cbc18abc563c1fe2d1a71c7bc2350807c62ecffdb02b11f1a34946b0777bd677

Resubmissions

23/04/2024, 14:45

240423-r4x2wahb3x10

23/04/2024, 04:30

240423-e4x1nada9110

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p1lZQttt.exe
Size 16.6MB
Sample240423-e4x1nada91
SHA256 cbc18abc563c1fe2d1a71c7bc2350807c62ecffdb02b11f1a34946b0777bd677
MD5 2168b2eff6aa08948aa8bec7304a3358
SHA1 b19f9edd3fa9a53a687120f778ce6b9bfd6c0ac1
SHA512 76f1963825df8b9cc7427127357216ce27a0e61f4b8500f7b2f6e65093fd98e7cdd7289a6867f223e23f2cedd10ae52ba72ccb21075c2eee70efeaca50f4f04b
SSDEEP 393216:NTwXfhOjgKZ2P/p3Sn+1LYLZBB33Iy0qc+CWWjJ8Kule9aMnUkQQ:25Oj7Gp3S+5+dcWWjJJuhR5Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bootkit evasion persistence ransomware themida trojan

Malware Config

Signatures

Deletes NTFS Change Journal 2 TTPs 64 IoCs

The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

ransomware

Inhibit System Recovery

T1490

Data Destruction

T1485

pid	Process
5640	fsutil.exe
3744	fsutil.exe
4392	fsutil.exe
4752	fsutil.exe
5984	fsutil.exe
5496	fsutil.exe
5792	fsutil.exe
5260	fsutil.exe
4944	fsutil.exe
4672	fsutil.exe
1624	fsutil.exe
6096	fsutil.exe
2192	fsutil.exe
5764	fsutil.exe
4580	fsutil.exe
3160	fsutil.exe
3652	fsutil.exe
4960	fsutil.exe
2444	fsutil.exe
1448	fsutil.exe
4200	fsutil.exe
6012	fsutil.exe
1696	fsutil.exe
5084	fsutil.exe
3780	fsutil.exe
4856	fsutil.exe
4440	fsutil.exe
1924	fsutil.exe
1696	fsutil.exe
6040	fsutil.exe
1376	fsutil.exe
5848	fsutil.exe
4284	fsutil.exe
2532	fsutil.exe
2304	fsutil.exe
2292	fsutil.exe
2520	fsutil.exe
4396	fsutil.exe
6096	fsutil.exe
264	fsutil.exe
4180	fsutil.exe
3040	fsutil.exe
4660	fsutil.exe
4332	fsutil.exe
4560	fsutil.exe
2396	fsutil.exe
372	fsutil.exe
4900	fsutil.exe
4308	fsutil.exe
5556	fsutil.exe
5352	fsutil.exe
724	fsutil.exe
5692	fsutil.exe
4856	fsutil.exe
4860	fsutil.exe
5328	fsutil.exe
5836	fsutil.exe
1792	fsutil.exe
1712	fsutil.exe
1824	fsutil.exe
5476	fsutil.exe
2004	fsutil.exe
4180	fsutil.exe
4980	fsutil.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	p1lZQttt.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\w32time\Parameters\ServiceDll = "C:\\Windows\\SYSTEM32\\w32time.DLL"	w32tm.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	p1lZQttt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	p1lZQttt.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/876-0-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-2-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-3-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-4-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-5-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-76-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-113-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-200-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-348-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-435-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-732-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-819-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-950-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-1034-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-1181-0x0000000140000000-0x00000001428C5000-memory.dmp	themida
behavioral2/memory/876-1308-0x0000000140000000-0x00000001428C5000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	p1lZQttt.exe

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	MBR2GPT.EXE
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\F:	MBR2GPT.EXE
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\D:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	vds.exe
File opened for modification	\??\PhysicalDrive0	MBR2GPT.EXE

