageCore_0e26bd77\win_guard_0.exe
        
        "C:\ProgramData\RageCore_0e26bd77\win_guard_0.exe"
        7⤵
        
        PID:19916
      - C:\ProgramData\RageCore_aad85d2d\win_guard_1.exe
        
        "C:\ProgramData\RageCore_aad85d2d\win_guard_1.exe"
        6⤵
        
        PID:15572
      - C:\Users\Public\RageCore_8ea00414\win_guard_2.exe
        
        "C:\Users\Public\RageCore_8ea00414\win_guard_2.exe"
        6⤵
        
        PID:21508
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_c0ffcf7c\win_guard_0.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:10320
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\ProgramData\RageCore_c0ffcf7c\win_guard_0.exe" /sc onlogon /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:19264
    - - C:\Windows\SysWOW64\takeown.exe
        
        "C:\Windows\System32\takeown.exe" /f "C:\Windows\system32\cmd.exe" /a
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:27148
  - - C:\ProgramData\RageCore_567a1a28\win_guard_1.exe
      "C:\ProgramData\RageCore_567a1a28\win_guard_1.exe"
      4⤵
      PID:5508
    - - C:\ProgramData\RageCore_30b6346d\win_guard_0.exe
        
        "C:\ProgramData\RageCore_30b6346d\win_guard_0.exe"
        5⤵
        
        PID:3452
      - C:\Windows\Temp\RageCore_26ff054f\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_26ff054f\win_guard_0.exe"
        6⤵
        
        PID:7828
        
        C:\Users\Public\RageCore_79aaee43\win_guard_0.exe
        
        "C:\Users\Public\RageCore_79aaee43\win_guard_0.exe"
        7⤵
        
        PID:20300
        
        C:\Windows\Temp\RageCore_15a973ce\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_15a973ce\win_guard_1.exe"
        7⤵
        
        PID:27392
      - C:\ProgramData\RageCore_f23de3a9\win_guard_1.exe
        
        "C:\ProgramData\RageCore_f23de3a9\win_guard_1.exe"
        6⤵
        
        PID:9936
        
        C:\ProgramData\RageCore_263bf745\win_guard_0.exe
        
        "C:\ProgramData\RageCore_263bf745\win_guard_0.exe"
        7⤵
        
        PID:21096
      - C:\Users\Public\RageCore_a055a3eb\win_guard_2.exe
        
        "C:\Users\Public\RageCore_a055a3eb\win_guard_2.exe"
        6⤵
        
        PID:11868
        
        C:\Windows\Temp\RageCore_2db81149\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_2db81149\win_guard_0.exe"
        7⤵
        
        PID:28404
      - C:\ProgramData\RageCore_0591455b\win_guard_3.exe
        
        "C:\ProgramData\RageCore_0591455b\win_guard_3.exe"
        6⤵
        
        PID:18012
      - C:\Windows\Temp\RageCore_3df78142\win_guard_4.exe
        
        "C:\Windows\Temp\RageCore_3df78142\win_guard_4.exe"
        6⤵
        
        PID:23092
    - - C:\Windows\Temp\RageCore_b1ff612c\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_b1ff612c\win_guard_1.exe"
        5⤵
        
        PID:5912
      - C:\ProgramData\RageCore_79865c4a\win_guard_0.exe
        
        "C:\ProgramData\RageCore_79865c4a\win_guard_0.exe"
        6⤵
        
        PID:10856
        
        C:\ProgramData\RageCore_71fe67e0\win_guard_0.exe
        
        "C:\ProgramData\RageCore_71fe67e0\win_guard_0.exe"
        7⤵
        
        PID:24136
      - C:\Users\Public\RageCore_e77811d8\win_guard_1.exe
        
        "C:\Users\Public\RageCore_e77811d8\win_guard_1.exe"
        6⤵
        
        PID:13928
        
        C:\Windows\Temp\RageCore_7f85edf6\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_7f85edf6\win_guard_0.exe"
        7⤵
        
        PID:28856
      - C:\Windows\Temp\RageCore_90e594bf\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_90e594bf\win_guard_2.exe"
        6⤵
        
        PID:19096
      - C:\Users\Public\RageCore_7dfbda7e\win_guard_3.exe
        
        "C:\Users\Public\RageCore_7dfbda7e\win_guard_3.exe"
        6⤵
        
        PID:896
    - - C:\Windows\Temp\RageCore_e097db47\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_e097db47\win_guard_2.exe"
        5⤵
        
        PID:7652
      - C:\Users\Public\RageCore_e844ccf7\win_guard_0.exe
        
        "C:\Users\Public\RageCore_e844ccf7\win_guard_0.exe"
        6⤵
        
        PID:16300
      - C:\ProgramData\RageCore_2156c604\win_guard_1.exe
        
        "C:\ProgramData\RageCore_2156c604\win_guard_1.exe"
        6⤵
        
        PID:22568
    - - C:\Windows\Temp\RageCore_690668bb\win_guard_3.exe
        
        "C:\Windows\Temp\RageCore_690668bb\win_guard_3.exe"
        5⤵
        
        PID:8724
      - C:\Windows\Temp\RageCore_889130e6\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_889130e6\win_guard_0.exe"
        6⤵
        
        PID:20640
    - - C:\Users\Public\RageCore_2584cd4a\win_guard_4.exe
        
        "C:\Users\Public\RageCore_2584cd4a\win_guard_4.exe"
        5⤵
        
        PID:12444
      - C:\Windows\Temp\RageCore_8b01a6fc\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_8b01a6fc\win_guard_0.exe"
        6⤵
        
        PID:28396
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_30b6346d\win_guard_0.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:19244
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\ProgramData\RageCore_30b6346d\win_guard_0.exe" /sc onlogon /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:26844
  - - C:\Users\Public\RageCore_99c5c0e2\win_guard_2.exe
      "C:\Users\Public\RageCore_99c5c0e2\win_guard_2.exe"
      4⤵
      PID:2588
    - - C:\Users\Public\RageCore_b1d876aa\win_guard_0.exe
        
        "C:\Users\Public\RageCore_b1d876aa\win_guard_0.exe"
        5⤵
        
        PID:6272
      - C:\Windows\Temp\RageCore_0cfb87ee\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_0cfb87ee\win_guard_0.exe"
        6⤵
        
        PID:12492
        
        C:\ProgramData\RageCore_6215ce3f\win_guard_0.exe
        
        "C:\ProgramData\RageCore_6215ce3f\win_guard_0.exe"
        7⤵
        
        PID:9592
      - C:\ProgramData\RageCore_8eb2e6b8\win_guard_1.exe
        
        "C:\ProgramData\RageCore_8eb2e6b8\win_guard_1.exe"
        6⤵
        
        PID:16976
      - C:\Windows\Temp\RageCore_69b89713\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_69b89713\win_guard_2.exe"
        6⤵
        
        PID:23376
    - - C:\Windows\Temp\RageCore_01f160d2\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_01f160d2\win_guard_1.exe"
        5⤵
        
        PID:7644
      - C:\ProgramData\RageCore_8551a8e6\win_guard_0.exe
        
        "C:\ProgramData\RageCore_8551a8e6\win_guard_0.exe"
        6⤵
        
        PID:17524
      - C:\Users\Public\RageCore_08cf0669\win_guard_1.exe
        
        "C:\Users\Public\RageCore_08cf0669\win_guard_1.exe"
        6⤵
        
        PID:24100
    - - C:\Windows\Temp\RageCore_f34bbe09\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_f34bbe09\win_guard_2.exe"
        5⤵
        
        PID:8992
      - C:\Windows\Temp\RageCore_cedb8183\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_cedb8183\win_guard_0.exe"
        6⤵
        
        PID:22472
    - - C:\ProgramData\RageCore_cc6e38ca\win_guard_3.exe
        
        "C:\ProgramData\RageCore_cc6e38ca\win_guard_3.exe"
        5⤵
        
        PID:12124
      - C:\Users\Public\RageCore_daf56977\win_guard_0.exe
        
        "C:\Users\Public\RageCore_daf56977\win_guard_0.exe"
        6⤵
        
        PID:10140
    - - C:\Windows\Temp\RageCore_6e394a6e\win_guard_4.exe
        
        "C:\Windows\Temp\RageCore_6e394a6e\win_guard_4.exe"
        5⤵
        
        PID:16952
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Users\Public\RageCore_b1d876aa\win_guard_0.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:24380
  - - C:\Users\Public\RageCore_6e9672c8\win_guard_3.exe
      "C:\Users\Public\RageCore_6e9672c8\win_guard_3.exe"
      4⤵
      PID:2352
    - - C:\Users\Public\RageCore_6ea501c6\win_guard_0.exe
        
        "C:\Users\Public\RageCore_6ea501c6\win_guard_0.exe"
        5⤵
        
        PID:6776
      - C:\Windows\Temp\RageCore_1f2397e1\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_1f2397e1\win_guard_0.exe"
        6⤵
        
        PID:11520
        
        C:\Users\Public\RageCore_641faab5\win_guard_0.exe
        
        "C:\Users\Public\RageCore_641faab5\win_guard_0.exe"
        7⤵
        
        PID:27168
      - C:\ProgramData\RageCore_6f5c334e\win_guard_1.exe
        
        "C:\ProgramData\RageCore_6f5c334e\win_guard_1.exe"
        6⤵
        
        PID:15672
      - C:\ProgramData\RageCore_e6ef27e3\win_guard_2.exe
        
        "C:\ProgramData\RageCore_e6ef27e3\win_guard_2.exe"
        6⤵
        
        PID:21856
    - - C:\Windows\Temp\RageCore_b43a63d1\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_b43a63d1\win_guard_1.exe"
        5⤵
        
        PID:7340
      - C:\ProgramData\RageCore_8a617cc9\win_guard_0.exe
        
        "C:\ProgramData\RageCore_8a617cc9\win_guard_0.exe"
        6⤵
        
        PID:13984
      - C:\Windows\Temp\RageCore_0d2bc220\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_0d2bc220\win_guard_1.exe"
        6⤵
        
        PID:18880
      - C:\Users\Public\RageCore_8e02c6bf\win_guard_2.exe
        
        "C:\Users\Public\RageCore_8e02c6bf\win_guard_2.exe"
        6⤵
        
        PID:28288
    - - C:\ProgramData\RageCore_7dc44bab\win_guard_2.exe
        
        "C:\ProgramData\RageCore_7dc44bab\win_guard_2.exe"
        5⤵
        
        PID:8772
      - C:\Users\Public\RageCore_acd58958\win_guard_0.exe
        
        "C:\Users\Public\RageCore_acd58958\win_guard_0.exe"
        6⤵
        
        PID:19716
      - C:\Users\Public\RageCore_b3a22fd8\win_guard_1.exe
        
        "C:\Users\Public\RageCore_b3a22fd8\win_guard_1.exe"
        6⤵
        
        PID:26544
    - - C:\Users\Public\RageCore_84386a0d\win_guard_3.exe
        
        "C:\Users\Public\RageCore_84386a0d\win_guard_3.exe"
        5⤵
        
        PID:11016
      - C:\ProgramData\RageCore_8af84a3a\win_guard_0.exe
        
        "C:\ProgramData\RageCore_8af84a3a\win_guard_0.exe"
        6⤵
        
        PID:24492
    - - C:\Users\Public\RageCore_677c2853\win_guard_4.exe
        
        "C:\Users\Public\RageCore_677c2853\win_guard_4.exe"
        5⤵
        
        PID:13936
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Users\Public\RageCore_6ea501c6\win_guard_0.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:20740
  - - C:\Windows\Temp\RageCore_ab8873a4\win_guard_4.exe
      "C:\Windows\Temp\RageCore_ab8873a4\win_guard_4.exe"
      4⤵
      PID:5720
    - - C:\ProgramData\RageCore_872393a8\win_guard_0.exe
        
        "C:\ProgramData\RageCore_872393a8\win_guard_0.exe"
        5⤵
        
        PID:8452
      - C:\Windows\Temp\RageCore_0f90635b\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_0f90635b\win_guard_0.exe"
        6⤵
        
        PID:16492
      - C:\Users\Public\RageCore_a85abb2e\win_guard_1.exe
        
        "C:\Users\Public\RageCore_a85abb2e\win_guard_1.exe"
        6⤵
        
        PID:22660
    - - C:\Users\Public\RageCore_518b506c\win_guard_1.exe
        
        "C:\Users\Public\RageCore_518b506c\win_guard_1.exe"
        5⤵
        
        PID:10996
      - C:\Users\Public\RageCore_23b3b9e3\win_guard_0.exe
        
        "C:\Users\Public\RageCore_23b3b9e3\win_guard_0.exe"
        6⤵
        
        PID:21000
    - - C:\Users\Public\RageCore_62697937\win_guard_2.exe
        
        "C:\Users\Public\RageCore_62697937\win_guard_2.exe"
        5⤵
        
        PID:13612
      - C:\Windows\Temp\RageCore_de4037d1\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_de4037d1\win_guard_0.exe"
        6⤵
        
        PID:27436
    - - C:\ProgramData\RageCore_b3ce081f\win_guard_3.exe
        
        "C:\ProgramData\RageCore_b3ce081f\win_guard_3.exe"
        5⤵
        
        PID:17456
    - - C:\Windows\Temp\RageCore_e26ddd8f\win_guard_4.exe
        
        "C:\Windows\Temp\RageCore_e26ddd8f\win_guard_4.exe"
        5⤵
        
        PID:25028
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Users\Public\RageCore_8b60ca97\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:8548
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\Users\Public\RageCore_8b60ca97\win_guard_0.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:11984
  - - C:\Windows\SysWOW64\takeown.exe
      "C:\Windows\System32\takeown.exe" /f "C:\Windows\system32\cmd.exe" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:23000
- - C:\ProgramData\RageCore_23d88336\win_guard_1.exe
    "C:\ProgramData\RageCore_23d88336\win_guard_1.exe"
    3⤵
    PID:1812
  - - C:\ProgramData\RageCore_a00fba93\win_guard_0.exe
      "C:\ProgramData\RageCore_a00fba93\win_guard_0.exe"
      4⤵
      PID:712
    - - C:\Windows\Temp\RageCore_69f20302\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_69f20302\win_guard_0.exe"
        5⤵
        
        PID:6332
      - C:\Windows\Temp\RageCore_a3b75d3e\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_a3b75d3e\win_guard_0.exe"
        6⤵
        
        PID:10832
        
        C:\ProgramData\RageCore_9576274e\win_guard_0.exe
        
        "C:\ProgramData\RageCore_9576274e\win_guard_0.exe"
        7⤵
        
        PID:23688
      - C:\Users\Public\RageCore_98c306bb\win_guard_1.exe
        
        "C:\Users\Public\RageCore_98c306bb\win_guard_1.exe"
        6⤵
        
        PID:12572
        
        C:\Users\Public\RageCore_76377978\win_guard_0.exe
        
        "C:\Users\Public\RageCore_76377978\win_guard_0.exe"
        7⤵
        
        PID:9604
      - C:\ProgramData\RageCore_4a548bf7\win_guard_2.exe
        
        "C:\ProgramData\RageCore_4a548bf7\win_guard_2.exe"
        6⤵
        
        PID:16988
      - C:\Windows\Temp\RageCore_6bac9e9d\win_guard_3.exe
        
        "C:\Windows\Temp\RageCore_6bac9e9d\win_guard_3.exe"
        6⤵
        
        PID:23168
    - - C:\Users\Public\RageCore_916f2747\win_guard_1.exe
        
        "C:\Users\Public\RageCore_916f2747\win_guard_1.exe"
        5⤵
        
        PID:7772
      - C:\Users\Public\RageCore_287157cc\win_guard_0.exe
        
        "C:\Users\Public\RageCore_287157cc\win_guard_0.exe"
        6⤵
        
        PID:17492
      - C:\Users\Public\RageCore_783ee012\win_guard_1.exe
        
        "C:\Users\Public\RageCore_783ee012\win_guard_1.exe"
        6⤵
        
        PID:23976
    - - C:\Users\Public\RageCore_c5249cf5\win_guard_2.exe
        
        "C:\Users\Public\RageCore_c5249cf5\win_guard_2.exe"
        5⤵
        
        PID:9744
      - C:\Users\Public\RageCore_b489d3d4\win_guard_0.exe
        
        "C:\Users\Public\RageCore_b489d3d4\win_guard_0.exe"
        6⤵
        
        PID:18884
      - C:\ProgramData\RageCore_7b513a0d\win_guard_1.exe
        
        "C:\ProgramData\RageCore_7b513a0d\win_guard_1.exe"
        6⤵
        
        PID:28316
    - - C:\Users\Public\RageCore_a9c06ed2\win_guard_3.exe
        
        "C:\Users\Public\RageCore_a9c06ed2\win_guard_3.exe"
        5⤵
        
        PID:12052
      - C:\ProgramData\RageCore_9e3ff848\win_guard_0.exe
        
        "C:\ProgramData\RageCore_9e3ff848\win_guard_0.exe"
        6⤵
        
        PID:27692
    - - C:\Users\Public\RageCore_4fd13eb1\win_guard_4.exe
        
        "C:\Users\Public\RageCore_4fd13eb1\win_guard_4.exe"
        5⤵
        
        PID:16192
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Windows\Temp\RageCore_69f20302\win_guard_0.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:22912
  - - C:\ProgramData\RageCore_2943299d\win_guard_1.exe
      "C:\ProgramData\RageCore_2943299d\win_guard_1.exe"
      4⤵
      PID:1536
    - - C:\Users\Public\RageCore_cc87ef80\win_guard_0.exe
        
        "C:\Users\Public\RageCore_cc87ef80\win_guard_0.exe"
        5⤵
        
        PID:3720
      - C:\ProgramData\RageCore_b25b7ca8\win_guard_0.exe
        
        "C:\ProgramData\RageCore_b25b7ca8\win_guard_0.exe"
        6⤵
        
        PID:13344
        
        C:\Users\Public\RageCore_698b8cc3\win_guard_0.exe
        
        "C:\Users\Public\RageCore_698b8cc3\win_guard_0.exe"
        7⤵
        
        PID:27944
      - C:\Windows\Temp\RageCore_ab9a0b47\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_ab9a0b47\win_guard_1.exe"
        6⤵
        
        PID:16752
      - C:\Users\Public\RageCore_3e449f14\win_guard_2.exe
        
        "C:\Users\Public\RageCore_3e449f14\win_guard_2.exe"
        6⤵
        
        PID:25080
    - - C:\ProgramData\RageCore_9377375d\win_guard_1.exe
        
        "C:\ProgramData\RageCore_9377375d\win_guard_1.exe"
        5⤵
        
        PID:8308
      - C:\Users\Public\RageCore_d4d6d551\win_guard_0.exe
        
        "C:\Users\Public\RageCore_d4d6d551\win_guard_0.exe"
        6⤵
        
        PID:15444
      - C:\Users\Public\RageCore_4032f2b8\win_guard_1.exe
        
        "C:\Users\Public\RageCore_4032f2b8\win_guard_1.exe"
        6⤵
        
        PID:21028
    - - C:\Users\Public\RageCore_7c634228\win_guard_2.exe
        
        "C:\Users\Public\RageCore_7c634228\win_guard_2.exe"
        5⤵
        
        PID:8404
      - C:\Windows\Temp\RageCore_77b62232\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_77b62232\win_guard_0.exe"
        6⤵
        
        PID:21564
    - - C:\ProgramData\RageCore_0b4d1b4c\win_guard_3.exe
        
        "C:\ProgramData\RageCore_0b4d1b4c\win_guard_3.exe"
        5⤵
        
        PID:12132
      - C:\ProgramData\RageCore_3051f29c\win_guard_0.exe
        
        "C:\ProgramData\RageCore_3051f29c\win_guard_0.exe"
        6⤵
        
        PID:28036
    - - C:\Windows\Temp\RageCore_2065b3c8\win_guard_4.exe
        
        "C:\Windows\Temp\RageCore_2065b3c8\win_guard_4.exe"
        5⤵
        
        PID:16836
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Users\Public\RageCore_cc87ef80\win_guard_0.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:24204
  - - C:\Windows\Temp\RageCore_baff0e11\win_guard_2.exe
      "C:\Windows\Temp\RageCore_baff0e11\win_guard_2.exe"
      4⤵
      PID:5336
    - - C:\Users\Public\RageCore_2cfdaf8d\win_guard_0.exe
        
        "C:\Users\Public\RageCore_2cfdaf8d\win_guard_0.exe"
        5⤵
        
        PID:10824
      - C:\ProgramData\RageCore_e0ce1f7a\win_guard_0.exe
        
        "C:\ProgramData\RageCore_e0ce1f7a\win_guard_0.exe"
        6⤵
        
        PID:20672
    - - C:\Users\Public\RageCore_801a9fc4\win_guard_1.exe
        
        "C:\Users\Public\RageCore_801a9fc4\win_guard_1.exe"
        5⤵
        
        PID:13920
    - - C:\Windows\Temp\RageCore_182e0018\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_182e0018\win_guard_2.exe"
        5⤵
        
        PID:18948
    - - C:\Windows\Temp\RageCore_61ac0545\win_guard_3.exe
        
        "C:\Windows\Temp\RageCore_61ac0545\win_guard_3.exe"
        5⤵
        
        PID:6600
  - - C:\Windows\Temp\RageCore_cf232557\win_guard_3.exe
      "C:\Windows\Temp\RageCore_cf232557\win_guard_3.exe"
      4⤵
      PID:7056
    - - C:\ProgramData\RageCore_9282ee10\win_guard_0.exe
        
        "C:\ProgramData\RageCore_9282ee10\win_guard_0.exe"
        5⤵
        
        PID:15092
    - - C:\Windows\Temp\RageCore_5bc87792\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_5bc87792\win_guard_1.exe"
        5⤵
        
        PID:21052
  - - C:\ProgramData\RageCore_d7295fd8\win_guard_4.exe
      "C:\ProgramData\RageCore_d7295fd8\win_guard_4.exe"
      4⤵
      PID:8120
    - - C:\ProgramData\RageCore_b5addc88\win_guard_0.exe
        
        "C:\ProgramData\RageCore_b5addc88\win_guard_0.exe"
        5⤵
        
        PID:15628
    - - C:\Users\Public\RageCore_6cd68d23\win_guard_1.exe
        
        "C:\Users\Public\RageCore_6cd68d23\win_guard_1.exe"
        5⤵
        
        PID:22084
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_a00fba93\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:13760
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\ProgramData\RageCore_a00fba93\win_guard_0.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:21932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 2764
      4⤵
      Program crash
      PID:26704
- - C:\ProgramData\RageCore_e6d773f9\win_guard_2.exe
    "C:\ProgramData\RageCore_e6d773f9\win_guard_2.exe"
    3⤵
    PID:3752
  - - C:\Windows\Temp\RageCore_bcead265\win_guard_0.exe
      "C:\Windows\Temp\RageCore_bcead265\win_guard_0.exe"
      4⤵
      PID:5108
    - - C:\Windows\Temp\RageCore_62cfc2d1\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_62cfc2d1\win_guard_0.exe"
        5⤵
        
        PID:6700
      - C:\ProgramData\RageCore_aee7703f\win_guard_0.exe
        
        "C:\ProgramData\RageCore_aee7703f\win_guard_0.exe"
        6⤵
        
        PID:13912
      - C:\Windows\Temp\RageCore_2c248381\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_2c248381\win_guard_1.exe"
        6⤵
        
        PID:19068
      - C:\Users\Public\RageCore_a779a31b\win_guard_2.exe
        
        "C:\Users\Public\RageCore_a779a31b\win_guard_2.exe"
        6⤵
        
        PID:25252
    - - C:\ProgramData\RageCore_af4a484c\win_guard_1.exe
        
        "C:\ProgramData\RageCore_af4a484c\win_guard_1.exe"
        5⤵
        
        PID:7660
      - C:\ProgramData\RageCore_9286b128\win_guard_0.exe
        
        "C:\ProgramData\RageCore_9286b128\win_guard_0.exe"
        6⤵
        
        PID:16420
      - C:\Windows\Temp\RageCore_5d6946d9\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_5d6946d9\win_guard_1.exe"
        6⤵
        
        PID:22356
    - - C:\Windows\Temp\RageCore_22b6b1e4\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_22b6b1e4\win_guard_2.exe"
        5⤵
        