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
876	p1lZQttt.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Prefetch\ASPNET_REGIIS.EXE-A5891C91.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-01E21A55.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-A3608B1E.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-ACEF2FA2.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-A73FB9CB.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-32DA767E.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-97BCF638.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-94A02D86.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\SGRMBROKER.EXE-0CA31CC6.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\PfSvPerfStats.bin	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-6F2A95AF.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-C4B5739C.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\WFSERVICESREG.EXE-766D3C5B.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl	powershell.exe
File opened for modification	C:\Windows\Prefetch\NGEN.EXE-EC3F9239.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-7194EF5E.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-894C9E34.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pf	powershell.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	vds.exe
File opened for modification	C:\Windows\Prefetch\ResPriHMStaticDb.ebd	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-08AF006C.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-4BA0E729.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-156D43F1.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-4DC9A20E.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-B2C296EF.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-D71F3FEA.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\TIWORKER.EXE-C101ABCD.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\12T9_P.EXE-1AB905A3.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-18665B15.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-C8D69DC6.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-4DE02988.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-23EA2E5B.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-7E8D1C35.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-D2B15AE2.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-3ED30A86.pf	powershell.exe
File opened for modification	C:\Windows\diagerr.xml	MBR2GPT.EXE
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-641DCE1C.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-7F337F0A.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-DB926CB0.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\WFSERVICESREG.EXE-3EE82250.pf	powershell.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Prefetch\ASPNET_REGIIS.EXE-945CDB73.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\DISM.EXE-DE199F71.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-1589E4C3.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-7BB97BF6.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-7EF4A0DD.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\AgAppLaunch.db	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-0521102C.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-61696F68.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\BACKGROUNDTRANSFERHOST.EXE-CF5B50C1.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-28A8211F.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-2C52326A.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-FFCC5BB3.pf	powershell.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Prefetch\LINQWEBCONFIG.EXE-0FDCD1CB.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-976DB280.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-AE5EC6E9.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-8102A33C.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-9F4DB6F5.pf	powershell.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\rblayout.xin	powershell.exe
File opened for modification	C:\Windows\Prefetch\AUDIODG.EXE-BDFD3029.pf	powershell.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1316	sc.exe
5084	sc.exe
5300	sc.exe
4744	sc.exe
5808	sc.exe
5452	sc.exe
6072	sc.exe
4480	sc.exe
2344	sc.exe
4660	sc.exe
2020	sc.exe
740	sc.exe
5048	sc.exe
1508	sc.exe
2844	sc.exe
3040	sc.exe
6028	sc.exe
4192	sc.exe
4828	sc.exe
3568	sc.exe
5196	sc.exe
2712	sc.exe
5244	sc.exe
2872	sc.exe
1580	sc.exe
776	sc.exe
1792	sc.exe
6084	sc.exe
4660	sc.exe
1824	sc.exe
5040	sc.exe
2132	sc.exe
6088	sc.exe
3040	sc.exe
5448	sc.exe
5296	sc.exe
2936	sc.exe
1868	sc.exe
2336	sc.exe
3956	sc.exe
1480	sc.exe
5816	sc.exe
2532	sc.exe
1356	sc.exe
2148	sc.exe
5156	sc.exe
5844	sc.exe
3540	sc.exe
2928	sc.exe
5948	sc.exe
5376	sc.exe
2264	sc.exe
2032	sc.exe
5588	sc.exe
2216	sc.exe
5444	sc.exe
5160	sc.exe
3720	sc.exe
1164	sc.exe
2932	sc.exe
3532	sc.exe
5240	sc.exe
5264	sc.exe
5816	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 25 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009fcbbddfdba92f8e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009fcbbddf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809009fcbbddf000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9fcbbddf000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009fcbbddf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009fcbbddf618c21ba0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009fcbbddf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000e0e63a000000ffffffff0000000007000100006809009fcbbddf000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0f93a0000000000400600000000ffffffff000000000c00010000d87c1d9fcbbddf000000000000b0f93a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9fcbbddf000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009fcbbddfdea92fae0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009fcbbddf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000e0e63a000000ffffffff0000000007000100006809009fcbbddf000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9fcbbddf000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009fcbbddf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009fcbbddf618c06ba0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009fcbbddf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000e0e63a000000ffffffff0000000007000100006809009fcbbddf000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0f93a0000000000400600000000ffffffff000000002700010000d87c1d9fcbbddf000000000000b0f93a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9fcbbddf000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	vds.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vds.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\AttributesTableCache = a2a0d0ebe5b9334487c068b6b72699c70000000000000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	vds.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4372	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE	p1lZQttt.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3464	powershell.exe
3464	powershell.exe
1480	powershell.exe
1480	powershell.exe
1696	powershell.exe
1696	powershell.exe
4700	powershell.exe
4700	powershell.exe
1480	powershell.exe
1696	powershell.exe
4700	powershell.exe
4780	powershell.exe
4780	powershell.exe
4780	powershell.exe
1356	powershell.exe
1356	powershell.exe
1356	powershell.exe
4104	powershell.exe
4104	powershell.exe
4104	powershell.exe
4436	powershell.exe
4436	powershell.exe
4436	powershell.exe
1452	powershell.exe
1452	powershell.exe
1452	powershell.exe
3996	powershell.exe
3996	powershell.exe
3996	powershell.exe
516	powershell.exe
516	powershell.exe
516	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
2844	powershell.exe
2844	powershell.exe
2844	powershell.exe
1696	powershell.exe
1696	powershell.exe
1696	powershell.exe
4516	powershell.exe
4516	powershell.exe
4516	powershell.exe
1376	powershell.exe
1376	powershell.exe
1376	powershell.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
1160	powershell.exe
1160	powershell.exe
1160	powershell.exe
3096	powershell.exe
3096	powershell.exe
3096	powershell.exe
1664	powershell.exe
1664	powershell.exe
1664	powershell.exe
2148	powershell.exe
2148	powershell.exe
2148	powershell.exe
3160	powershell.exe
3160	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4948	vds.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeSystemtimePrivilege	2444	svchost.exe
Token: SeSystemtimePrivilege	2444	svchost.exe
Token: SeIncBasePriorityPrivilege	2444	svchost.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeSystemEnvironmentPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeSystemtimePrivilege	2444	svchost.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeDebugPrivilege	516	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeSystemtimePrivilege	3268	svchost.exe
Token: SeSystemtimePrivilege	3268	svchost.exe
Token: SeIncBasePriorityPrivilege	3268	svchost.exe
Token: SeDebugPrivilege	4048	powershell.exe
Token: SeSystemtimePrivilege	3268	svchost.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	3096	powershell.exe