        PID:6696
      - C:\Users\Public\RageCore_da5a51e9\win_guard_0.exe
        
        "C:\Users\Public\RageCore_da5a51e9\win_guard_0.exe"
        6⤵
        
        PID:21584
    - - C:\Windows\Temp\RageCore_ae185729\win_guard_3.exe
        
        "C:\Windows\Temp\RageCore_ae185729\win_guard_3.exe"
        5⤵
        
        PID:12604
    - - C:\Users\Public\RageCore_4c7f5016\win_guard_4.exe
        
        "C:\Users\Public\RageCore_4c7f5016\win_guard_4.exe"
        5⤵
        
        PID:17468
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Windows\Temp\RageCore_62cfc2d1\win_guard_0.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:24320
  - - C:\Users\Public\RageCore_d4f6ee6d\win_guard_1.exe
      "C:\Users\Public\RageCore_d4f6ee6d\win_guard_1.exe"
      4⤵
      PID:2740
    - - C:\Users\Public\RageCore_7d9f4fcd\win_guard_0.exe
        
        "C:\Users\Public\RageCore_7d9f4fcd\win_guard_0.exe"
        5⤵
        
        PID:10840
      - C:\ProgramData\RageCore_604ffffe\win_guard_0.exe
        
        "C:\ProgramData\RageCore_604ffffe\win_guard_0.exe"
        6⤵
        
        PID:23940
    - - C:\ProgramData\RageCore_0c0ae5ee\win_guard_1.exe
        
        "C:\ProgramData\RageCore_0c0ae5ee\win_guard_1.exe"
        5⤵
        
        PID:14776
    - - C:\Users\Public\RageCore_e3b48755\win_guard_2.exe
        
        "C:\Users\Public\RageCore_e3b48755\win_guard_2.exe"
        5⤵
        
        PID:21060
  - - C:\ProgramData\RageCore_0f7354c4\win_guard_2.exe
      "C:\ProgramData\RageCore_0f7354c4\win_guard_2.exe"
      4⤵
      PID:6648
    - - C:\Users\Public\RageCore_a20958fe\win_guard_0.exe
        
        "C:\Users\Public\RageCore_a20958fe\win_guard_0.exe"
        5⤵
        
        PID:15336
    - - C:\Users\Public\RageCore_d038b944\win_guard_1.exe
        
        "C:\Users\Public\RageCore_d038b944\win_guard_1.exe"
        5⤵
        
        PID:20968
  - - C:\ProgramData\RageCore_7915abb9\win_guard_3.exe
      "C:\ProgramData\RageCore_7915abb9\win_guard_3.exe"
      4⤵
      PID:7988
    - - C:\Users\Public\RageCore_3c73c71b\win_guard_0.exe
        
        "C:\Users\Public\RageCore_3c73c71b\win_guard_0.exe"
        5⤵
        
        PID:17500
    - - C:\Users\Public\RageCore_fd3c5c4b\win_guard_1.exe
        
        "C:\Users\Public\RageCore_fd3c5c4b\win_guard_1.exe"
        5⤵
        
        PID:23952
  - - C:\Users\Public\RageCore_8b11d66c\win_guard_4.exe
      "C:\Users\Public\RageCore_8b11d66c\win_guard_4.exe"
      4⤵
      PID:7696
    - - C:\Users\Public\RageCore_61ac16a4\win_guard_0.exe
        
        "C:\Users\Public\RageCore_61ac16a4\win_guard_0.exe"
        5⤵
        
        PID:23720
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Windows\Temp\RageCore_bcead265\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:18628
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\Windows\Temp\RageCore_bcead265\win_guard_0.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:26328
- - C:\ProgramData\RageCore_d2cd42d0\win_guard_3.exe
    "C:\ProgramData\RageCore_d2cd42d0\win_guard_3.exe"
    3⤵
    PID:1692
  - - C:\Users\Public\RageCore_a0f68e0c\win_guard_0.exe
      "C:\Users\Public\RageCore_a0f68e0c\win_guard_0.exe"
      4⤵
      PID:5884
    - - C:\Users\Public\RageCore_a7918e6b\win_guard_0.exe
        
        "C:\Users\Public\RageCore_a7918e6b\win_guard_0.exe"
        5⤵
        
        PID:6640
      - C:\ProgramData\RageCore_ca0f5071\win_guard_0.exe
        
        "C:\ProgramData\RageCore_ca0f5071\win_guard_0.exe"
        6⤵
        
        PID:11512
        
        C:\Users\Public\RageCore_081d9148\win_guard_0.exe
        
        "C:\Users\Public\RageCore_081d9148\win_guard_0.exe"
        7⤵
        
        PID:24676
      - C:\ProgramData\RageCore_301d57fd\win_guard_1.exe
        
        "C:\ProgramData\RageCore_301d57fd\win_guard_1.exe"
        6⤵
        
        PID:15204
      - C:\Users\Public\RageCore_8bf785cf\win_guard_2.exe
        
        "C:\Users\Public\RageCore_8bf785cf\win_guard_2.exe"
        6⤵
        
        PID:21104
    - - C:\ProgramData\RageCore_00eef9ce\win_guard_1.exe
        
        "C:\ProgramData\RageCore_00eef9ce\win_guard_1.exe"
        5⤵
        
        PID:7292
      - C:\Windows\Temp\RageCore_57fa301f\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_57fa301f\win_guard_0.exe"
        6⤵
        
        PID:13380
        
        C:\ProgramData\RageCore_3acf05cb\win_guard_0.exe
        
        "C:\ProgramData\RageCore_3acf05cb\win_guard_0.exe"
        7⤵
        
        PID:27712
      - C:\Users\Public\RageCore_9b8eaa34\win_guard_1.exe
        
        "C:\Users\Public\RageCore_9b8eaa34\win_guard_1.exe"
        6⤵
        
        PID:18288
      - C:\ProgramData\RageCore_69501c31\win_guard_2.exe
        
        "C:\ProgramData\RageCore_69501c31\win_guard_2.exe"
        6⤵
        
        PID:25088
    - - C:\Windows\Temp\RageCore_ec525a1a\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_ec525a1a\win_guard_2.exe"
        5⤵
        
        PID:8572
      - C:\ProgramData\RageCore_aa0decc5\win_guard_0.exe
        
        "C:\ProgramData\RageCore_aa0decc5\win_guard_0.exe"
        6⤵
        
        PID:16032
      - C:\ProgramData\RageCore_c5cd60da\win_guard_1.exe
        
        "C:\ProgramData\RageCore_c5cd60da\win_guard_1.exe"
        6⤵
        
        PID:22408
    - - C:\Users\Public\RageCore_d42008eb\win_guard_3.exe
        
        "C:\Users\Public\RageCore_d42008eb\win_guard_3.exe"
        5⤵
        
        PID:10344
      - C:\Users\Public\RageCore_09d6f791\win_guard_0.exe
        
        "C:\Users\Public\RageCore_09d6f791\win_guard_0.exe"
        6⤵
        
        PID:21536
    - - C:\ProgramData\RageCore_10377e6d\win_guard_4.exe
        
        "C:\ProgramData\RageCore_10377e6d\win_guard_4.exe"
        5⤵
        
        PID:12812
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Users\Public\RageCore_a7918e6b\win_guard_0.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:20804
  - - C:\Users\Public\RageCore_a872035b\win_guard_1.exe
      "C:\Users\Public\RageCore_a872035b\win_guard_1.exe"
      4⤵
      PID:4816
    - - C:\ProgramData\RageCore_4194d2a4\win_guard_0.exe
        
        "C:\ProgramData\RageCore_4194d2a4\win_guard_0.exe"
        5⤵
        
        PID:6768
      - C:\Windows\Temp\RageCore_bd5122b1\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_bd5122b1\win_guard_0.exe"
        6⤵
        
        PID:11816
        
        C:\Users\Public\RageCore_357fecef\win_guard_0.exe
        
        "C:\Users\Public\RageCore_357fecef\win_guard_0.exe"
        7⤵
        
        PID:27376
      - C:\Users\Public\RageCore_a6a64c47\win_guard_1.exe
        
        "C:\Users\Public\RageCore_a6a64c47\win_guard_1.exe"
        6⤵
        
        PID:14580
      - C:\Users\Public\RageCore_0a5c5f66\win_guard_2.exe
        
        "C:\Users\Public\RageCore_0a5c5f66\win_guard_2.exe"
        6⤵
        
        PID:20772
      - C:\Windows\Temp\RageCore_649d13a9\win_guard_3.exe
        
        "C:\Windows\Temp\RageCore_649d13a9\win_guard_3.exe"
        6⤵
        
        PID:28628
    - - C:\Windows\Temp\RageCore_cbdc1c94\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_cbdc1c94\win_guard_1.exe"
        5⤵
        
        PID:7844
      - C:\Users\Public\RageCore_a1f41729\win_guard_0.exe
        
        "C:\Users\Public\RageCore_a1f41729\win_guard_0.exe"
        6⤵
        
        PID:17508
      - C:\Windows\Temp\RageCore_ad796329\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_ad796329\win_guard_1.exe"
        6⤵
        
        PID:23900
    - - C:\Windows\Temp\RageCore_72e17389\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_72e17389\win_guard_2.exe"
        5⤵
        
        PID:9024
      - C:\Windows\Temp\RageCore_1550a35d\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_1550a35d\win_guard_0.exe"
        6⤵
        
        PID:22540
    - - C:\ProgramData\RageCore_6bc68cc4\win_guard_3.exe
        
        "C:\ProgramData\RageCore_6bc68cc4\win_guard_3.exe"
        5⤵
        
        PID:13324
      - C:\Users\Public\RageCore_351dc8c8\win_guard_0.exe
        
        "C:\Users\Public\RageCore_351dc8c8\win_guard_0.exe"
        6⤵
        
        PID:28180
    - - C:\ProgramData\RageCore_a6de2990\win_guard_4.exe
        
        "C:\ProgramData\RageCore_a6de2990\win_guard_4.exe"
        5⤵
        
        PID:18972
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_4194d2a4\win_guard_0.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:26908
  - - C:\Windows\Temp\RageCore_ec188190\win_guard_2.exe
      "C:\Windows\Temp\RageCore_ec188190\win_guard_2.exe"
      4⤵
      PID:3892
    - - C:\Users\Public\RageCore_53f986d1\win_guard_0.exe
        
        "C:\Users\Public\RageCore_53f986d1\win_guard_0.exe"
        5⤵
        
        PID:8300
      - C:\Windows\Temp\RageCore_61e71968\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_61e71968\win_guard_0.exe"
        6⤵
        
        PID:19856
      - C:\ProgramData\RageCore_04597d02\win_guard_1.exe
        
        "C:\ProgramData\RageCore_04597d02\win_guard_1.exe"
        6⤵
        
        PID:8168
    - - C:\Users\Public\RageCore_8e634e2f\win_guard_1.exe
        
        "C:\Users\Public\RageCore_8e634e2f\win_guard_1.exe"
        5⤵
        
        PID:9876
      - C:\ProgramData\RageCore_595d2acc\win_guard_0.exe
        
        "C:\ProgramData\RageCore_595d2acc\win_guard_0.exe"
        6⤵
        
        PID:24108
    - - C:\Users\Public\RageCore_380ae189\win_guard_2.exe
        
        "C:\Users\Public\RageCore_380ae189\win_guard_2.exe"
        5⤵
        
        PID:13184
      - C:\Users\Public\RageCore_0b63e0cb\win_guard_0.exe
        
        "C:\Users\Public\RageCore_0b63e0cb\win_guard_0.exe"
        6⤵
        
        PID:26780
    - - C:\Users\Public\RageCore_f7c365d4\win_guard_3.exe
        
        "C:\Users\Public\RageCore_f7c365d4\win_guard_3.exe"
        5⤵
        
        PID:18872
    - - C:\Users\Public\RageCore_f869cb8a\win_guard_4.exe
        
        "C:\Users\Public\RageCore_f869cb8a\win_guard_4.exe"
        5⤵
        
        PID:4212
  - - C:\Users\Public\RageCore_a8596b36\win_guard_3.exe
      "C:\Users\Public\RageCore_a8596b36\win_guard_3.exe"
      4⤵
      PID:5256
    - - C:\Windows\Temp\RageCore_4cdfc878\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_4cdfc878\win_guard_0.exe"
        5⤵
        
        PID:11104
      - C:\Windows\Temp\RageCore_03f292c0\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_03f292c0\win_guard_0.exe"
        6⤵
        