Token: SeTakeOwnershipPrivilege	3780	ReAgentc.exe
Token: SeBackupPrivilege	4664	MBR2GPT.EXE
Token: SeRestorePrivilege	4664	MBR2GPT.EXE
Token: SeSecurityPrivilege	4664	MBR2GPT.EXE
Token: SeRestorePrivilege	4664	MBR2GPT.EXE
Token: SeRestorePrivilege	4664	MBR2GPT.EXE
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	3160	powershell.exe
Token: SeRestorePrivilege	4948	vds.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	5396	powershell.exe
Token: SeDebugPrivilege	5592	powershell.exe
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeDebugPrivilege	5696	powershell.exe
Token: SeDebugPrivilege	5860	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeDebugPrivilege	5332	powershell.exe
Token: SeDebugPrivilege	5400	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	5596	powershell.exe
Token: SeDebugPrivilege	5916	powershell.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeDebugPrivilege	5396	powershell.exe
Token: SeDebugPrivilege	5812	powershell.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
876	p1lZQttt.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
876	p1lZQttt.exe
876	p1lZQttt.exe
876	p1lZQttt.exe
876	p1lZQttt.exe
876	p1lZQttt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 3464	876	p1lZQttt.exe	90
PID 876 wrote to memory of 3464	876	p1lZQttt.exe	90
PID 876 wrote to memory of 2148	876	p1lZQttt.exe	380
PID 876 wrote to memory of 2148	876	p1lZQttt.exe	380
PID 2148 wrote to memory of 4300	2148	net.exe	94
PID 2148 wrote to memory of 4300	2148	net.exe	94
PID 876 wrote to memory of 4936	876	p1lZQttt.exe	539
PID 876 wrote to memory of 4936	876	p1lZQttt.exe	539
PID 876 wrote to memory of 3888	876	p1lZQttt.exe	255
PID 876 wrote to memory of 3888	876	p1lZQttt.exe	255
PID 876 wrote to memory of 2512	876	p1lZQttt.exe	99
PID 876 wrote to memory of 2512	876	p1lZQttt.exe	99
PID 2512 wrote to memory of 4104	2512	net.exe	365
PID 2512 wrote to memory of 4104	2512	net.exe	365
PID 876 wrote to memory of 4700	876	p1lZQttt.exe	379
PID 876 wrote to memory of 4700	876	p1lZQttt.exe	379
PID 876 wrote to memory of 1696	876	p1lZQttt.exe	313
PID 876 wrote to memory of 1696	876	p1lZQttt.exe	313
PID 876 wrote to memory of 1480	876	p1lZQttt.exe	287
PID 876 wrote to memory of 1480	876	p1lZQttt.exe	287
PID 876 wrote to memory of 2844	876	p1lZQttt.exe	327
PID 876 wrote to memory of 2844	876	p1lZQttt.exe	327
PID 876 wrote to memory of 3744	876	p1lZQttt.exe	470
PID 876 wrote to memory of 3744	876	p1lZQttt.exe	470
PID 876 wrote to memory of 2216	876	p1lZQttt.exe	113
PID 876 wrote to memory of 2216	876	p1lZQttt.exe	113
PID 876 wrote to memory of 3456	876	p1lZQttt.exe	133
PID 876 wrote to memory of 3456	876	p1lZQttt.exe	133
PID 876 wrote to memory of 4780	876	p1lZQttt.exe	260
PID 876 wrote to memory of 4780	876	p1lZQttt.exe	260
PID 876 wrote to memory of 1356	876	p1lZQttt.exe	632
PID 876 wrote to memory of 1356	876	p1lZQttt.exe	632
PID 876 wrote to memory of 4104	876	p1lZQttt.exe	365
PID 876 wrote to memory of 4104	876	p1lZQttt.exe	365
PID 876 wrote to memory of 4580	876	p1lZQttt.exe	538
PID 876 wrote to memory of 4580	876	p1lZQttt.exe	538
PID 4580 wrote to memory of 3592	4580	net.exe	186
PID 4580 wrote to memory of 3592	4580	net.exe	186
PID 876 wrote to memory of 2368	876	p1lZQttt.exe	130
PID 876 wrote to memory of 2368	876	p1lZQttt.exe	130
PID 876 wrote to memory of 2396	876	p1lZQttt.exe	132
PID 876 wrote to memory of 2396	876	p1lZQttt.exe	132
PID 876 wrote to memory of 4860	876	p1lZQttt.exe	158
PID 876 wrote to memory of 4860	876	p1lZQttt.exe	158
PID 876 wrote to memory of 3160	876	p1lZQttt.exe	559
PID 876 wrote to memory of 3160	876	p1lZQttt.exe	559
PID 876 wrote to memory of 4936	876	p1lZQttt.exe	663
PID 876 wrote to memory of 4936	876	p1lZQttt.exe	663
PID 876 wrote to memory of 1604	876	p1lZQttt.exe	204
PID 876 wrote to memory of 1604	876	p1lZQttt.exe	204
PID 876 wrote to memory of 4480	876	p1lZQttt.exe	142
PID 876 wrote to memory of 4480	876	p1lZQttt.exe	142
PID 876 wrote to memory of 2444	876	p1lZQttt.exe	190
PID 876 wrote to memory of 2444	876	p1lZQttt.exe	190
PID 876 wrote to memory of 1612	876	p1lZQttt.exe	247
PID 876 wrote to memory of 1612	876	p1lZQttt.exe	247
PID 876 wrote to memory of 1580	876	p1lZQttt.exe	175
PID 876 wrote to memory of 1580	876	p1lZQttt.exe	175
PID 876 wrote to memory of 4436	876	p1lZQttt.exe	343
PID 876 wrote to memory of 4436	876	p1lZQttt.exe	343
PID 876 wrote to memory of 1452	876	p1lZQttt.exe	357
PID 876 wrote to memory of 1452	876	p1lZQttt.exe	357
PID 876 wrote to memory of 3996	876	p1lZQttt.exe	315
PID 876 wrote to memory of 3996	876	p1lZQttt.exe	315

C:\Users\Admin\AppData\Local\Temp\p1lZQttt.exe
"C:\Users\Admin\AppData\Local\Temp\p1lZQttt.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command Remove-Item 'C:\Users\Admin\AppData\Local\Temp\p1lZQttt.exe.bak' -force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\SYSTEM32\net.exe
  net stop w32time
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop w32time
    3⤵
    PID:4300
- C:\Windows\SYSTEM32\w32tm.exe
  w32tm /unregister
  2⤵
  PID:4936
- C:\Windows\SYSTEM32\w32tm.exe
  w32tm /register
  2⤵
  - Sets DLL path for service in the registry
  PID:3888
- C:\Windows\SYSTEM32\net.exe
  net start w32time
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start w32time
    3⤵
    PID:4104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell (GWMI Win32_Processor).VirtualizationFirmwareEnabled
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "$env:firmware_type"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "confirm-securebootuefi"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Windows\SYSTEM32\w32tm.exe
  w32tm /resync /force
  2⤵
  PID:2844
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:3744
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:2216
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:3456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- C:\Windows\SYSTEM32\net.exe
  net stop w32time
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop w32time
    3⤵
    PID:3592
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  PID:2368
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:2396
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3456
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4860
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:3160
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:4936
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:1604
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:4480
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:2444
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:1612
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3996
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:4180
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4672
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4392
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:3300
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  - Launches sc.exe
  PID:740
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  - Launches sc.exe
  PID:3568
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:1316
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:3976
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:2332
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:1436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:2444
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:2304
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4180
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:4048
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:3976
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  - Launches sc.exe
  PID:2344
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:5048
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1436
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:1824
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:3232
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:4668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  PID:2148
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:2292
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:1824
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  - Launches sc.exe
  PID:3720
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:4580
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  - Launches sc.exe
  PID:776
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:1508
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:1600
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:5084
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3096
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:4980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1612
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:3040
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:5084
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:3792
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:2712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3888
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  - Launches sc.exe
  PID:3956
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  PID:4900
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reagentc /enable
  2⤵
  PID:2252
- - C:\Windows\system32\ReAgentc.exe
    reagentc /enable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mbr2gpt /convert /allowFullOS
  2⤵
  PID:3996
- - C:\Windows\system32\MBR2GPT.EXE
    mbr2gpt /convert /allowFullOS
    3⤵
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4664
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:1160
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:4564
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:4624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:1624
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4580
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:2520
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:1300
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  - Launches sc.exe
  PID:1480
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:2768
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  PID:2872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4624
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:412
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:4516
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:3780
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4752
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:1696
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:3996
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:4560
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:4840
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  PID:2704
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:2032
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:4136
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:2844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1920
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:4396
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4200
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4660
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  - Launches sc.exe
  PID:1792
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:4436
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:5068
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  PID:2588
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:2672
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:4900
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:1164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:4308
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4560
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4104
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4332
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:516
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  - Launches sc.exe
  PID:4660
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:2984
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  PID:764
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.diskpart.com/features/convert-mbr-gpt.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffcf3af46f8,0x7ffcf3af4708,0x7ffcf3af4718
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13777967377018596809,15921603240270211428,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,13777967377018596809,15921603240270211428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,13777967377018596809,15921603240270211428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13777967377018596809,15921603240270211428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13777967377018596809,15921603240270211428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13777967377018596809,15921603240270211428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13777967377018596809,15921603240270211428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
    3⤵
    PID:5904
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:5244
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:5300
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:5352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5788
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:5984
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:6040
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:6096
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:2984
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  - Launches sc.exe
  PID:5156
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:5220
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  PID:5256
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:5532
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:5448
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6076
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  PID:5264
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:5328
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:264
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:5300
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:5468
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  - Launches sc.exe
  PID:5444
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  PID:5440
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:2172
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:5240
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:5296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2032
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:5836
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4900
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2344
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:1376
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  - Launches sc.exe
  PID:5196
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:6104
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:2488
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:5948
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:5872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3744
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:3108
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:5476
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:5496
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:5556
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:5624
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  - Launches sc.exe
  PID:4744
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  - Launches sc.exe
  PID:5808
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:6084