        PID:3812
    - - C:\ProgramData\RageCore_72903f1a\win_guard_1.exe
        
        "C:\ProgramData\RageCore_72903f1a\win_guard_1.exe"
        5⤵
        
        PID:14016
    - - C:\Users\Public\RageCore_69452f80\win_guard_2.exe
        
        "C:\Users\Public\RageCore_69452f80\win_guard_2.exe"
        5⤵
        
        PID:19744
    - - C:\ProgramData\RageCore_0b18a2bd\win_guard_3.exe
        
        "C:\ProgramData\RageCore_0b18a2bd\win_guard_3.exe"
        5⤵
        
        PID:28296
  - - C:\Windows\Temp\RageCore_3199865d\win_guard_4.exe
      "C:\Windows\Temp\RageCore_3199865d\win_guard_4.exe"
      4⤵
      PID:7068
    - - C:\ProgramData\RageCore_e6dc0143\win_guard_0.exe
        
        "C:\ProgramData\RageCore_e6dc0143\win_guard_0.exe"
        5⤵
        
        PID:15356
    - - C:\ProgramData\RageCore_f599f269\win_guard_1.exe
        
        "C:\ProgramData\RageCore_f599f269\win_guard_1.exe"
        5⤵
        
        PID:20984
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Users\Public\RageCore_a0f68e0c\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:10328
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\Users\Public\RageCore_a0f68e0c\win_guard_0.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:13972
  - - C:\Windows\SysWOW64\takeown.exe
      "C:\Windows\System32\takeown.exe" /f "C:\Windows\system32\cmd.exe" /a
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:24744
- - C:\Users\Public\RageCore_20ae95ba\win_guard_4.exe
    "C:\Users\Public\RageCore_20ae95ba\win_guard_4.exe"
    3⤵
    PID:748
  - - C:\Windows\Temp\RageCore_e9692204\win_guard_0.exe
      "C:\Windows\Temp\RageCore_e9692204\win_guard_0.exe"
      4⤵
      PID:2384
    - - C:\ProgramData\RageCore_03de8278\win_guard_0.exe
        
        "C:\ProgramData\RageCore_03de8278\win_guard_0.exe"
        5⤵
        
        PID:12436
      - C:\ProgramData\RageCore_d70ad656\win_guard_0.exe
        
        "C:\ProgramData\RageCore_d70ad656\win_guard_0.exe"
        6⤵
        
        PID:9540
    - - C:\Users\Public\RageCore_418c9c5f\win_guard_1.exe
        
        "C:\Users\Public\RageCore_418c9c5f\win_guard_1.exe"
        5⤵
        
        PID:16604
    - - C:\Users\Public\RageCore_cee18fd3\win_guard_2.exe
        
        "C:\Users\Public\RageCore_cee18fd3\win_guard_2.exe"
        5⤵
        
        PID:23080
  - - C:\Windows\Temp\RageCore_5ca6e4a5\win_guard_1.exe
      "C:\Windows\Temp\RageCore_5ca6e4a5\win_guard_1.exe"
      4⤵
      PID:7720
    - - C:\ProgramData\RageCore_da0805b1\win_guard_0.exe
        
        "C:\ProgramData\RageCore_da0805b1\win_guard_0.exe"
        5⤵
        
        PID:17516
    - - C:\Windows\Temp\RageCore_9e581fdb\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_9e581fdb\win_guard_1.exe"
        5⤵
        
        PID:23772
  - - C:\ProgramData\RageCore_6a367422\win_guard_2.exe
      "C:\ProgramData\RageCore_6a367422\win_guard_2.exe"
      4⤵
      PID:6708
    - - C:\Windows\Temp\RageCore_57157748\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_57157748\win_guard_0.exe"
        5⤵
        
        PID:21660
  - - C:\Windows\Temp\RageCore_8c80a3ea\win_guard_3.exe
      "C:\Windows\Temp\RageCore_8c80a3ea\win_guard_3.exe"
      4⤵
      PID:13148
  - - C:\Users\Public\RageCore_110c007c\win_guard_4.exe
      "C:\Users\Public\RageCore_110c007c\win_guard_4.exe"
      4⤵
      PID:18352
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Windows\Temp\RageCore_e9692204\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:26392
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Users\Public\RageCore_800d9432\win_guard_0.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:2992
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\Users\Public\RageCore_800d9432\win_guard_0.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5424
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\System32\takeown.exe" /f "C:\Windows\system32\cmd.exe" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:12400
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\Windows\system32\cmd.exe" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:20704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 2724
    3⤵
    - Program crash
    PID:21932
- C:\Windows\Temp\RageCore_ca88bc8e\win_guard_1.exe
  "C:\Windows\Temp\RageCore_ca88bc8e\win_guard_1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2576
- - C:\Users\Public\RageCore_1434a831\win_guard_0.exe
    "C:\Users\Public\RageCore_1434a831\win_guard_0.exe"
    3⤵
    PID:1708
  - - C:\ProgramData\RageCore_d7841349\win_guard_0.exe
      "C:\ProgramData\RageCore_d7841349\win_guard_0.exe"
      4⤵
      PID:3404
    - - C:\ProgramData\RageCore_d40a65a4\win_guard_0.exe
        
        "C:\ProgramData\RageCore_d40a65a4\win_guard_0.exe"
        5⤵
        
        PID:9072
      - C:\ProgramData\RageCore_eeefef52\win_guard_0.exe
        
        "C:\ProgramData\RageCore_eeefef52\win_guard_0.exe"
        6⤵
        
        PID:11272
      - C:\Users\Public\RageCore_e151e722\win_guard_1.exe
        
        "C:\Users\Public\RageCore_e151e722\win_guard_1.exe"
        6⤵
        
        PID:28308
    - - C:\ProgramData\RageCore_340cc703\win_guard_1.exe
        
        "C:\ProgramData\RageCore_340cc703\win_guard_1.exe"
        5⤵
        
        PID:11840
      - C:\ProgramData\RageCore_aded3094\win_guard_0.exe
        
        "C:\ProgramData\RageCore_aded3094\win_guard_0.exe"
        6⤵
        
        PID:27300
    - - C:\ProgramData\RageCore_54882235\win_guard_2.exe
        
        "C:\ProgramData\RageCore_54882235\win_guard_2.exe"
        5⤵
        
        PID:15904
    - - C:\Windows\Temp\RageCore_7eb8b656\win_guard_3.exe
        
        "C:\Windows\Temp\RageCore_7eb8b656\win_guard_3.exe"
        5⤵
        
        PID:22392
  - - C:\Users\Public\RageCore_720f9625\win_guard_1.exe
      "C:\Users\Public\RageCore_720f9625\win_guard_1.exe"
      4⤵
      PID:6456
    - - C:\Windows\Temp\RageCore_019fe1c9\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_019fe1c9\win_guard_0.exe"
        5⤵
        
        PID:13164
      - C:\ProgramData\RageCore_c14c48e3\win_guard_0.exe
        
        "C:\ProgramData\RageCore_c14c48e3\win_guard_0.exe"
        6⤵
        
        PID:28516
    - - C:\ProgramData\RageCore_3f20786d\win_guard_1.exe
        
        "C:\ProgramData\RageCore_3f20786d\win_guard_1.exe"
        5⤵
        
        PID:19652
    - - C:\ProgramData\RageCore_d5b61c3e\win_guard_2.exe
        
        "C:\ProgramData\RageCore_d5b61c3e\win_guard_2.exe"
        5⤵
        
        PID:24660
  - - C:\Users\Public\RageCore_8f8599d7\win_guard_2.exe
      "C:\Users\Public\RageCore_8f8599d7\win_guard_2.exe"
      4⤵
      PID:7560
    - - C:\ProgramData\RageCore_ffcf07e5\win_guard_0.exe
        
        "C:\ProgramData\RageCore_ffcf07e5\win_guard_0.exe"
        5⤵
        
        PID:16364
    - - C:\Windows\Temp\RageCore_d3c0c7e0\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_d3c0c7e0\win_guard_1.exe"
        5⤵
        
        PID:22156
  - - C:\Windows\Temp\RageCore_9ceb7c1f\win_guard_3.exe
      "C:\Windows\Temp\RageCore_9ceb7c1f\win_guard_3.exe"
      4⤵
      PID:9828
    - - C:\Windows\Temp\RageCore_ca40fd6f\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_ca40fd6f\win_guard_0.exe"
        5⤵
        
        PID:19760
    - - C:\Windows\Temp\RageCore_5b6d7c14\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_5b6d7c14\win_guard_1.exe"
        5⤵
        
        PID:26400
  - - C:\Windows\Temp\RageCore_632583a5\win_guard_4.exe
      "C:\Windows\Temp\RageCore_632583a5\win_guard_4.exe"
      4⤵
      PID:11900
    - - C:\ProgramData\RageCore_60903ca2\win_guard_0.exe
        
        "C:\ProgramData\RageCore_60903ca2\win_guard_0.exe"
        5⤵
        
        PID:23188
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_d7841349\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:20716
- - C:\Windows\Temp\RageCore_ea6bab53\win_guard_1.exe
    "C:\Windows\Temp\RageCore_ea6bab53\win_guard_1.exe"
    3⤵
    PID:3420
  - - C:\ProgramData\RageCore_4bdf946d\win_guard_0.exe
      "C:\ProgramData\RageCore_4bdf946d\win_guard_0.exe"
      4⤵
      PID:7144
    - - C:\Users\Public\RageCore_e2016561\win_guard_0.exe
        
        "C:\Users\Public\RageCore_e2016561\win_guard_0.exe"
        5⤵
        
        PID:13960
    - - C:\Windows\Temp\RageCore_269dc659\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_269dc659\win_guard_1.exe"
        5⤵
        
        PID:18856
    - - C:\Users\Public\RageCore_01a46b6d\win_guard_2.exe
        
        "C:\Users\Public\RageCore_01a46b6d\win_guard_2.exe"
        5⤵
        
        PID:24724
  - - C:\Windows\Temp\RageCore_c3296cae\win_guard_1.exe
      "C:\Windows\Temp\RageCore_c3296cae\win_guard_1.exe"
      4⤵
      PID:8432
    - - C:\ProgramData\RageCore_7ca170e8\win_guard_0.exe
        
        "C:\ProgramData\RageCore_7ca170e8\win_guard_0.exe"
        5⤵
        
        PID:19688
    - - C:\Windows\Temp\RageCore_75a69d99\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_75a69d99\win_guard_1.exe"
        5⤵
        
        PID:26360
  - - C:\ProgramData\RageCore_aebc4208\win_guard_2.exe
      "C:\ProgramData\RageCore_aebc4208\win_guard_2.exe"
      4⤵
      PID:10360
    - - C:\ProgramData\RageCore_b8a8ca64\win_guard_0.exe
        
        "C:\ProgramData\RageCore_b8a8ca64\win_guard_0.exe"
        5⤵
        
        PID:21720
  - - C:\ProgramData\RageCore_bc6c2c64\win_guard_3.exe
      "C:\ProgramData\RageCore_bc6c2c64\win_guard_3.exe"
      4⤵
      PID:12500
    - - C:\ProgramData\RageCore_d503255f\win_guard_0.exe
        
        "C:\ProgramData\RageCore_d503255f\win_guard_0.exe"
        5⤵
        
        PID:27832
  - - C:\Windows\Temp\RageCore_dea76fba\win_guard_4.exe
      "C:\Windows\Temp\RageCore_dea76fba\win_guard_4.exe"
      4⤵
      PID:16844
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_4bdf946d\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:24356
- - C:\Users\Public\RageCore_1ff6e998\win_guard_2.exe
    "C:\Users\Public\RageCore_1ff6e998\win_guard_2.exe"
    3⤵
    PID:4140
  - - C:\ProgramData\RageCore_f1ae9864\win_guard_0.exe
      "C:\ProgramData\RageCore_f1ae9864\win_guard_0.exe"
      4⤵
      PID:6868
    - - C:\Windows\Temp\RageCore_af34c941\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_af34c941\win_guard_0.exe"
        5⤵
        
        PID:13644
      - C:\Users\Public\RageCore_d9caedd7\win_guard_0.exe
        
        "C:\Users\Public\RageCore_d9caedd7\win_guard_0.exe"
        6⤵
        
        PID:27936
    - - C:\Users\Public\RageCore_2d48734a\win_guard_1.exe
        
        "C:\Users\Public\RageCore_2d48734a\win_guard_1.exe"
        5⤵
        
        PID:19196
    - - C:\Windows\Temp\RageCore_431472c9\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_431472c9\win_guard_2.exe"
        5⤵
        
        PID:4720
  - - C:\ProgramData\RageCore_e4776fca\win_guard_1.exe
      "C:\ProgramData\RageCore_e4776fca\win_guard_1.exe"
      4⤵
      PID:7996
    - - C:\Windows\Temp\RageCore_0761cce1\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_0761cce1\win_guard_0.exe"
        5⤵
        