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:6036
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:5816
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:6004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3108
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:1792
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Enumerates connected drives
  PID:1296
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:6096
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:2496
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  - Launches sc.exe
  PID:5040
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:5328
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:5264
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:5224
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4564
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:5376
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:5316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5984
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:5352
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:5792
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:5848
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4580
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:4936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5872
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:5972
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:2332
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  PID:5916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5084
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:2264
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:2936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:740
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:3976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:6140
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:3160
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Enumerates connected drives
  PID:5688
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Enumerates connected drives
  PID:5988
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  - Launches sc.exe
  PID:6028
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:6016
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  - Launches sc.exe
  PID:1868
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  PID:1268
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:4900
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:5836
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:6108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:2028
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  PID:372
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Enumerates connected drives
  PID:1356
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4856
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:5284
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:5088
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5220
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:3992
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:5452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5476
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:6048
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:4192
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:5800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:4900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:1376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5860
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:4284
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4048
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:2192
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:1712
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  - Launches sc.exe
  PID:2264
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:4464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:516
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  - Launches sc.exe
  PID:2932
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4516
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:2532
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:5144
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4664
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:1356
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:5548
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:1752
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:2004
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:1448
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1868
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:5640
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:2492
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:3928
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:1696
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:5844
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:6064
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:5540
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5048
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:6124
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:2532
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2028
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:5692
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2172
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:372
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:5328
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:5468
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5548
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:1924
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3992
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  PID:5568
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:5452
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:2712
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:4568
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4744
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:2536
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:4116
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:5968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:1944
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:1364
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:5764
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5956
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4440
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:3652
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4624
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:996
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  - Launches sc.exe
  PID:6072
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4284
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  - Launches sc.exe
  PID:2148
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3200
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:4856
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:372
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:1824
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:5260
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:1924
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:5072
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  - Launches sc.exe
  PID:3540
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  PID:2364
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5904
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:5588
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:1588
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  PID:3288
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:3532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5748
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5556
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:1700
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:1696
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:6012
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2384
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:3744
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5972
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  PID:5048
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  PID:1600
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  - Launches sc.exe
  PID:6088
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5696
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  PID:4780
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:4200
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:5244
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5200
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  PID:3704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:3464
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4180
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:2340
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6072
- C:\Windows\SYSTEM32\sc.exe
  sc stop "PcaSvc"
  2⤵
  - Launches sc.exe
  PID:2872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:4044
- C:\Windows\SYSTEM32\sc.exe
  sc config "PcaSvc" start=disabled
  2⤵
  - Launches sc.exe
  PID:3040
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'C:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'D:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:5312
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5296
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  - Deletes NTFS Change Journal
  PID:4944
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Remove-Item 'F:\Windows\Prefetch\*' -force -recurse -ErrorAction SilentlyContinue"
  2⤵
  PID:1448
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5968
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d D:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:4960
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5724
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d F:
  2⤵
  - Deletes NTFS Change Journal
  - Enumerates connected drives
  PID:724
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2488
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SysMain"
  2⤵
  - Launches sc.exe
  PID:4828
- C:\Windows\SYSTEM32\sc.exe
  sc config "SysMain" start=disabled
  2⤵
  - Launches sc.exe
  PID:5160
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1268
- C:\Windows\SYSTEM32\sc.exe
  sc stop "SuperFetch"
  2⤵
  - Launches sc.exe
  PID:5816
- C:\Windows\SYSTEM32\fsutil.exe
  fsutil usn deletejournal /d C:
  2⤵
  PID:1064
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5756
- C:\Windows\SYSTEM32\sc.exe
  sc config "SuperFetch" start=disabled
  2⤵
  - Launches sc.exe
  PID:2020
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C timeout /t 1 /nobreak > nul & del "C:\Users\Admin\AppData\Local\Temp\p1lZQttt.exe"
  2⤵
  PID:5844
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s w32time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe e8ea73972b9b31a05ef9a7026d1bbc83 ES0I26CFoUa4FNk+clpPEg.0.1.0.0.0
1⤵
PID:1580