        PID:15456
    - - C:\Windows\Temp\RageCore_0823c359\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_0823c359\win_guard_1.exe"
        5⤵
        
        PID:20976
  - - C:\Users\Public\RageCore_ff7343e1\win_guard_2.exe
      "C:\Users\Public\RageCore_ff7343e1\win_guard_2.exe"
      4⤵
      PID:4136
    - - C:\Users\Public\RageCore_615d2327\win_guard_0.exe
        
        "C:\Users\Public\RageCore_615d2327\win_guard_0.exe"
        5⤵
        
        PID:20720
  - - C:\Windows\Temp\RageCore_2d8d8ca6\win_guard_3.exe
      "C:\Windows\Temp\RageCore_2d8d8ca6\win_guard_3.exe"
      4⤵
      PID:12452
  - - C:\ProgramData\RageCore_018d473c\win_guard_4.exe
      "C:\ProgramData\RageCore_018d473c\win_guard_4.exe"
      4⤵
      PID:17484
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_f1ae9864\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:24916
- - C:\Windows\Temp\RageCore_5df49c62\win_guard_3.exe
    "C:\Windows\Temp\RageCore_5df49c62\win_guard_3.exe"
    3⤵
    PID:5644
  - - C:\Windows\Temp\RageCore_85a91f6f\win_guard_0.exe
      "C:\Windows\Temp\RageCore_85a91f6f\win_guard_0.exe"
      4⤵
      PID:7964
    - - C:\Windows\Temp\RageCore_8703549c\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_8703549c\win_guard_0.exe"
        5⤵
        
        PID:18500
    - - C:\Windows\Temp\RageCore_aa962d32\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_aa962d32\win_guard_1.exe"
        5⤵
        
        PID:25012
  - - C:\Users\Public\RageCore_d443e810\win_guard_1.exe
      "C:\Users\Public\RageCore_d443e810\win_guard_1.exe"
      4⤵
      PID:8352
    - - C:\Users\Public\RageCore_ce10ffb2\win_guard_0.exe
        
        "C:\Users\Public\RageCore_ce10ffb2\win_guard_0.exe"
        5⤵
        
        PID:20556
    - - C:\Windows\Temp\RageCore_54636400\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_54636400\win_guard_1.exe"
        5⤵
        
        PID:28524
  - - C:\ProgramData\RageCore_12b411bf\win_guard_2.exe
      "C:\ProgramData\RageCore_12b411bf\win_guard_2.exe"
      4⤵
      PID:12540
    - - C:\Users\Public\RageCore_29a062f8\win_guard_0.exe
        
        "C:\Users\Public\RageCore_29a062f8\win_guard_0.exe"
        5⤵
        
        PID:26956
  - - C:\Users\Public\RageCore_5a8630b7\win_guard_3.exe
      "C:\Users\Public\RageCore_5a8630b7\win_guard_3.exe"
      4⤵
      PID:17560
  - - C:\ProgramData\RageCore_bf17b9dd\win_guard_4.exe
      "C:\ProgramData\RageCore_bf17b9dd\win_guard_4.exe"
      4⤵
      PID:24156
- - C:\ProgramData\RageCore_2219f0ae\win_guard_4.exe
    "C:\ProgramData\RageCore_2219f0ae\win_guard_4.exe"
    3⤵
    PID:6340
  - - C:\Windows\Temp\RageCore_aa5806b0\win_guard_0.exe
      "C:\Windows\Temp\RageCore_aa5806b0\win_guard_0.exe"
      4⤵
      PID:12428
    - - C:\Windows\Temp\RageCore_652f8d6b\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_652f8d6b\win_guard_0.exe"
        5⤵
        
        PID:2264
  - - C:\ProgramData\RageCore_d5c49d9b\win_guard_1.exe
      "C:\ProgramData\RageCore_d5c49d9b\win_guard_1.exe"
      4⤵
      PID:16612
  - - C:\Users\Public\RageCore_7ac925be\win_guard_2.exe
      "C:\Users\Public\RageCore_7ac925be\win_guard_2.exe"
      4⤵
      PID:23176
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Users\Public\RageCore_1434a831\win_guard_0.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:7692
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\Users\Public\RageCore_1434a831\win_guard_0.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11992
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\System32\takeown.exe" /f "C:\Windows\system32\cmd.exe" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:22896
- C:\Windows\Temp\RageCore_a716cd18\win_guard_2.exe
  "C:\Windows\Temp\RageCore_a716cd18\win_guard_2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3300
- - C:\Windows\Temp\RageCore_2ce8af19\win_guard_0.exe
    "C:\Windows\Temp\RageCore_2ce8af19\win_guard_0.exe"
    3⤵
    PID:4320
  - - C:\ProgramData\RageCore_1d457197\win_guard_0.exe
      "C:\ProgramData\RageCore_1d457197\win_guard_0.exe"
      4⤵
      PID:1268
    - - C:\ProgramData\RageCore_ccde22c9\win_guard_0.exe
        
        "C:\ProgramData\RageCore_ccde22c9\win_guard_0.exe"
        5⤵
        
        PID:7836
      - C:\Windows\Temp\RageCore_e144b56c\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_e144b56c\win_guard_0.exe"
        6⤵
        
        PID:17552
      - C:\ProgramData\RageCore_1de7ef03\win_guard_1.exe
        
        "C:\ProgramData\RageCore_1de7ef03\win_guard_1.exe"
        6⤵
        
        PID:24160
    - - C:\Windows\Temp\RageCore_4289f137\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_4289f137\win_guard_1.exe"
        5⤵
        
        PID:9620
      - C:\Windows\Temp\RageCore_db0d4a92\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_db0d4a92\win_guard_0.exe"
        6⤵
        
        PID:19064
      - C:\Users\Public\RageCore_e568f03e\win_guard_1.exe
        
        "C:\Users\Public\RageCore_e568f03e\win_guard_1.exe"
        6⤵
        
        PID:10096
    - - C:\Users\Public\RageCore_5c6118e3\win_guard_2.exe
        
        "C:\Users\Public\RageCore_5c6118e3\win_guard_2.exe"
        5⤵
        
        PID:12300
      - C:\Users\Public\RageCore_60530a2d\win_guard_0.exe
        
        "C:\Users\Public\RageCore_60530a2d\win_guard_0.exe"
        6⤵
        
        PID:27720
    - - C:\ProgramData\RageCore_6f4b9c06\win_guard_3.exe
        
        "C:\ProgramData\RageCore_6f4b9c06\win_guard_3.exe"
        5⤵
        
        PID:17460
    - - C:\Windows\Temp\RageCore_1bd8dbfd\win_guard_4.exe
        
        "C:\Windows\Temp\RageCore_1bd8dbfd\win_guard_4.exe"
        5⤵
        
        PID:23968
  - - C:\ProgramData\RageCore_da1441c6\win_guard_1.exe
      "C:\ProgramData\RageCore_da1441c6\win_guard_1.exe"
      4⤵
      PID:4876
    - - C:\Windows\Temp\RageCore_81a8e6ab\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_81a8e6ab\win_guard_0.exe"
        5⤵
        
        PID:8440
      - C:\ProgramData\RageCore_370b691a\win_guard_0.exe
        
        "C:\ProgramData\RageCore_370b691a\win_guard_0.exe"
        6⤵
        
        PID:20044
      - C:\Windows\Temp\RageCore_f2dbad07\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_f2dbad07\win_guard_1.exe"
        6⤵
        
        PID:27064
    - - C:\Users\Public\RageCore_613caac1\win_guard_1.exe
        
        "C:\Users\Public\RageCore_613caac1\win_guard_1.exe"
        5⤵
        
        PID:10468
      - C:\ProgramData\RageCore_4f4d9b72\win_guard_0.exe
        
        "C:\ProgramData\RageCore_4f4d9b72\win_guard_0.exe"
        6⤵
        
        PID:22752
    - - C:\Windows\Temp\RageCore_8a225e5c\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_8a225e5c\win_guard_2.exe"
        5⤵
        
        PID:13492
    - - C:\Users\Public\RageCore_08031c35\win_guard_3.exe
        
        "C:\Users\Public\RageCore_08031c35\win_guard_3.exe"
        5⤵
        
        PID:19232
    - - C:\ProgramData\RageCore_8530b999\win_guard_4.exe
        
        "C:\ProgramData\RageCore_8530b999\win_guard_4.exe"
        5⤵
        
        PID:25728
  - - C:\ProgramData\RageCore_eb84c60e\win_guard_2.exe
      "C:\ProgramData\RageCore_eb84c60e\win_guard_2.exe"
      4⤵
      PID:6240
    - - C:\Windows\Temp\RageCore_bfb95879\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_bfb95879\win_guard_0.exe"
        5⤵
        
        PID:12548
      - C:\Users\Public\RageCore_88e7fd79\win_guard_0.exe
        
        "C:\Users\Public\RageCore_88e7fd79\win_guard_0.exe"
        6⤵
        
        PID:28072
    - - C:\Windows\Temp\RageCore_0007e9a3\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_0007e9a3\win_guard_1.exe"
        5⤵
        
        PID:18108
    - - C:\ProgramData\RageCore_89545dd5\win_guard_2.exe
        
        "C:\ProgramData\RageCore_89545dd5\win_guard_2.exe"
        5⤵
        
        PID:23368
  - - C:\Windows\Temp\RageCore_e65639b2\win_guard_3.exe
      "C:\Windows\Temp\RageCore_e65639b2\win_guard_3.exe"
      4⤵
      PID:7552
    - - C:\ProgramData\RageCore_483455dd\win_guard_0.exe
        
        "C:\ProgramData\RageCore_483455dd\win_guard_0.exe"
        5⤵
        
        PID:16500
    - - C:\ProgramData\RageCore_8c984be8\win_guard_1.exe
        
        "C:\ProgramData\RageCore_8c984be8\win_guard_1.exe"
        5⤵
        
        PID:23100
  - - C:\Windows\Temp\RageCore_bd01e4fb\win_guard_4.exe
      "C:\Windows\Temp\RageCore_bd01e4fb\win_guard_4.exe"
      4⤵
      PID:9372
    - - C:\ProgramData\RageCore_c9e3d849\win_guard_0.exe
        
        "C:\ProgramData\RageCore_c9e3d849\win_guard_0.exe"
        5⤵
        
        PID:20820
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_1d457197\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:18848
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\ProgramData\RageCore_1d457197\win_guard_0.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:25308
- - C:\Users\Public\RageCore_c086ae97\win_guard_1.exe
    "C:\Users\Public\RageCore_c086ae97\win_guard_1.exe"
    3⤵
    PID:4044
  - - C:\ProgramData\RageCore_d0515307\win_guard_0.exe
      "C:\ProgramData\RageCore_d0515307\win_guard_0.exe"
      4⤵
      PID:6176
    - - C:\Users\Public\RageCore_a202f4fb\win_guard_0.exe
        
        "C:\Users\Public\RageCore_a202f4fb\win_guard_0.exe"
        5⤵
        
        PID:11752
      - C:\Users\Public\RageCore_b1884938\win_guard_0.exe
        
        "C:\Users\Public\RageCore_b1884938\win_guard_0.exe"
        6⤵
        
        PID:26768
    - - C:\Users\Public\RageCore_5ff80c79\win_guard_1.exe
        
        "C:\Users\Public\RageCore_5ff80c79\win_guard_1.exe"
        5⤵
        
        PID:16328
    - - C:\Users\Public\RageCore_0b8bd80a\win_guard_2.exe
        
        "C:\Users\Public\RageCore_0b8bd80a\win_guard_2.exe"
        5⤵
        
        PID:21576
  - - C:\ProgramData\RageCore_adab986e\win_guard_1.exe
      "C:\ProgramData\RageCore_adab986e\win_guard_1.exe"
      4⤵
      PID:7408
    - - C:\Windows\Temp\RageCore_5784f61b\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_5784f61b\win_guard_0.exe"
        5⤵
        
        PID:16264
    - - C:\Windows\Temp\RageCore_bec23128\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_bec23128\win_guard_1.exe"
        5⤵
        
        PID:22140
  - - C:\ProgramData\RageCore_88b81fba\win_guard_2.exe
      "C:\ProgramData\RageCore_88b81fba\win_guard_2.exe"
      4⤵
      PID:9628
    - - C:\ProgramData\RageCore_03904200\win_guard_0.exe
        
        "C:\ProgramData\RageCore_03904200\win_guard_0.exe"
        5⤵
        
        PID:19700
    - - C:\Users\Public\RageCore_0b1ad3b9\win_guard_1.exe
        
        "C:\Users\Public\RageCore_0b1ad3b9\win_guard_1.exe"
        5⤵
        
        PID:26340
  - - C:\Windows\Temp\RageCore_9ce8d47b\win_guard_3.exe
      "C:\Windows\Temp\RageCore_9ce8d47b\win_guard_3.exe"
      4⤵
      PID:11848
    - - C:\Windows\Temp\RageCore_76b622ff\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_76b622ff\win_guard_0.exe"
        5⤵
        
        PID:27196
  - - C:\ProgramData\RageCore_1401823c\win_guard_4.exe
      "C:\ProgramData\RageCore_1401823c\win_guard_4.exe"
      4⤵
      PID:15596
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_d0515307\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:22904
- - C:\ProgramData\RageCore_f17fb3da\win_guard_2.exe
    "C:\ProgramData\RageCore_f17fb3da\win_guard_2.exe"
    3⤵
    PID:5696
  - - C:\Users\Public\RageCore_dc0f7537\win_guard_0.exe
      "C:\Users\Public\RageCore_dc0f7537\win_guard_0.exe"
      4⤵
      PID:6248
    - - C:\ProgramData\RageCore_5d4ba2f3\win_guard_0.exe
        
        "C:\ProgramData\RageCore_5d4ba2f3\win_guard_0.exe"
        5⤵
        
        PID:12412
      - C:\Users\Public\RageCore_f73ad054\win_guard_0.exe
        
        "C:\Users\Public\RageCore_f73ad054\win_guard_0.exe"
        6⤵
        
        PID:27016
    - - C:\Windows\Temp\RageCore_b9871652\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_b9871652\win_guard_1.exe"
        5⤵
        
        PID:16912
    - - C:\Users\Public\RageCore_1154b39d\win_guard_2.exe
        
        "C:\Users\Public\RageCore_1154b39d\win_guard_2.exe"
        5⤵
        
        PID:23324
  - - C:\Windows\Temp\RageCore_e783200e\win_guard_1.exe
      "C:\Windows\Temp\RageCore_e783200e\win_guard_1.exe"
      4⤵
      PID:7628
    - - C:\Users\Public\RageCore_b1c8b6a3\win_guard_0.exe
        
        "C:\Users\Public\RageCore_b1c8b6a3\win_guard_0.exe"
        5⤵
        
        PID:15564
    - - C:\Users\Public\RageCore_982990bd\win_guard_1.exe
        
        "C:\Users\Public\RageCore_982990bd\win_guard_1.exe"
        5⤵
        
        PID:21548
  - - C:\ProgramData\RageCore_b8293bfd\win_guard_2.exe
      "C:\ProgramData\RageCore_b8293bfd\win_guard_2.exe"
      4⤵
      PID:9860
    - - C:\ProgramData\RageCore_2dcca801\win_guard_0.exe
        
        "C:\ProgramData\RageCore_2dcca801\win_guard_0.exe"
        5⤵
        
        PID:19792
    - - C:\Users\Public\RageCore_ffc0da82\win_guard_1.exe
        
        "C:\Users\Public\RageCore_ffc0da82\win_guard_1.exe"
        5⤵
        
        PID:27740
  - - C:\Windows\Temp\RageCore_a99cb72c\win_guard_3.exe
      "C:\Windows\Temp\RageCore_a99cb72c\win_guard_3.exe"
      4⤵
      PID:12292
  - - C:\ProgramData\RageCore_d0e7e66a\win_guard_4.exe
      "C:\ProgramData\RageCore_d0e7e66a\win_guard_4.exe"
      4⤵
      PID:18068
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Users\Public\RageCore_dc0f7537\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:26560
- - C:\Windows\Temp\RageCore_8f13c82b\win_guard_3.exe
    "C:\Windows\Temp\RageCore_8f13c82b\win_guard_3.exe"
    3⤵
    PID:1100
  - - C:\ProgramData\RageCore_6ca62a0c\win_guard_0.exe
      "C:\ProgramData\RageCore_6ca62a0c\win_guard_0.exe"
      4⤵
      PID:7332
    - - C:\Users\Public\RageCore_64cfb751\win_guard_0.exe
        
        "C:\Users\Public\RageCore_64cfb751\win_guard_0.exe"
        5⤵
        
        PID:10524
    - - C:\Windows\Temp\RageCore_81d1947f\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_81d1947f\win_guard_1.exe"
        5⤵
        
        PID:16856
    - - C:\ProgramData\RageCore_93f370c2\win_guard_2.exe
        
        "C:\ProgramData\RageCore_93f370c2\win_guard_2.exe"
        5⤵
        
        PID:24988
  - - C:\ProgramData\RageCore_0be06fb2\win_guard_1.exe
      "C:\ProgramData\RageCore_0be06fb2\win_guard_1.exe"
      4⤵
      PID:8460
    - - C:\Users\Public\RageCore_ef5a0176\win_guard_0.exe
        
        "C:\Users\Public\RageCore_ef5a0176\win_guard_0.exe"
        5⤵
        
        PID:19728
    - - C:\Users\Public\RageCore_62c67012\win_guard_1.exe
        
        "C:\Users\Public\RageCore_62c67012\win_guard_1.exe"
        5⤵
        
        PID:26500
  - - C:\Users\Public\RageCore_1ac2087c\win_guard_2.exe
      "C:\Users\Public\RageCore_1ac2087c\win_guard_2.exe"
      4⤵
      PID:10368
    - - C:\Windows\Temp\RageCore_a52d92fd\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_a52d92fd\win_guard_0.exe"
        5⤵
        
        PID:22004
  - - C:\ProgramData\RageCore_01bd2cea\win_guard_3.exe
      "C:\ProgramData\RageCore_01bd2cea\win_guard_3.exe"
      4⤵
      PID:12520
    - - C:\Users\Public\RageCore_123e3717\win_guard_0.exe
        
        "C:\Users\Public\RageCore_123e3717\win_guard_0.exe"
        5⤵
        
        PID:5712
  - - C:\Windows\Temp\RageCore_708e80e5\win_guard_4.exe
      "C:\Windows\Temp\RageCore_708e80e5\win_guard_4.exe"
      4⤵
      PID:17568
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_6ca62a0c\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:25216
- - C:\Users\Public\RageCore_ae9a3bfc\win_guard_4.exe
    "C:\Users\Public\RageCore_ae9a3bfc\win_guard_4.exe"
    3⤵
    PID:2024
  - - C:\ProgramData\RageCore_cf1a9043\win_guard_0.exe
      "C:\ProgramData\RageCore_cf1a9043\win_guard_0.exe"
      4⤵
      PID:8932
    - - C:\Windows\Temp\RageCore_e2de05a6\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_e2de05a6\win_guard_0.exe"
        5⤵
        
        PID:20268
    - - C:\Windows\Temp\RageCore_6079165f\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_6079165f\win_guard_1.exe"
        5⤵
        
        PID:27160
  - - C:\Windows\Temp\RageCore_ea07e6cd\win_guard_1.exe
      "C:\Windows\Temp\RageCore_ea07e6cd\win_guard_1.exe"
      4⤵
      PID:11004
    - - C:\ProgramData\RageCore_52e228f8\win_guard_0.exe
        
        "C:\ProgramData\RageCore_52e228f8\win_guard_0.exe"
        5⤵
        
        PID:24484
  - - C:\Windows\Temp\RageCore_f54651ff\win_guard_2.exe
      "C:\Windows\Temp\RageCore_f54651ff\win_guard_2.exe"
      4⤵
      PID:13880
  - - C:\Windows\Temp\RageCore_073f08ff\win_guard_3.exe
      "C:\Windows\Temp\RageCore_073f08ff\win_guard_3.exe"
      4⤵
      PID:18672
  - - C:\Users\Public\RageCore_2e709334\win_guard_4.exe
      "C:\Users\Public\RageCore_2e709334\win_guard_4.exe"
      4⤵
      PID:25580
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Windows\Temp\RageCore_2ce8af19\win_guard_0.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:10336
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\Windows\Temp\RageCore_2ce8af19\win_guard_0.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:16968
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\System32\takeown.exe" /f "C:\Windows\system32\cmd.exe" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:25444
- C:\Users\Public\RageCore_f1c253d3\win_guard_3.exe
  "C:\Users\Public\RageCore_f1c253d3\win_guard_3.exe"
  2⤵
  PID:5236
- - C:\ProgramData\RageCore_3c2ece6e\win_guard_0.exe
    "C:\ProgramData\RageCore_3c2ece6e\win_guard_0.exe"
    3⤵
    PID:3116
  - - C:\ProgramData\RageCore_6cc4a3dd\win_guard_0.exe
      "C:\ProgramData\RageCore_6cc4a3dd\win_guard_0.exe"
      4⤵
      PID:5324
    - - C:\Users\Public\RageCore_a6ae04ce\win_guard_0.exe
        
        "C:\Users\Public\RageCore_a6ae04ce\win_guard_0.exe"
        5⤵
        
        PID:7016
      - C:\ProgramData\RageCore_6b39333d\win_guard_0.exe
        
        "C:\ProgramData\RageCore_6b39333d\win_guard_0.exe"
        6⤵
        
        PID:15164
      - C:\ProgramData\RageCore_bf38c927\win_guard_1.exe
        
        "C:\ProgramData\RageCore_bf38c927\win_guard_1.exe"
        6⤵
        
        PID:20892
      - C:\ProgramData\RageCore_8ab097ed\win_guard_2.exe
        
        "C:\ProgramData\RageCore_8ab097ed\win_guard_2.exe"
        6⤵
        
        PID:28612
    - - C:\ProgramData\RageCore_429dd555\win_guard_1.exe
        
        "C:\ProgramData\RageCore_429dd555\win_guard_1.exe"
        5⤵
        
        PID:8112
      - C:\ProgramData\RageCore_f2962d5a\win_guard_0.exe
        
        "C:\ProgramData\RageCore_f2962d5a\win_guard_0.exe"
        6⤵
        
        PID:18444
      - C:\ProgramData\RageCore_400482e9\win_guard_1.exe
        
        "C:\ProgramData\RageCore_400482e9\win_guard_1.exe"
        6⤵
        
        PID:25064
    - - C:\Users\Public\RageCore_1aed42bf\win_guard_2.exe
        
        "C:\Users\Public\RageCore_1aed42bf\win_guard_2.exe"
        5⤵
        
        PID:10452
      - C:\Users\Public\RageCore_d10d21b7\win_guard_0.exe
        
        "C:\Users\Public\RageCore_d10d21b7\win_guard_0.exe"
        6⤵
        
        PID:22532
    - - C:\Users\Public\RageCore_d7437041\win_guard_3.exe
        
        "C:\Users\Public\RageCore_d7437041\win_guard_3.exe"
        5⤵
        
        PID:13412
      - C:\Users\Public\RageCore_55bd2b99\win_guard_0.exe
        
        "C:\Users\Public\RageCore_55bd2b99\win_guard_0.exe"
        6⤵
        
        PID:28236
    - - C:\Windows\Temp\RageCore_6733b246\win_guard_4.exe
        
        "C:\Windows\Temp\RageCore_6733b246\win_guard_4.exe"
        5⤵
        
        PID:18864
    - - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Users\Public\RageCore_a6ae04ce\win_guard_0.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:26604
  - - C:\Users\Public\RageCore_b057debc\win_guard_1.exe
      "C:\Users\Public\RageCore_b057debc\win_guard_1.exe"
      4⤵
      PID:4432
    - - C:\Windows\Temp\RageCore_c5e6c0c2\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_c5e6c0c2\win_guard_0.exe"
        5⤵
        
        PID:9064
      - C:\ProgramData\RageCore_f2cbb872\win_guard_0.exe
        
        "C:\ProgramData\RageCore_f2cbb872\win_guard_0.exe"
        6⤵
        
        PID:18344
      - C:\Users\Public\RageCore_5c37da36\win_guard_1.exe
        
        "C:\Users\Public\RageCore_5c37da36\win_guard_1.exe"
        6⤵
        
        PID:24016
    - - C:\Windows\Temp\RageCore_59538b09\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_59538b09\win_guard_1.exe"
        5⤵
        
        PID:11476
      - C:\Windows\Temp\RageCore_03b746aa\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_03b746aa\win_guard_0.exe"
        6⤵
        