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s w32time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:516

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3536

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:5396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Destruction

T1485

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10
MD5 559ff144c30d6a7102ec298fb7c261c4
SHA1 badecb08f9a6c849ce5b30c348156b45ac9120b9
SHA512 3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b
MD5 e36b219dcae7d32ec82cec3245512f80
SHA1 6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466
SHA512 fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 7851dfbc4fc36c71f9601206870a72912db441506f027139bc77e34a9df3ddb5
MD5 fafb9a5cdcdb03502ae8c3808e8acd3f
SHA1 2a560a125126e81dd5a08dd596b5765a1a107c26
SHA512 bd6df2bf670fab7510cb2d8e3cb0f521aa364a52bfd984950900b3f80c631db401d8797d61726d4b102f2b84b3e177c8519b0619ae72084312933a1eda95154a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 feb5daf64944a9bcb14aa892b1623dce27d08c39ef4d2b78b88247e560d48905
MD5 53c18c6a3c528904e098ebe5efca48ad
SHA1 62e43191423637b7048a91bcf17ac38856767773
SHA512 de3fc9b8e5469d452b07a1c4ac87d6308f948be2b70f681cd5960bb336883b84089801ef0281dc7659e5eb75ef1dc1ca875670a64503231755f349f5924414e1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e8279da5cc5c50b7cdd54bb78e910882eff3efb281d91901da4fa2751a4a99fd
MD5 c0b54f46e7f472da22cefa6d23fe6d48
SHA1 a5184f08b8c838c89f161247a489e6ad38266a1f
SHA512 13b80a911a3721a36d3e2b27b4ee76fa1d6ea8f2e74545c5856740f50ed168de58e6241f4251f28d4f126cb0570ea64bc76fd408598ac5153b49f7abbc7f5ead
SSDEEP 96:nDksvxm/YQYmqK1JggDRwpvWMoiVmdeHvxeKqCUWQyV+VDCziEwb:nDksE9pLggDRGWMXZ5qCro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 11ccd6dad186992fdde478b8c9863312f07e4672116039c8605777f4fecc09e9
MD5 7c3f436784ff4533dc3becae934ae940
SHA1 086fd99ad3916a0033dfe4bb267e7e7e7c171252
SHA512 58c0d56ed823b1a4da18713ffe02e7c17ef7f98a97a57d1f937af1b6c11ed59f72dcb848dfed4cc24aa26a6e132c79c4c8aef3cfd75da94d9a223ad3efa68f70
SSDEEP 96:nDkjxm/YDmqK1JgCDRwpvWMoiuR5mdeoutS18vzEsEVfg2vxOoqMyWQyV+VD7Aih:nDkQDpLgCDRGWMumukOYsEVfg2ZZqMlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3acdac68de5839398c1c8c7fe1a46cf7123a96613e6303e41a235efc757003f2
MD5 68aaf058486873beb4169837142fa14f
SHA1 a061f9959d0a5373af60dbd3ca07455300cc9a79
SHA512 67b13a1601eae5c8b59d7509bc8e047e713793ea1614bd9decc0dffe0e2ec1c719a66318773223e485c185edddd950ad977b084a04bd5b8e070f167a0f160be3
SSDEEP 192:JoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKI/b5qSde2RUE1fz2+OblT:19iIxuERzA83h09RZxY3l5Tl2/XDafEn
MD5 SHA1 SHA512 SSDEEP

Submit Download