        PID:25120
    - - C:\ProgramData\RageCore_2e263cc3\win_guard_2.exe
        
        "C:\ProgramData\RageCore_2e263cc3\win_guard_2.exe"
        5⤵
        
        PID:14764
    - - C:\ProgramData\RageCore_b610bfa7\win_guard_3.exe
        
        "C:\ProgramData\RageCore_b610bfa7\win_guard_3.exe"
        5⤵
        
        PID:20780
    - - C:\Windows\Temp\RageCore_f9cf24fa\win_guard_4.exe
        
        "C:\Windows\Temp\RageCore_f9cf24fa\win_guard_4.exe"
        5⤵
        
        PID:28508
  - - C:\ProgramData\RageCore_57eceede\win_guard_2.exe
      "C:\ProgramData\RageCore_57eceede\win_guard_2.exe"
      4⤵
      PID:6264
    - - C:\ProgramData\RageCore_5ecda260\win_guard_0.exe
        
        "C:\ProgramData\RageCore_5ecda260\win_guard_0.exe"
        5⤵
        
        PID:10532
      - C:\ProgramData\RageCore_0aec0f3d\win_guard_0.exe
        
        "C:\ProgramData\RageCore_0aec0f3d\win_guard_0.exe"
        6⤵
        
        PID:5076
    - - C:\Windows\Temp\RageCore_01bdf14f\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_01bdf14f\win_guard_1.exe"
        5⤵
        
        PID:13316
    - - C:\ProgramData\RageCore_8957be9c\win_guard_2.exe
        
        "C:\ProgramData\RageCore_8957be9c\win_guard_2.exe"
        5⤵
        
        PID:18904
    - - C:\Users\Public\RageCore_73c3ebdd\win_guard_3.exe
        
        "C:\Users\Public\RageCore_73c3ebdd\win_guard_3.exe"
        5⤵
        
        PID:24776
  - - C:\Users\Public\RageCore_b4f952b9\win_guard_3.exe
      "C:\Users\Public\RageCore_b4f952b9\win_guard_3.exe"
      4⤵
      PID:7636
    - - C:\Users\Public\RageCore_c50bcca4\win_guard_0.exe
        
        "C:\Users\Public\RageCore_c50bcca4\win_guard_0.exe"
        5⤵
        
        PID:14976
    - - C:\Users\Public\RageCore_614ecf7a\win_guard_1.exe
        
        "C:\Users\Public\RageCore_614ecf7a\win_guard_1.exe"
        5⤵
        
        PID:20796
    - - C:\Windows\Temp\RageCore_bc6f14c2\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_bc6f14c2\win_guard_2.exe"
        5⤵
        
        PID:28492
  - - C:\ProgramData\RageCore_feb13a6f\win_guard_4.exe
      "C:\ProgramData\RageCore_feb13a6f\win_guard_4.exe"
      4⤵
      PID:9816
    - - C:\ProgramData\RageCore_d9e716e2\win_guard_0.exe
        
        "C:\ProgramData\RageCore_d9e716e2\win_guard_0.exe"
        5⤵
        
        PID:19260
    - - C:\Windows\Temp\RageCore_d78f8e41\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_d78f8e41\win_guard_1.exe"
        5⤵
        
        PID:27876
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_6cc4a3dd\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:13768
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\ProgramData\RageCore_6cc4a3dd\win_guard_0.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:21840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 2780
      4⤵
      Program crash
      PID:26916
- - C:\Users\Public\RageCore_86539285\win_guard_1.exe
    "C:\Users\Public\RageCore_86539285\win_guard_1.exe"
    3⤵
    PID:1704
  - - C:\ProgramData\RageCore_5e425f52\win_guard_0.exe
      "C:\ProgramData\RageCore_5e425f52\win_guard_0.exe"
      4⤵
      PID:2912
    - - C:\Windows\Temp\RageCore_d116ce42\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_d116ce42\win_guard_0.exe"
        5⤵
        
        PID:10020
      - C:\Users\Public\RageCore_2f7be831\win_guard_0.exe
        
        "C:\Users\Public\RageCore_2f7be831\win_guard_0.exe"
        6⤵
        
        PID:24500
    - - C:\Windows\Temp\RageCore_fb2fca91\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_fb2fca91\win_guard_1.exe"
        5⤵
        
        PID:13332
      - C:\Windows\Temp\RageCore_2a4be6f2\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_2a4be6f2\win_guard_0.exe"
        6⤵
        
        PID:28360
    - - C:\ProgramData\RageCore_1c5553a2\win_guard_2.exe
        
        "C:\ProgramData\RageCore_1c5553a2\win_guard_2.exe"
        5⤵
        
        PID:19272
    - - C:\ProgramData\RageCore_c7e32d83\win_guard_3.exe
        
        "C:\ProgramData\RageCore_c7e32d83\win_guard_3.exe"
        5⤵
        
        PID:25896
  - - C:\Users\Public\RageCore_7ed8383e\win_guard_1.exe
      "C:\Users\Public\RageCore_7ed8383e\win_guard_1.exe"
      4⤵
      PID:6880
    - - C:\Users\Public\RageCore_e44511c9\win_guard_0.exe
        
        "C:\Users\Public\RageCore_e44511c9\win_guard_0.exe"
        5⤵
        
        PID:12820
      - C:\Users\Public\RageCore_42e0110f\win_guard_0.exe
        
        "C:\Users\Public\RageCore_42e0110f\win_guard_0.exe"
        6⤵
        
        PID:27928
    - - C:\Users\Public\RageCore_f648f35f\win_guard_1.exe
        
        "C:\Users\Public\RageCore_f648f35f\win_guard_1.exe"
        5⤵
        
        PID:17532
    - - C:\Windows\Temp\RageCore_7d8d9c13\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_7d8d9c13\win_guard_2.exe"
        5⤵
        
        PID:23736
  - - C:\Users\Public\RageCore_cff99706\win_guard_2.exe
      "C:\Users\Public\RageCore_cff99706\win_guard_2.exe"
      4⤵
      PID:7980
    - - C:\Users\Public\RageCore_30167b3a\win_guard_0.exe
        
        "C:\Users\Public\RageCore_30167b3a\win_guard_0.exe"
        5⤵
        
        PID:19996
    - - C:\ProgramData\RageCore_f9c9c384\win_guard_1.exe
        
        "C:\ProgramData\RageCore_f9c9c384\win_guard_1.exe"
        5⤵
        
        PID:26792
  - - C:\Users\Public\RageCore_851ac8b9\win_guard_3.exe
      "C:\Users\Public\RageCore_851ac8b9\win_guard_3.exe"
      4⤵
      PID:10436
    - - C:\Windows\Temp\RageCore_508ebfc3\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_508ebfc3\win_guard_0.exe"
        5⤵
        
        PID:20860
  - - C:\ProgramData\RageCore_73b9c900\win_guard_4.exe
      "C:\ProgramData\RageCore_73b9c900\win_guard_4.exe"
      4⤵
      PID:13944
    - - C:\ProgramData\RageCore_237969c4\win_guard_0.exe
        
        "C:\ProgramData\RageCore_237969c4\win_guard_0.exe"
        5⤵
        
        PID:28368
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_5e425f52\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:21828
- - C:\Windows\Temp\RageCore_69bc24b2\win_guard_2.exe
    "C:\Windows\Temp\RageCore_69bc24b2\win_guard_2.exe"
    3⤵
    PID:996
  - - C:\Users\Public\RageCore_512c408a\win_guard_0.exe
      "C:\Users\Public\RageCore_512c408a\win_guard_0.exe"
      4⤵
      PID:7284
    - - C:\Windows\Temp\RageCore_26e04ed4\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_26e04ed4\win_guard_0.exe"
        5⤵
        
        PID:15676
    - - C:\Users\Public\RageCore_8a8da3a9\win_guard_1.exe
        
        "C:\Users\Public\RageCore_8a8da3a9\win_guard_1.exe"
        5⤵
        
        PID:22192
  - - C:\Windows\Temp\RageCore_617cdd62\win_guard_1.exe
      "C:\Windows\Temp\RageCore_617cdd62\win_guard_1.exe"
      4⤵
      PID:8564
    - - C:\Windows\Temp\RageCore_59b0f0a2\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_59b0f0a2\win_guard_0.exe"
        5⤵
        
        PID:19988
    - - C:\Users\Public\RageCore_38f53f80\win_guard_1.exe
        
        "C:\Users\Public\RageCore_38f53f80\win_guard_1.exe"
        5⤵
        
        PID:26380
  - - C:\ProgramData\RageCore_94f18ec4\win_guard_2.exe
      "C:\ProgramData\RageCore_94f18ec4\win_guard_2.exe"
      4⤵
      PID:10848
    - - C:\Users\Public\RageCore_1eb5726f\win_guard_0.exe
        
        "C:\Users\Public\RageCore_1eb5726f\win_guard_0.exe"
        5⤵
        
        PID:27568
  - - C:\Users\Public\RageCore_441774d2\win_guard_3.exe
      "C:\Users\Public\RageCore_441774d2\win_guard_3.exe"
      4⤵
      PID:15708
  - - C:\Users\Public\RageCore_174d4c90\win_guard_4.exe
      "C:\Users\Public\RageCore_174d4c90\win_guard_4.exe"
      4⤵
      PID:21772
- - C:\Windows\Temp\RageCore_41cdfded\win_guard_3.exe
    "C:\Windows\Temp\RageCore_41cdfded\win_guard_3.exe"
    3⤵
    PID:4756
  - - C:\Windows\Temp\RageCore_1114d7f8\win_guard_0.exe
      "C:\Windows\Temp\RageCore_1114d7f8\win_guard_0.exe"
      4⤵
      PID:11824
    - - C:\Windows\Temp\RageCore_769cc335\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_769cc335\win_guard_0.exe"
        5⤵
        
        PID:26164
  - - C:\Users\Public\RageCore_930f1309\win_guard_1.exe
      "C:\Users\Public\RageCore_930f1309\win_guard_1.exe"
      4⤵
      PID:14968
  - - C:\Users\Public\RageCore_9cb520dc\win_guard_2.exe
      "C:\Users\Public\RageCore_9cb520dc\win_guard_2.exe"
      4⤵
      PID:20764
  - - C:\Windows\Temp\RageCore_d4a0156a\win_guard_3.exe
      "C:\Windows\Temp\RageCore_d4a0156a\win_guard_3.exe"
      4⤵
      PID:28620
- - C:\ProgramData\RageCore_81f1b586\win_guard_4.exe
    "C:\ProgramData\RageCore_81f1b586\win_guard_4.exe"
    3⤵
    PID:6760
  - - C:\Windows\Temp\RageCore_fac72eaa\win_guard_0.exe
      "C:\Windows\Temp\RageCore_fac72eaa\win_guard_0.exe"
      4⤵
      PID:12140
  - - C:\Users\Public\RageCore_bb50363b\win_guard_1.exe
      "C:\Users\Public\RageCore_bb50363b\win_guard_1.exe"
      4⤵
      PID:16184
  - - C:\Windows\Temp\RageCore_b34b6315\win_guard_2.exe
      "C:\Windows\Temp\RageCore_b34b6315\win_guard_2.exe"
      4⤵
      PID:22416
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_3c2ece6e\win_guard_0.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:9996
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\ProgramData\RageCore_3c2ece6e\win_guard_0.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7692
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\System32\takeown.exe" /f "C:\Windows\system32\cmd.exe" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:24388
- C:\Windows\Temp\RageCore_e7adeebe\win_guard_4.exe
  "C:\Windows\Temp\RageCore_e7adeebe\win_guard_4.exe"
  2⤵
  PID:400
- - C:\ProgramData\RageCore_bdef5603\win_guard_0.exe
    "C:\ProgramData\RageCore_bdef5603\win_guard_0.exe"
    3⤵
    PID:1996
  - - C:\ProgramData\RageCore_094e1529\win_guard_0.exe
      "C:\ProgramData\RageCore_094e1529\win_guard_0.exe"
      4⤵
      PID:1052
    - - C:\Users\Public\RageCore_b89350ec\win_guard_0.exe
        
        "C:\Users\Public\RageCore_b89350ec\win_guard_0.exe"
        5⤵
        
        PID:11112
      - C:\Windows\Temp\RageCore_3727e3f9\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_3727e3f9\win_guard_0.exe"
        6⤵
        
        PID:22424
    - - C:\Users\Public\RageCore_3f951d79\win_guard_1.exe
        
        "C:\Users\Public\RageCore_3f951d79\win_guard_1.exe"
        5⤵
        
        PID:13996
    - - C:\Windows\Temp\RageCore_b91c852b\win_guard_2.exe
        
        "C:\Windows\Temp\RageCore_b91c852b\win_guard_2.exe"
        5⤵
        
        PID:19668
    - - C:\Windows\Temp\RageCore_4c8d925c\win_guard_3.exe
        
        "C:\Windows\Temp\RageCore_4c8d925c\win_guard_3.exe"
        5⤵
        
        PID:26348
  - - C:\Windows\Temp\RageCore_a00a37d1\win_guard_1.exe
      "C:\Windows\Temp\RageCore_a00a37d1\win_guard_1.exe"
      4⤵
      PID:7048
    - - C:\Users\Public\RageCore_5ed36ee8\win_guard_0.exe
        
        "C:\Users\Public\RageCore_5ed36ee8\win_guard_0.exe"
        5⤵
        
        PID:12420
      - C:\ProgramData\RageCore_2bf57723\win_guard_0.exe
        
        "C:\ProgramData\RageCore_2bf57723\win_guard_0.exe"
        6⤵
        
        PID:27224
    - - C:\ProgramData\RageCore_d44a9845\win_guard_1.exe
        
        "C:\ProgramData\RageCore_d44a9845\win_guard_1.exe"
        5⤵
        
        PID:16620
    - - C:\ProgramData\RageCore_bee985df\win_guard_2.exe
        
        "C:\ProgramData\RageCore_bee985df\win_guard_2.exe"
        5⤵
        
        PID:22820
  - - C:\ProgramData\RageCore_db695a9b\win_guard_2.exe
      "C:\ProgramData\RageCore_db695a9b\win_guard_2.exe"
      4⤵
      PID:8128
    - - C:\Windows\Temp\RageCore_522dea85\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_522dea85\win_guard_0.exe"
        5⤵
        
        PID:18560
    - - C:\ProgramData\RageCore_96dadac6\win_guard_1.exe
        
        "C:\ProgramData\RageCore_96dadac6\win_guard_1.exe"
        5⤵
        
        PID:25436
  - - C:\Windows\Temp\RageCore_7a30ae58\win_guard_3.exe
      "C:\Windows\Temp\RageCore_7a30ae58\win_guard_3.exe"
      4⤵
      PID:3692
    - - C:\Windows\Temp\RageCore_99df3935\win_guard_0.exe
        
        "C:\Windows\Temp\RageCore_99df3935\win_guard_0.exe"
        5⤵
        
        PID:22484
  - - C:\Windows\Temp\RageCore_1f117d50\win_guard_4.exe
      "C:\Windows\Temp\RageCore_1f117d50\win_guard_4.exe"
      4⤵
      PID:12112
    - - C:\Users\Public\RageCore_7404efcf\win_guard_0.exe
        
        "C:\Users\Public\RageCore_7404efcf\win_guard_0.exe"
        5⤵
        
        PID:26700
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_094e1529\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:21448
- - C:\Windows\Temp\RageCore_55775927\win_guard_1.exe
    "C:\Windows\Temp\RageCore_55775927\win_guard_1.exe"
    3⤵
    PID:5008
  - - C:\Windows\Temp\RageCore_7651ed9b\win_guard_0.exe
      "C:\Windows\Temp\RageCore_7651ed9b\win_guard_0.exe"
      4⤵
      PID:6964
    - - C:\Users\Public\RageCore_6af2e42e\win_guard_0.exe
        
        "C:\Users\Public\RageCore_6af2e42e\win_guard_0.exe"
        5⤵
        
        PID:13156
    - - C:\Windows\Temp\RageCore_7ad5abb1\win_guard_1.exe
        
        "C:\Windows\Temp\RageCore_7ad5abb1\win_guard_1.exe"
        5⤵
        
        PID:16660
    - - C:\ProgramData\RageCore_597e9628\win_guard_2.exe
        
        "C:\ProgramData\RageCore_597e9628\win_guard_2.exe"
        5⤵
        
        PID:25368
  - - C:\Windows\Temp\RageCore_0e730c2e\win_guard_1.exe
      "C:\Windows\Temp\RageCore_0e730c2e\win_guard_1.exe"
      4⤵
      PID:8104
    - - C:\ProgramData\RageCore_28718283\win_guard_0.exe
        
        "C:\ProgramData\RageCore_28718283\win_guard_0.exe"
        5⤵
        
        PID:18532
    - - C:\ProgramData\RageCore_c217aaf5\win_guard_1.exe
        
        "C:\ProgramData\RageCore_c217aaf5\win_guard_1.exe"
        5⤵
        
        PID:25572
  - - C:\Users\Public\RageCore_0d09a34c\win_guard_2.exe
      "C:\Users\Public\RageCore_0d09a34c\win_guard_2.exe"
      4⤵
      PID:8408
    - - C:\ProgramData\RageCore_99072842\win_guard_0.exe
        
        "C:\ProgramData\RageCore_99072842\win_guard_0.exe"
        5⤵
        
        PID:20992
  - - C:\Users\Public\RageCore_785e0510\win_guard_3.exe
      "C:\Users\Public\RageCore_785e0510\win_guard_3.exe"
      4⤵
      PID:13008
    - - C:\Users\Public\RageCore_145f00ee\win_guard_0.exe
        
        "C:\Users\Public\RageCore_145f00ee\win_guard_0.exe"
        5⤵
        
        PID:10572
  - - C:\ProgramData\RageCore_df52e226\win_guard_4.exe
      "C:\ProgramData\RageCore_df52e226\win_guard_4.exe"
      4⤵
      PID:18980
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Windows\Temp\RageCore_7651ed9b\win_guard_0.exe" start= auto
      4⤵
      Launches sc.exe
      PID:25548
- - C:\ProgramData\RageCore_d5d431ba\win_guard_2.exe
    "C:\ProgramData\RageCore_d5d431ba\win_guard_2.exe"
    3⤵
    PID:3588
  - - C:\Windows\Temp\RageCore_17e5a88d\win_guard_0.exe
      "C:\Windows\Temp\RageCore_17e5a88d\win_guard_0.exe"
      4⤵
      PID:9504
    - - C:\ProgramData\RageCore_efe6f64e\win_guard_0.exe
        
        "C:\ProgramData\RageCore_efe6f64e\win_guard_0.exe"
        5⤵
        
        PID:18632
    - - C:\ProgramData\RageCore_c9e2a482\win_guard_1.exe
        
        "C:\ProgramData\RageCore_c9e2a482\win_guard_1.exe"
        5⤵
        
        PID:27856
  - - C:\Users\Public\RageCore_78ab4368\win_guard_1.exe
      "C:\Users\Public\RageCore_78ab4368\win_guard_1.exe"
      4⤵
      PID:11888
    - - C:\ProgramData\RageCore_55bb5fd0\win_guard_0.exe
        
        "C:\ProgramData\RageCore_55bb5fd0\win_guard_0.exe"
        5⤵
        
        PID:27704
  - - C:\Windows\Temp\RageCore_84b1a898\win_guard_2.exe
      "C:\Windows\Temp\RageCore_84b1a898\win_guard_2.exe"
      4⤵
      PID:17852
  - - C:\ProgramData\RageCore_07518a39\win_guard_3.exe
      "C:\ProgramData\RageCore_07518a39\win_guard_3.exe"
      4⤵
      PID:24060
- - C:\ProgramData\RageCore_02984e6f\win_guard_3.exe
    "C:\ProgramData\RageCore_02984e6f\win_guard_3.exe"
    3⤵
    PID:6256
  - - C:\Windows\Temp\RageCore_6f3d2e83\win_guard_0.exe
      "C:\Windows\Temp\RageCore_6f3d2e83\win_guard_0.exe"
      4⤵
      PID:11968
    - - C:\ProgramData\RageCore_b10b7e3f\win_guard_0.exe
        
        "C:\ProgramData\RageCore_b10b7e3f\win_guard_0.exe"
        5⤵
        
        PID:27384
  - - C:\ProgramData\RageCore_d202e0a6\win_guard_1.exe
      "C:\ProgramData\RageCore_d202e0a6\win_guard_1.exe"
      4⤵
      PID:15484
  - - C:\Windows\Temp\RageCore_dba3059e\win_guard_2.exe
      "C:\Windows\Temp\RageCore_dba3059e\win_guard_2.exe"
      4⤵
      PID:21736
- - C:\Windows\Temp\RageCore_37a3f89f\win_guard_4.exe
    "C:\Windows\Temp\RageCore_37a3f89f\win_guard_4.exe"
    3⤵
    PID:7620
  - - C:\Users\Public\RageCore_644c89a0\win_guard_0.exe
      "C:\Users\Public\RageCore_644c89a0\win_guard_0.exe"
      4⤵
      PID:15612
  - - C:\Users\Public\RageCore_db6952c5\win_guard_1.exe
      "C:\Users\Public\RageCore_db6952c5\win_guard_1.exe"
      4⤵
      PID:22164
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create RageService binPath= "C:\ProgramData\RageCore_bdef5603\win_guard_0.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:11272
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\ProgramData\RageCore_bdef5603\win_guard_0.exe" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:18540
- - C:\Windows\SysWOW64\takeown.exe
    "C:\Windows\System32\takeown.exe" /f "C:\Windows\system32\cmd.exe" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:27072
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create RageService binPath= "C:\Windows\Temp\RageCore_4f642669\win_guard_0.exe" start= auto
  2⤵
  - Launches sc.exe
  PID:4136
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn RageGuard /tr "C:\Windows\Temp\RageCore_4f642669\win_guard_0.exe" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2248
- C:\Windows\SysWOW64\takeown.exe
  "C:\Windows\System32\takeown.exe" /f "C:\Windows\system32\cmd.exe" /a
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:12592
- C:\Windows\SysWOW64\icacls.exe
  "C:\Windows\System32\icacls.exe" "C:\Windows\system32\cmd.exe" /grant administrators:F
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:20540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 2776
  2⤵
  - Program crash
  PID:23000

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:7124
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1812 -ip 1812
1⤵
PID:26420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4060 -ip 4060
1⤵
PID:26452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4340 -ip 4340
1⤵
PID:26472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3116 -ip 3116
1⤵
PID:9388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc
1⤵
PID:26868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3752 -ip 3752
1⤵
PID:28336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

win_guard_0.exe

Path C:\Windows\Temp\RageCore_4f642669\win_guard_0.exe
Size 26KB
SHA256 5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd
MD5 efa0aeb1ee3dac26deb0ee1c4e233a99
SHA1 9eb66d1231c6c7e102ce91d207ada982e3e3f0a5
SHA512 fc5570a458fd1f2fa74e4b8026a8e0f7af59fabe1b32b6292b4abbffa622e4f9569cdc2006ffc21655cf83bf9040e1e06aaf7336bf95b63e9d363e0e286e7902
SSDEEP 384:KUlOyj1hF/q05ul9+K0b6SFDMH4YlTYbGGqTrJHehHQZJHljgCrPBXTl1nHBwLdp:Ka/q0Uvv05LYCbyg6llTlAd
TLSH
T17BC2D604B7FC4A24F2BE4F35197961404B3BBE169C22D75E0AC45D8E18767C88BA2B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-74-0x0000000074D60000-0x000000007551C000-memory.dmp

Download

memory/2576-7-0x0000000074D60000-0x000000007551C000-memory.dmp

Download

memory/4060-82-0x0000000074D60000-0x000000007551C000-memory.dmp

Download

memory/4060-3-0x00000000054F0000-0x0000000005582000-memory.dmp

Download

memory/4060-1-0x0000000000920000-0x000000000092C000-memory.dmp

Download

memory/4060-2-0x0000000005AB0000-0x000000000606A000-memory.dmp

Download

memory/4060-88-0x0000000074D60000-0x000000007551C000-memory.dmp

Download

memory/4060-70-0x0000000074D72000-0x0000000074D73000-memory.dmp

Download

memory/4060-0-0x0000000074D72000-0x0000000074D73000-memory.dmp

Download

memory/4340-6-0x0000000074D60000-0x000000007551C000-memory.dmp

Download

memory/4340-83-0x0000000074D60000-0x000000007551C000-memory.dmp

Download

memory/4340-86-0x0000000007400000-0x000000000740A000-memory.dmp

Download

memory/4340-71-0x0000000074D60000-0x000000007551C000-memory.dmp

Download

memory/4340-91-0x0000000074D60000-0x000000007551C000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads